Friday, May 8, 2009

The Admin Rights Argument

AKA "Why You Can't Have Admin Rights at Work"

Check out this video from Steve Gibson (Gibson Research Center) explaining the security ramifications of administrative rights on corporate PC's running Windows.

Admit it. You clicked the image thinking it was an embedded YouTube video didn't you. I could have fooled you into going anywhere and if you're logged in with Administrative privileges (which is quite likely if you're on your home PC running Windows), quite a bit more could have just happened.
Human sacrifice, dogs and cats living together. Mass hysteria!

I'm using a simple demonstration to point out a very basic flaw in human nature that is also one of our greatest strengths. We're very good at spotting patterns. Sometimes even where they
don't exist (Go ahead and click it. I wouldn't Rick Roll you twice in one post. I promise.). We couldn't get through a day if we had to actively analyze everything we see so we make assumptions based on known patterns. You see a large thing coming at you very fast. It's shaped roughly like a Volvo so you assume it is one and jump out of the way. Imagine what would happen if you had to figure out what a pair of shoes is everytime you see a different brand. What about a chair?

In this case, the image looks like a YouTube video so you assume it is one. We've all seen these embedded YouTube videos so many times we don't think much about them. Just click it and you get to see funny cats dancing with party hats on, or the kid who thought he could jump the park bench on his bike.

This is the attack method of modern malware. It's a lot easier to get someone to click a link in a web page or email than it is to find a technical software security vulnerability. Those are just bonus. If you're not an administrator, the malware will just fail to install in many cases.

I'll go into a longer dissertation about this issue later, but you rarely need Adminstrative access on your production PC to accomplish day-to-day, work-related tasks. This goes for developers and system administrators, too. This has long been the norm in the Unix and Linux world, with administrators running under a standard user account then elevating privileges as necessary, but when Microsoft attempted to implement the same thing in Vista they got grief for it. Even Apple's Mac OS X does the same thing that they mock Vista for, but their deceptive marketing practices are a topic for another time.

No comments:

Post a Comment