90 percent of Windows 7 flaws fixed by removing admin rights


Recommended Posts

After tabulating all the vulnerabilities published in Microsoft's 2009 Security Bulletins, it turns out 90 percent of the vulnerabilities can be mitigated by configuring users to operate without administrator rights, according to a report by BeyondTrust. As for the published Windows 7 vulnerabilities through March 2010, 57 percent are no longer applicable after removing administrator rights. By comparison, Windows 2000 is at 53 percent, Windows XP is at 62 percent, Windows Server 2003 is at 55 percent, Windows Vista is at 54 percent, and Windows Server 2008 is at 53 percent. The two biggest exploited Microsoft applications also fare well: 100 percent of Microsoft Office flaws and 94 percent of Internet Explorer flaws (and 100 percent of IE8 flaws) no longer work.

This is good news for IT departments because it means they can significantly reduce the risk of a security breach by configuring the operating system for standard users rather than an administrator. Despite unpredictable and evolving attacks, companies can very easily protect themselves or at least reduce the effects of a newly discovered threat, as long as they're OK with their users not installing software or using many applications that require elevated privileges.

In total, 64 percent of all Microsoft vulnerabilities reported last year are mitigated by removing administrator rights. That number increases to 81 percent if you only consider security issues marked Critical, the highest rating Redmond gives out, and goes even higher to 87 percent if you look at just Remote Code Execution flaws. Microsoft published 74 Security Bulletins in 2009, spanning around 160 vulnerabilities (133 of those were for Microsoft operating systems). The report, linked below, has a list of all of them, which software they affect, and which ones are mitigated by removing admin rights.

90% of Critical Microsoft Windows 7 Vulnerabilities are Mitigated by Eliminating Admin Rights (pdf)

Source : ArsTechnica

So how much money did they get paid to come up with that foolish report..... How about you don't turn on your machine then 100% of the security holes are fixed.... Can I have ?500 for that please.

There's a prize for whoever can guess what happens the day no one will run anything as admin.

half of the windows programs wouldn't work anymore because they are designed by morons? Luckily vista and 7 take care of that by using a virtual store, but nonetheless ;)

There's a prize for whoever can guess what happens the day no one will run anything as admin.

Pigs fly, birds sing, grass grows, the sun shines, and people skip around singing hallelujah while their computers slowly eat themselves alive from the inside because some moron gets so fed up with not being able to install or run any sort of program that the swirling torrent of pain, anger, and misery that is his mind comes full circle and he just snaps.

the_more_you_know2.jpg

I know, I'm dramatic like that.

half of the windows programs wouldn't work anymore because they are designed by morons? Luckily vista and 7 take care of that by using a virtual store, but nonetheless ;)

More like all the malware will simply cease to require admin rights. They can do virtually all they want without it anyway. Back to square one. The idea that the user/admin separation has any real meaning on your average home computer from a security perspective is a misconception.

  • Like 2

well obviously, it's why in OSX and root user is disabled... what damage can you do when their no admin account?

Take what matters most to a user: their data. You only really need read-only access to get some valuable stuff.

delete all their files? get the contents of all their files?

And those are just two examples :)

but how do you get access to those files is you are say on a guest act or a user act that has no rights whatsoever? especially in a *unix based system.

I have just setup a laptop for my wife's mum. She lives about 200 miles away, so I wanted to get it all setup and ready to roll, without me driving down to fix it all the time...

I've installed everything I need - OS, Office, apps, etc. It's all configured.

But I know that at her end, she will need to install her printer, etc...

If I make her user a standard user (as opposed to a local administrator), will she be able to install drivers, and whatever apps she NEEDS?

Obviously as an admin, I get the UAC prompt and that's that. What will she get?

but how do you get access to those files is you are say on a guest act or a user act that has no rights whatsoever? especially in a *unix based system.

Erm, a user always has access to their own files. Malware usually runs with similar (or the same) privileges as the user.

Guest accounts are a little different because they don't have any permanent files. A guest account's whole user directory gets eradicated on logout.

but how do you get access to those files is you are say on a guest act or a user act that has no rights whatsoever? especially in a *unix based system.

because as a user you have access to your own files, hence all the malware running as that user also has access to the same files of course.

let's say you have a document on your pc that contains some private banking details, what would you fear most, malware attacking your system files and making your system unusable or malware sending those banking details to some hacker.

I have just setup a laptop for my wife's mum. She lives about 200 miles away, so I wanted to get it all setup and ready to roll, without me driving down to fix it all the time...

I've installed everything I need - OS, Office, apps, etc. It's all configured.

But I know that at her end, she will need to install her printer, etc...

If I make her user a standard user (as opposed to a local administrator), will she be able to install drivers, and whatever apps she NEEDS?

Obviously as an admin, I get the UAC prompt and that's that. What will she get?

a prompt that asks her for admin credentials

I have just setup a laptop for my wife's mum. She lives about 200 miles away, so I wanted to get it all setup and ready to roll, without me driving down to fix it all the time...

I've installed everything I need - OS, Office, apps, etc. It's all configured.

But I know that at her end, she will need to install her printer, etc...

If I make her user a standard user (as opposed to a local administrator), will she be able to install drivers, and whatever apps she NEEDS?

Obviously as an admin, I get the UAC prompt and that's that. What will she get?

logmein.com. just preinstall her wireless network and you can do it all yourself :D

logmein.com. just preinstall her wireless network and you can do it all yourself

Already put TeamViewer on it :)

a prompt that asks her for admin credentials

So I can create a hidden admin user purely to provide a set of credentials to her, which she could then use to elevate and install?

So I can create a hidden admin user purely to provide a set of credentials to her, which she could then use to elevate and install?

Yep, but UAC will prompt any time it needs elevation even if her user was an admin. Typing in credentials only requires a little more thought than clicking a button. Having an admin user that she's not logged in as vs. having an admin user that she is logged in as is really no different.

but how do you get access to those files is you are say on a guest act or a user act that has no rights whatsoever? especially in a *unix based system.

In what real world scenario do you have a user with no rights? You don't. There's no real difference between a Unix-like system and Windows there. Your user has access to all your files and data, can run programs, can make the programs automatically launch on startup, has access to the network, and so on. The only thing having admin/root rights gives you is the ability to infect other users on the system (which usually don't exist) and make it easier to hide deep in the system. These are bonuses rather than essentials, and there is a certain chance of obtaining them by tricking the user at some later point.

Obviously as an admin, I get the UAC prompt and that's that. What will she get?

She will get a different UAC prompt, one that asks for the username and password of someone with administrator rights. This is a dangerous prompt that you should avoid using.

Yep, but UAC will prompt any time it needs elevation anything. Having an admin user that she's not logged in as vs. having an admin user that she is logged in as is really no different.

Which is exactly how OSX does it? That works just dandy for me :)

Yep, but UAC will prompt any time it needs elevation even if her user was an admin. Typing in credentials is only requires a little more thought than clicking a button. Having an admin user that she's not logged in as vs. having an admin user that she is logged in as is really no different.

there is a psychological difference between typing a password or clicking a button.

Which is exactly how OSX does it? That works just dandy for me :)

Works like that even if she is an admin. :p Which means you don't need to change anything unless you just want that extra step for typing in credentials.

there is a psychological difference between typing a password or clicking a button.

You could also make a case that malware could emulate the look of this window and get her admin credentials (albeit probably without the driver disabling/screen dimming). Either way, giving something administrative privileges really doesn't mean anything. Any range of malware can run and do harm without them.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • One of the strangest galaxies in our Universe could help answer some long overdue questions by Sayan Sen Image by Pixabay via Pexels | Not representative An international team of astronomers led by the Department of Astronomy at Tsinghua University has discovered an unusually metal-poor galaxy that may contain signs of first-generation star formation. The galaxy, named Metal-Pristine Galaxy COSMOS Redshift 3 (MPG-CR3), or CR3, was identified using observations from the James Webb Space Telescope (JWST), the Very Large Telescope (VLT), and the Subaru Telescope. The findings, published in The Astrophysical Journal Letters, describe CR3 as the most metal-poor galaxy known from the period known as "cosmic noon," around 11.5 billion years ago. Cosmic noon refers to a period when the universe was producing stars at its highest rate and galaxies were growing rapidly. In astronomy, "metals" refers to all elements heavier than helium, including oxygen, carbon, and iron. Because CR3 contains so few of these heavier elements, researchers say it closely resembles what scientists expect the earliest galaxies in the universe may have looked like. The discovery is significant because it could offer clues about Population III (Pop III) stars, the first generation of stars thought to have formed after the Big Bang. These stars are believed to have formed from gas made almost entirely of hydrogen and helium, before heavier elements were created inside stars and spread across the universe through supernova explosions. Hence this is why CR3 has been referred to as a "living fossil." Scientists have long believed that Population III stars existed only in the very early universe. As more generations of stars formed and died, they enriched surrounding gas with heavier elements, making the conditions needed for metal-free star formation increasingly rare. Because of this, researchers expected the formation of such stars to have largely ended after the epoch of reionization, a period when radiation from the first stars and galaxies transformed the neutral hydrogen filling the universe and made it largely transparent to ultraviolet light. CR3 appears to challenge that idea. The galaxy was observed at a redshift of z = 3.193 ± 0.016. Redshift measures how much light from a distant object has been stretched as the universe expands and helps astronomers determine how far back in time they are looking. In this case, the redshift corresponds to roughly 11.5 billion years ago during cosmic noon. Although the universe was already several billion years old by that point, CR3 shows characteristics more commonly associated with much earlier galaxies. Observations revealed exceptionally strong emissions from hydrogen and helium, including Lyα, Hα, and He I λ10830. Lyα, or Lyman-alpha emission, is a specific wavelength of light produced by hydrogen and is widely used to study distant galaxies. Hα emission is another hydrogen signature commonly used to trace active star formation, while He I λ10830 is produced by helium and can indicate the presence of very hot, young stars. The measured equivalent widths of EW₀(Lyα) = 822 ± 101 Å and EW₀(Hα) = 2814 ± 327 Å are among the highest ever observed in star-forming galaxies. Equivalent width is a measure of the strength of an emission line relative to the surrounding light, and such large values are typically associated with intense and very recent star formation. At the same time, researchers found no statistically significant detections of metal emission lines, including [O III] λλ4959, 5007 and C IV λλ1548, 1550. Emission lines act as chemical fingerprints that reveal which elements are present in a galaxy. Oxygen and carbon lines are commonly seen in galaxies that have already undergone significant chemical enrichment. Their absence in CR3 suggests an unusually pristine environment. Using abundance calibration methods developed with JWST observations, the team placed a 2σ upper limit on the galaxy's gas-phase metallicity of 12+log(O/H)<6.52, corresponding to less than 0.7% of the Sun's metallicity (Z < 7 × 10⁻³ Z⊙). Gas-phase metallicity measures the abundance of heavy elements in a galaxy's gas. A 2σ upper limit indicates that the true value is very unlikely to be higher than the quoted threshold. Even when accounting for uncertainties in the calibration methods, the most conservative limit remains 12+log(O/H)<6.95, making CR3 the most metal-poor galaxy identified at cosmic noon. The galaxy also appears to contain very little dust. Researchers measured a Lyα/Hα flux ratio of 13.9 ± 2.5, a result that suggests negligible dust attenuation, meaning very little of the galaxy's light is being absorbed or scattered by cosmic dust. Because dust is usually produced by earlier generations of stars, this finding further supports the idea that CR3 has experienced very little chemical enrichment. Further analysis using spectral energy distribution modelling, a technique that compares observed light with theoretical models, suggests that CR3 contains an extremely young stellar population only around 2 million years old. The modelling, which used Population III stellar templates, also indicates the galaxy has a stellar mass of approximately 6.1 × 10⁵ M⊙. The symbol M⊙ represents one solar mass, or the mass of the Sun. One of the key questions raised by the discovery is how such a chemically primitive galaxy could exist in a universe that had already spent billions of years producing heavier elements. To investigate this, the researchers examined CR3's surroundings. Their analysis suggests the galaxy may lie in a slightly underdense environment, with a density contrast of roughly δ ≈ −0.12. An underdense region contains less matter and fewer galaxies than average. The team suggests that this relative isolation may have helped preserve pockets of pristine gas. Metal-rich material expelled from nearby galaxies may never have reached CR3, while the lower rate of galaxy mergers and interactions could have slowed the mixing of enriched gas into the system. If future observations confirm these findings, CR3 could provide some of the strongest evidence yet that first-generation star formation continued well after the epoch of reionization. Such a result would challenge the conventional view that pristine star formation ended by z ≳ 6 and suggest that small pockets of metal-free gas survived much longer than previously thought. Researchers stress that more observations will be needed to determine the galaxy's true nature. Future spectroscopic studies with higher resolution and better signal quality could help confirm whether CR3 is genuinely hosting Population III star formation. The discovery is also expected to encourage searches for other similar galaxies, which could help astronomers better understand how the first stars formed and how galaxies evolved in the early universe. Source: Tsinghua University, IOPscience This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing.
    • "I think in the immediate absence of a partner to apply relief" In the words of Sterling Archer... "Phrasing!"
    • For me, the fundamental problems with these "smartglasses" is that they really don't work well for people with significant prescriptions and massively up the price if you use attached lenses if they have displays, and if they don't, then they're not actually "smart" anything, rather just connecting to your phone and relaying voice to an AI. In a few cases like this, they throw in small cameras to feed video to the AI. All around, these feel like both a solution looking for a problem, and the problems it tries to solve seem more easily solved by different approaches and designs. Oddly, if the rumours are true, Apple may actually have invented something for once and it kind of does this right: put cameras in ear buds and manage the interface to AI exactly as most of us do: tapping on an ear bud and saying "Hey Google" or "Hey Siri." That makes them compatible with almost everyone, can double up as a hearing assist device, an impaired vision assist device, a "smart" device... and answer your phone and play music. That just seems like a better solution all around.
    • Usually the bigger ones with many fixes/changes take a few, theyre an exception to the rule most likely
    • If you don’t get lucky with Valve’s Steam Machine reservation system, you can make your own Steam Machine instead. Valve says that “starting with the SteamOS 3.8 release, you can put together your own Steam Machine using whatever PC parts you want.” SteamOS 3.8.10 launched last week with a slew of updates, including “improved compatibility with recent Intel and AMD platforms.” Alongside that improved compatibility, Valve is giving gamers the green light to install SteamOS on their own desktops. In an interview with The Verge, Valve’s Pierre-Loup Griffais said Valve has been “rolling out improvements to [SteamOS] so it’s more compatible with desktop hardware,” including eventual support for Nvidia graphics. Griffais says Valve has “a growing team” working on Nvidia driver support for SteamOS, adding, “We’re collaborating with Nvidia very closely.” While he mentioned that Nvidia support might not come this year, Griffais emphasized that “it’s certainly something that we’re working on in the background.”     Subscription not needed: https://archive.fo/Tssfc Subscription needed: https://www.theverge.com/games/953411/valve-steamos-desktop-nvidia
  • Recent Achievements

    • Dedicated
      HidekoYamamoto94 earned a badge
      Dedicated
    • One Month Later
      timbobit earned a badge
      One Month Later
    • One Month Later
      nates earned a badge
      One Month Later
    • Week One Done
      Almohandis earned a badge
      Week One Done
    • Rookie
      dorf went up a rank
      Rookie
  • Popular Contributors

    1. 1
      +primortal
      454
    2. 2
      +Edouard
      162
    3. 3
      PsYcHoKiLLa
      107
    4. 4
      Michael Scrip
      84
    5. 5
      Steven P.
      70
  • Tell a friend

    Love Neowin? Tell a friend!