28-06-2003 16:48									#1
	This looks like fun: fundamental security flaw in Windows that cannot be patched Full PM-box? Change here!

"Unfixable" flaw breaks Microsoft's Windows

quote: The flaw is part of the fundamental design of the Windows operating system. It is contained within the mechanism that controls the flow of messages between different windows on the desktop. This is called the Win32 API and has remained unchanged since 1993. Critically, the Win32 API system does not authenticate the messages, so cannot distinguish messages from malicious or legitimate sources. This allowed Paget to select a window with the highest privileges and surreptitiously embed a malicious piece of code. When executed, the code would increase his user privileges to the maximum given to that window.

So what's the latest news on this? Has anything been done about it?

	28-06-2003 16:52									#2
	Got spare money?

Why can I only forsee an argument breaking out over this thread, as opposed to intelligent discussion?

	28-06-2003 16:57									#3
	Full PM-box? Change here!

*sits and waits for Asher*

	28-06-2003 17:00									#4
	Increase the size of your Attachments

*Decides to leave before Asher even arrives*

	29-06-2003 05:46									#5
	Support Apolyton buy from Amazon

Win32 is obsolete and is deprecated.

	29-06-2003 05:47									#6
	Support Apolyton, buy Galactic Civilizations

And there you have it.

	29-06-2003 05:53									#7
	Enter the AD-FREE zone

And the article is a bit misleading as to how serious this really is.

	29-06-2003 07:41									#8
	Support Apolyton buy from Amazon

On XP, most users log in as Administrators anyway. So what's the point of an exploit that lets you run code as an administrator when users run it like that intentionally most of the time?

Do they do that in corporate environments?

	29-06-2003 07:50									#9
	Help yourself to an AD-FREE life

quote: On XP, most users log in as Administrators anyway. So what's the point of an exploit that lets you run code as an administrator when users run it like that intentionally most of the time?

i don't think most people realize they are running it as an administrator. after all, when they run setup, they see an "administrator" account, and then it asks for their name.

most people probably don't realize they have all the power of a superuser...

	29-06-2003 07:58									#10
	Support Apolyton, buy Civilization III: Complete

Huh? Who do they think has that power then?

	29-06-2003 08:12									#11
	Support Apolyton

they may not realize such power exists, st leo. not to downplay the intelligence of the average computer user, but i've found that while working in tech support, most users have no idea that their default windows account has administrator priviledges. things install for them, and that's all they care about. they naturally don't know how to use "services" or "computer management", nor do they often bother with "internet options", "control panel", and the like--which are all accessible on the default named account.

	29-06-2003 08:17									#12
	Support Apolyton, pre-order Civilization IV

Believe me, most people, including and especially my wife, should not have administrator privileges on any computer.

	29-06-2003 08:24									#13
	Support Apolyton, pre-order Civilization IV

quote: Originally posted by St Leo On XP, most users log in as Administrators anyway. So what's the point of an exploit that lets you run code as an administrator when users run it like that intentionally most of the time? Do they do that in corporate environments?

Yes. However, they are "administrators" on their own boxes only with that logon. They are not administrators on remote boxes or on NT/2k domains unless granted those priveleges separately in the appropriate places.

	29-06-2003 21:36									#14
	Support Apolyton buy from Amazon

The reason XP defaults new accounts to administrator is for ease of use considerations.

Most games and applications when XP launched required administrator privledges to install because of how Win9x was designed. It'd be a huge pain in the ass (and confusing) for most people to have it tell you that you need an Administrator account to install a simple game.

Most games and apps out right now are properly configured and install on a per-user basis rather than per-system, so they do not require administrator accounts.

In Longhorn, not only will a limited account be the default, but .NET apps will more than likely far outnumber old Win32 apps.

	30-06-2003 00:57									#15
	Support Apolyton buy from Amazon

hi ,



thanks for OS X and its cats , ....

from apple bien sure , .....

have a nice day

	30-06-2003 00:59									#16
	Support Apolyton, buy Civilization 2

I use windows 98

the best windows out there

	30-06-2003 00:59									#17
	Support Apolyton

Panag, OS X is succeptible to the same thing thanks to its Unix heritage.

Try it yourself:

quote: make a copy of a shell program (e.g. csh, bash, sh, ksh, whatever) in your user area. Write some code that figures out where the inode table (which is usually cached in RAM) entry for that file resides in memory. Trap into a debugger, and set the suid root bit for that file. Resume the operating system. Run the shell - you now have a command prompt with root privileges.

	30-06-2003 01:05									#18
	Lose 30 kilos (of popups)

quote: Originally posted by Asher Panag, OS X is succeptible to the same thing thanks to its Unix heritage. Try it yourself: quote: make a copy of a shell program (e.g. csh, bash, sh, ksh, whatever) in your user area. Write some code that figures out where the inode table (which is usually cached in RAM) entry for that file resides in memory. Trap into a debugger, and set the suid root bit for that file. Resume the operating system. Run the shell - you now have a command prompt with root privileges.

hi ,

*sigh* , .....

if you would just read the hot mac news ones in a while , ......

have a nice day

	30-06-2003 01:07									#19
	Support Apolyton buy from Amazon

*whacks panag on his hollow head with a ferret*

	30-06-2003 01:09									#20
	Lose 30 kilos (of popups)

Mac users have made it clear they don't want me in their forums.

It's a lot like how you wouldn't want to have an adult telling kids Santa isn't real in a Christian kids forum.

	30-06-2003 01:09									#21
	Increase Your PM Length

quote: Originally posted by Asher *whacks panag on his hollow head with a ferret*

hi ,

before you post crap like that , .....

spend at least one hour of your live in front of a mac from apple , ......

have a nice day

	30-06-2003 01:10									#22
	Support Apolyton, buy Civilization: The Boardgame

quote: Originally posted by Dissident I use windows 98 the best windows out there

no, XP

	30-06-2003 01:10									#23
	Suffering from ads?

quote: Originally posted by panag hi , before you post crap like that , ..... spend at least one hour of your live in front of a mac from apple , ...... have a nice day

If I call now, do I get a free pair of anal beads?

	30-06-2003 01:10									#24
	Support Apolyton, pre-order Civilization IV

quote: Originally posted by Asher Mac users have made it clear they don't want me in their forums. It's a lot like how you wouldn't want to have an adult telling kids Santa isn't real in a Christian kids forum.

hi ,

Asher , have you ever wondered why , ....

have a nice day

	30-06-2003 01:12									#25
	Increase the size of your Attachments

quote: Originally posted by panag hi , Asher , have you ever wondered why , .... have a nice day

I've determined I'll never understand why people buy Macs, because there is no real sense in it.

It's all about emotions and what they're used to. If they're happy paying huge gobs of money to Apple for that, so be it.

So yes, I have wondered why, there's just no real answer aside from "it's purty".

	30-06-2003 01:15									#26
	Got spare money?

On the same line of thought, I'll never understand why people buy Land Rovers.

They're grossly overpriced, notoriously crap in terms of reliability and quality, and they're fugly too (but the people who buy them insist they're the prettiest little big things on earth)

	30-06-2003 01:17									#27
	Support Apolyton, buy GURPS/ Alpha Centauri

quote: If I call now, do I get a free pair of anal beads?

Go thread, Go thread, Go thread, Go thread.


oink.

	30-06-2003 01:22									#28
	Got spare money?

quote: Originally posted by Asher I've determined I'll never understand why people buy Macs, because there is no real sense in it. It's all about emotions and what they're used to. If they're happy paying huge gobs of money to Apple for that, so be it. So yes, I have wondered why, there's just no real answer aside from "it's purty".

hi ,

but thats what you believe , ......

everyone has his or her own opinion , .....

you should not jump everywhere in each thread telling how bad this is or how bad that is , ......

especially when we see and experience the opposite of what you tell us , .....

have a nice day

	30-06-2003 01:24									#29
	Lose 30 kilos (of popups)

quote: Originally posted by panag hi , but thats what you believe , ...... everyone has his or her own opinion , .....

Of course, which is why I said they're free to blow their money on whatever they want.

Everyone's opinion does not make sense, though. Many people's opinions are based on irrational things and weird experiences...

quote: you should not jump everywhere in each thread telling how bad this is or how bad that is , ...... especially when we see and experience the opposite of what you tell us , .....

People see what they want to see. 95% of people see differently than you, what's the probability that the ~3% of computer users in the world are more correct than the other 95%, considering the 3% who buy Macs widely buy into Apple's blatantly false advertising.

	30-06-2003 01:29									#30
	Support Apolyton, buy Call to Power 2

quote: Originally posted by Asher Of course, which is why I said they're free to blow their money on whatever they want. Everyone's opinion does not make sense, though. Many people's opinions are based on irrational things and weird experiences... People see what they want to see. 95% of people see differently than you, what's the probability that the ~3% of computer users in the world are more correct than the other 95%, considering the 3% who buy Macs widely buy into Apple's blatantly false advertising.

hi ,

you are still missing the point , ......

we dont care , but one thing we do care about is how you jump on our backs in each thread , .....

and sometimes personal words are brought up and then , .....

imagine it would the way around , .... imagine you would have 25 mac people jumping on your back , each single day , week in , week out , ..... how would you feel , ......

you say apple has a false advertising , and windows and the others are holy saints and have never done that or are not doing that now , ...

have a nice day