For the attack to work, users must be logged in as an administrator. #
Posted Wednesday 12th September 2007 21:34 GMT
Which is exactly why you only login to root for very special and limited circumstances...
Posted Wednesday 12th September 2007 21:34 GMT
Which is exactly why you only login to root for very special and limited circumstances...
Posted Wednesday 12th September 2007 23:06 GMT
Yeah, and how many Windows users are running as administrator, since the first account created is basically root?
Score one for the Linux camp, we don't even have QuickTime.
Posted Wednesday 12th September 2007 23:17 GMT
I have made in the past, I'm really not in the Windows, Open Source, or *inx camp. I just want tools that make business as easy as possible.
However, I do have to say early predictions about market dominance and (in)security are proving themselves true. As more people adopt non Windows products, more bad guys are going to target them. Hacking anything but MS has traditionally been a waste of time, but as other products start to acquire market share they become viable targets.
IT security for the masses is a joke. Considering that people have been trying for thousands of years to secure physical assets, and still fail, it'll be a really, really, long time before it's "absolutely safe" to be online.
Posted Thursday 13th September 2007 04:23 GMT
Guess it's the kind of risk, we have to take, to keep a dog-ugly POS operating system like Linux away from our computers...
Posted Thursday 13th September 2007 04:44 GMT
Anything that installs and associates itself, then demands money to enable features you previously had is malware.
Posted Thursday 13th September 2007 09:40 GMT
Any windows users stupid enough to be using quicktime as their primary media player deserve everything they get.
Quicktime doesn't even pretend to try and integrate into windows properly. It gives a nice mac user interface using mac interface conventions, which is infuriating if you are not using a Mac because they are completely different to all other applications.
Posted Thursday 13th September 2007 09:45 GMT
OS X' default user account privileges are admin-level, actually.
Posted Thursday 13th September 2007 09:58 GMT
"I see no reason why it shouldn't work on Mac" a simple test of the proof of concept shows that it does not work on a mac.
Posted Thursday 13th September 2007 13:49 GMT
Unfortunately, for Firefox to work, users must be logged in as an administrator.
Yet another Mozilla security hole due to poor input validation.... presumably this one will somehow be blamed on IE too.
Posted Thursday 13th September 2007 15:35 GMT
The "if more people used Linux/Unix there would be more exploits for it" argument is bogus. It's a variant of the "security through obscurity" argument, and is possibly a result of a too narrow-sighted view of IT as a whole.
The vast majority of Internet servers run Unix, yet Windows boxes remain the softest targets. Not because Unix machines can't be cracked (historically, most famous cracks were against Unix, which used to be perceived as having weak security compared to the competition!) or aren't attractive targets - in fact, cracked Unix hosts are highly prized among black hats because one can do more with them than with the average Windows PC.
The fact that vast hordes of Windows desktops can be trivially taken over by random script kiddies has litle to do with their market dominance, and the fact that this is harder to do with the various *nix flavours has little to do with their lack of presense in the desktop field.
Posted Thursday 13th September 2007 17:09 GMT
"Unfortunately, for Firefox to work, users must be logged in as an administrator."
That is completely untrue. Firefox works fine under a non-admin account. I'm using it on Vista under UAC right now and I have also used it on XP under a non-admin account.
Posted Thursday 13th September 2007 17:09 GMT
"admin-level" in OSX isn't the same as root. AFAICT, you get sudo privilege and access to files/folders in the admin group so you could do some damage but it is limited.
Obviously, more damage can be done once you have responded to a prompt for your password but who would be dumb enough to do that? Oh, wait...
Sign up, sign up for The Register's weekly IT security newsletter - click here