SuRun: Easily running Windows XP as a limited user

tlu - some good info there.

We must not forget that if a LUA gets infected nothing else on the machine will get infected.

I prefer to login as admin to manage my machines or using "run as"
I run LUA at home and it is also domain policy at work.
SuRun does sound like a good alternative for those who NEED to run apps with admin rights all the time (I personally wont use anything that requires admin rights).
It is also worth reviewing the default file permissions, removing everybody permissions for starters on all drive.

 

Good advice to lock down the autostart locations for restricted accounts if they are public. But if the computer/restricted account isn´t public, I would, for avoiding the above quoted issue when tweaking/changing settings, rather let for example Winpooch or Regdefend watch over those locations for manage it easier and faster. But that´s a matter of taste.

/C.

 

That's probably how it is now for most home users (it is in my case). However, privilege escalation vulnerabilities do exist. (example) Of course, keeping all software updated mitigates against vulnerabilities that are known and have patches.

I do the same, and run applications requiring admin access from within the admin account. Privilege escalation vulnerabilities aren't limited to the OS. Any vulnerable application that has admin rights can be exploited to gain admin access. Though only working locally, here is an example found in the wild: (Privilege Escalation Exploit In the Wild)


As helpful as LUAs are in protecting a patched OS, this developer and others here have made clear:

 

I fully concur.

I concur to this statement as well. There are malware classes that works perfectly in a restricted account, but by locking down/monitoring all the autostart locations adviced by tlu, applying software restriction policies and managing the user permissions, I would say that you can combat most of these classes effectively. What I´m worried about even after applying all of the above mentioned, are scriptbased/serverbased malware that runs within your browser and also the weak link when installing/updating new software without access to any hash check. Here can´t a LUA help you I´m afraid, therefore the necessity of third part security tools.

/C.

 

I found SuRun a much more comfortable way to manage my machine. Just right-click the desktop and you can access the Control Panel with admin rights. And runas has disadvantages.

Neither do I. But I've been told that there are some badly programmed games that require admin rights. The same is allegedly true for certain P2P applications.

 

That's why I use Firefox with Noscript - I wouldn't surf without it anymore.

Yes, but: If I assume that you only install trustworthy software (why should you do otherwise?), wouldn't you allow it in your HIPS? I think most of us are tempted to mechanically click the "Allow" button in such cases. This problem at least diminishes the usefulness of a HIPS. Actually it all comes down to one crucial point: Only install trustworthy software from trustworthy sources!

Nevertheless I concede that a HIPS - or more exactly: an anti-executable - makes sense even in a limited account. It's always possible that you get, e.g., a mail attachment from a friend you deem trustworthy which contains malware, though, and you execute it by accident. While this malware would not be able to seriously compromise your system in a limited account, it could delete your precious documents in folders where you have write permission.

 

How do you get started with SuRun? I never run anything but Admin account and with the arsenal bever felt threatened once, but it seems a good alternative nonetheless.

Do you first create a Limited (Guest) account or you just start it in admin mode and it deos the rest? I don't want to experiement with it, just the basic on where to start, either already in Admin account or first create a User account then run it from there?

I know nothing of these apps at all.

Thanks

 

I never work in my admin account since I only use it for installing/updating apps, applying/altering policies etc. I always create a new restricted account since by default I prefer to have everything restricted and then when needed elevate the rights of the adequate processes. AFAIK, applying SuRun in admin mode would be similar to UAC. If you run into problems with some apps you are using in the restricted account Easter, use Filemon and Regmon to solve the issues.

/C.

 

Easter, I would do it this way:

1. IMHO, the easiest way to create a new user account is to change the existing one from a administrator type one to a limited user type one. Go to Control Panel, create a new account - let's call it Admin -, define it as administrator account (define also a password), log off, log on into the new Admin account, go to Control Panel and change your old account to a user account (and don't forget to define a password also for this one if none exists!).
2. While you're still in your new Admin account install SuRun and configure it via the configuration window as described in my post #1. Be careful to check at least the setting regarding ownership so that you make the admin owner of objects rather than the creator.
3. Log off and log on into your limited user account. SuRun is now available in the context menu of any application by chosing "Run as admin". A window will open that offers you to input the password of your new admin account in order to become a member of the user group SuRunners. Now another window will open where you have to input the password of your limited user account. As mentioned, this has to be done just once.

If you run into any problems, I'm sure we will be able to solve them for you. Good luck!

 

Thanks for the details. Will definitely give this a good going over but already like the approach. It should help greatly on some of my systems of toning down layers but keeping security. Grateful for the outlines.

Already got this one done. LoL

 

Thanks for the tips and assist. I could get used to running LUA. Little old but WORKS! Using this Indicator also to confirm when LU or ADMIN.

https://www.wilderssecurity.com/showpost.php?p=861822&postcount=4

http://blogs.msdn.com/aaron_margosis/archive/2004/07/24/195350.aspx

The deny privileges working to a T so far. Nice now to click on files in my zoo collection and get a DENY/YOU DO NOT HAVE SUFFICIENT SECURITY PERMISSIONS etc. and even works nicely on malware DLL's LoL

 

Im a bit curious what the point of using privbar in a limited account is? I mean you are in a limited account and your browser is by default limited then. It wont go admin by itself. Or are you saying that it can happen?

 

Look at it this way. Don't take ANYTHING for granted, thats my basic rule of thumb. Nothing is etched in granite when it comes to windows.

 

A fine line between valid caution and FUD, as always.

 

OT:

Is there a reason why the much-hyped NoScript is superior to, say, IE's security zones, or Opera's site preferences function?

 

I'm kind of on that same page here. Why is there so much hype over No-Script, aside from the point that it's a useful add-on for FireFox users of course. I always have and likely always will use IE even though i have Opera at any time, but why bother. IE can be sealed up and monitored.

 

No it can´t by itself. Only if there´s some exploit in your browser and you get infected by a malware that will use this specific exploit to elevate its rights.

/C.

 

I serves mainly as a reminder that you started, e.g., explorer.exe with SuRun as you cannot recognize if that process is running with admin privileges or not.

 

It's much more comfortable than the IE zones concept. With Noscript Javascript and plugins are disabled by default, but you can temporarily or permanantly enable them for trustworhy sites with just one or two mouseclicks. The analogy in IE would be that you disable any scripting in the Internet Zone and manually add the trustworthy sites to the Trusted Zone - IMHO very circuitous. Furthermore, Noscript is the only solution on the client side that protects against XSS which is becoming more and more popular.

 

Congratulations - I'm glad to read this BTW: If you are running XP Professional an additional measure to make your system even safer would be using a Software Restriction Policy as described here. You can't apply that to XP Home, though.

 

Hmm. I was under the impression that NoScript offered extra security advantages, rather than just a convenience. One or two mouseclicks does sound quite easy, but hardly worth switching over to Firefox for...

That's interesting, as I was under the impression that disabling client-side scripts by default would defeat this attack. What "extra", exactly, does NoScript deliver to protect against these attacks?

Thanks.

 

IMHO it makes everyday browsing much easier. E.g., I can easliy temporarily whitelist sites I deem trustworthy but I won't open regularly, so the list of whitelisted sites doesn't become bigger and bigger. And I never have to input any site manually in my trusted zone (regardless if I whitelist them temporarily or permanantly).

Another important aspect is that also any plugins like Java, Flash etc. with possible security leaks (and there have been plenty of examples recently) are disabled by default (i.e. for not whitelisted sites). IMHO that's not so easy in IE.

As a matter of fact, most XSS attacks are Javascript based but not all of them which makes measures that protect against these XSS injections definitely useful. In addition, Noscript protects against XSS even when sites are whitelisted. Quote from the Noscript site: "Furthermore, since version 1.1.4.9 NoScript checks also requests started from whitelisted origins for specific suspicious URL patterns landing on other trusted sites: if a potential XSS attack is detected, even if coming from a trusted source, filters are promptly triggered." And this makes sense as there are many examples that even normally trustworthy prominent sites were victims of XSS attacks.

 

Thanks for the info. From your post it can be implied that IE and Opera will not block scripts inserted via iframe and object tags into whitelisted sites - I'll need to find out if this is true.

Also, one last question. You mentioned that not all XSS attacks are js-based; how else can they be launched, perchance?

 

XSS, control of plug-ins (Java, Quick Time, Adobe, Flash, etc) and convenience.

 

I've always depended on this little IE add-on since Windows 98SE

IEsure