Windows Vista: User Accounts Control

Windows Vista will introduce a "new" concept into Windows: User Account Control. No, surprisingly, this isn't another new way for Microsoft to regulate what you do online. It's not the beginning of a Big Brother program. Actually, it's designed to make the programs you already have installed on your computer work better. Surprisingly, for the first time, Microsoft may have done just that.

Priveleges and The Principle of Least Control

---

One of the core concepts in computer development is security. Actually, the reason for this is twofold. While it may be readily apparent that a would be intruder will have more trouble with a system designed to block his attempts to alter your critical files, protecting those same files from the user themselve isn't so obvious.

The simple fact is, your average user knows very little about how to use a computer effectively (at maximum productivity) let alone how it works its magic. Unfortunately, that means users are their own worst enemies. Just like a car manufacturer provides a simple ignition/accelerator/brake and encloses the pistons, rods, hoses, and other components in an inaccessible area, computer manufacturers provide a user interface. Unfortunately for the computer world, that interface is expected to be upgradable, changeable, and generally fully accessible.

To this end the principle of least control was born. At any given moment a user needs only enough control (access) over their computer to perform the specific task they are trying to do. Normally this doesn't include setting the clock, installing a program, or editing a system file. Accordingly, the principle dictates the user (in that moment) should not be allowed access to those system areas. This would in turn prevent an unauthorized agent (for example an Internet Active X control, a Trojan, or a Hacker) from performing the same task pretending to be the user.

Because we don't keep our computers exactly the same all the time, we likewise need a way to edit system components at any given time. Linux/Unix clones give us the "su" (super user) command for this task. The command prompts the user for a password (generally the "root" password) and if it is authenticated grants unrequited access to the machine (within the su session area). When the user is done, they simply type exit and return to normal access. This means that for all of eternity, Linux users have been more secure in principle in their computing environment. They don't run as administrators.

Don't be an Administrator, use "Run As..."

---

I know I pretty much just covered this with the bit on the principle of least control, but I can't reiterate it enough. When you run your computer as an administrator, you give yourself unaudited access to your machine. Good, right? Wrong. The fact is your not the one who's going t use that access, the website which is trying to hack you is.

The ActiveX control, when installed, can impersonate a user and perform operations on a machine. Granted, post XP SP2 ActiveX controls no longer automatically and without prompting install and run themselves, but most sites will advise users of this anyway. In actuality, a well written scheme can easily find its way onto a users computer... yes, even a "power users" computer.

If your running under non-admin priveleges this scheme is entirely powerless. It can only do what you would otherwise be able to do. On the other hand, if you're running as admin, you've handed your computer over on a silver platter.

So, for all the Windows users out there, what are your options? The su command is available under Linux clones only, although even if it were, the command line eludes most Windows users. Windows does fortunately have a similar, albeit almost more friendly version of the same.

First off, you need to create yourself an account with limited priveleges and run under that for normal, day to day operations. Then, whenever you need to do something that would normally require admin priveleges, instead of logging out, loggin in as admin, doing it, logging out, and loggin in as you, use the "Run As..." command. By holding the Shift key while you right-click something, you access the Run As... option. When you click it, it will prompt you for the credentials you want to run the command as.

Beautiful. If you enter "Administrator" for example, that process AND ONLY THAT PROCESS will be run with full admin priveleges. It works using the Secondary Logon service, which coincidentally also provides "Fast User Switching" capabilities to many users. When you finish your task and close the window, the administrative priveleges dissappear, and your free to behave irresponsibly again.

User Accounts Control

---

Windows Vista (as of Beta 2 without the Technicial Refreshes) expounds upon Windows XP's introduction of "Run As...". User Accounts Control is a built in required feature of the Operating System in fact. Basically, any user, including an adminstrator, is restricted from root level (su) priveleges. Whenever they try to access a component that would require those priveleges they are prompted for appropriate credentials.

As per Microsoft's general modus operandi, the UAC console kindly informs you that if you're not sure, you should probably choose to cancel. In fact, the average user who doesn't remember having seen this in their XP computer may do just that and wonder why their program never opened.

There are some limited options allowing the custimization of UAC screens and blockings, but in the beginning it will be little more than a hindrance for users. As I recall the message UAC greets you with informs you that "a request has been made to access a restricted component. Windows needs to verify that you made this request. If you made the request, please enter the password to continue now, otherwise, you should not continue." As I said, cryptic at best.

What exactly is a system component? Especially considering one may be accessed for something as simple as scheduling an appointment (depending on how the program you use works). How do you know if it's an appropriate request? What harm could happen if you just entered the password (which I have already addressed in this entry)? Most importantly, how many more damn times are you going to have to dismiss the UAC console to try and get your work done.

I mentioned as I started this blog UAC is designed to help make what you already have installed work better, and surprisingly, it does. As my next entry will explain, most programs are not written with a terrible amount of concern for how things are done, they only want the result. That unfortunately means a lot of programs commonly perform tasks normally reserved for Administrators. UAC will force these programs to run in a bubble where they can continue to execute their potentially dangerous code without endangering the rest of your computer.

Hard Drive Failure

No matter what you use your computer for, or how often you interact with it, odds are you've seen a symptom of HDD (Hard Disk Drive) failure at least once in your life. This could have been something obvious - a famous Blue Screen reading "UNMOUNTABLE_BOOT_VOLUME" - or something a little more elusive - certain files and folders seeming to "disappear" without warning. No matter your experience, you know that when it happens, it's not fun.

As a technician, I would estimate one of the scarier things to be told is "your hard drive has crashed"... a message which I give countless times a month. Normally, it's not as dire as it seems, but the message is still the most effective I can give. While the specifics vary, the general situation is this: I respond to a client reporting a "computer that turns off as soon as it shows the Windows XP logo". Upon arriving I disable the automatic reboot setting (this is made possible at the Advanced Boot Options Menu thanks to a recent Microsoft Update) and am greeted with a blue screen message along the lines of "UNMOUNTABLE_BOOT_VOLUME" or "NTLDR Is missing or corrupt".

Stop. At this point, I know only one of two things: a) The NT Boot Sector is corrupt or missing; b) The MBR Is corrupt or missing; In and of themselves, neither one is indicative of a crash, yet I'll inevitably tell my client they are. Why? Well, before demonizing me, realize that the basic reason is to benefit the client.

Hard drive crashes are something most people feel they can relate too. They know it means nothing they did caused the problem, which in many cases is just as important as the fact that the problem is resolvable. Ultimately, it gives them enough information to provide a brief synopsis of the problem without overburdening them with the gory details. The unfortunate tradeoff for this solution is the fear of data loss. I know, it doesn't seem fair, but based on consumer expectations, it's easier for both myself (who doesn't have to have a client watching my every move) and the client (who at least feels like they know whats going on).

The Symptoms

---

Hard Drive faiulre is not only one of the most potentially detrimental problems I see, it's also the hardest to spot. Allow me to tell two stories to demonstrate my point. While both ended in Hard Drive failure (and fortunately complete data recovery), only one was caught before the failure occured.

SITUATION ONE: An irregular client of mine called reporting printing trouble. After walking him though the common troubleshooting steps over the phone, I agreed to come out. I was greeted by one of the strangest printing errors I had ever seen. The Windows Print Spooler service absolutely refused to stay active. The couple of times I did get it working it didn't work properly. Printer drivers would report strange errors, anything that did print was garbled, nothing really seemed to be working.

Finally, I decided to run a slew of system tests. My intention was actually to isolate a possible motherboard or cable error. Luckily for the client, included in that standard set of tests was a Hard Drive integrity test. When the drive gracefully failed, I realized what had been happening all along. Immediately, we RMA'ed the drive, backed up the data, and rebuild the machine. The next day, printing was up and running.

SITUATION TWO: One of my client's is rather problematic. Since she decided to replace her desktop with a Dell Lattitude (on account of problems with the desktop), we have been there to fix something frequently. The problems range from not knowing there's a physical "On/Off" switch for a wireless adapter to not being able to connect to the network.

This particular case a connectivity issue; one that started immediately after another technician (not affiliated with my company) had tried to connect the laptop to home wireless. Because the computer is a bussiness machine first, and then a personal computer, anything the other tech had done seemed null and void.

I sat down, ran ipconfig and immediately saw there was no default gateway set. Unusual, especially considering another tech had just serviced the machine. Not worrying about it too much, I statically configured the gateway, IP, mask, and DNS servers. Voila, the machine was working.

The next morning, like clockwork, we received a call from the same client. Her hard drive had just crashed and she couldn't work. Incidentally, this was the second hard drive failure in this machine since purchase, and we ended up RMA'ing the entire box.

THE ANSWER: So, what caused the strange symptoms in both cases? Well, the answer to that has to do with what actually happens when a hard drive fails. A hard drive is a magnetic disk divided both pyhsically and logically into sectors. A physical sector is, without getting to complicated, a definition of a magnetic region. When a physical sector goes bad, it becomes entirely unusable, and any data stored on it becomes inaccessible.

Conversely, a logical sector is a file system's (eg FAT, EXT3, NTFS, WFS, EFS, etc) description of a where data is stored. when a logical sector goes bad, it's really just the file system information having a problem. Tools such as chkdsk can (and do) often fix these problems. When they don't, performing a low-level format (indiscriminately writing all 0's then 1's across a drive) almost always recovers them.

So, when a Windows based hard drive fails, the data sectors start becoming inaccessible. Being the "user-friendly" operating system, Windows tries to compensate. In the case of the printer, when the service became inaccessible (physical bad sectors existed where the services files were stored), windows reported it as failing. With the networking, the data on the gateway, DNS, etc was inaccessible, so Windows reported it as missing (unset).

While this may make things easier for a user in the short run, in the end they're relatively useless.

The SolutionKeep a regular backup. In a future entry, I'll be covering the usage of Microsoft's free backup utility "NTBackup". When used with the built in Windows Task Scheduler, this utility gives you the ability to automate a daily backup of any file, every file, your entire file system, or even the system state.

My only other advice is to be attentive. While you may be graced with an odd clicking sound prior to a crash, you're just as likely to only get some unexplainable behavior. Most computers come with built-in diagnostic software these days. Check your documentation to see if you have a "drivers and utilities" cd. You might even have a built in diagnostic boot sequence, usually accessed via F12 or F10 at boottime. Maxtor, Western Digital, and Seagate also provide free tools for use with their hard drives.

Hard drive failure suck, no question, but with appropriate care, they can be made to cause minimal damage.

Hacking Poly, Part I: Lockdown and Breakout

LOCKDOWN

---

The premise is simple. You are the technician in charge of orchestrating secure and private operation of approximately 200 public computers in a library. After painful reasearch, you settle on a Faronics product by the name of "Deep Freeze". This program touts the ability to boot "frozen", allow the user any freedoms they want, and then undo them on a consecutive reboot. Security solved.

Now there's the other half of the equation, privacy. You realize that the average user wouldn't understand how sensitive (and easily accessible) much internet/computer related data is if it smacked them in the face. As a result, part of your job is protecting them from themselves. To do this, you not only enforce maximum privacy rules via Internet Explorer (accept no cookies, 0 day history, no cache, etc), you lock down the settings themselves via group policy. Privacy solved.

By this point you're feeling pretty confident with yourself. It's not even two o'clock and your systems are running beautifully. In fact, in what can only be called a stroke of pure genius, you've eliminated the need (and potential security risk) of having unique and individual user accounts for every open access user in your public areas. You've set your policies to automatically logon as a local administrative account, while using GPO's to lock said accounts down.

This situation exactly describes the current Cal Poly security architecture. Unfortunately, their brutal decision to deny all cookies disables the ability to use any website that has sessions (although some newer sites do use querystring based sessions, it is much less desireable). Favorites among the college crowd, including most notably Facebook, are completely inaccessible from the supposedly "Open" systems at the university.

The disenfranchising this causes creates a huge pool of ambivalence between the IT support staff and the average student. From a network administrators standpoint, thats not a good place to be starting. Unfortunately, again, the IT staff are less concerned with providing a productive work environment than providing a controlled work environment (note that these are not incompatible terms as I will describe in a future installment of this series).

BREAKOUT

---

So the question students are left with is simple: How do we make the computers work, the way we want them to work? Actually, in spite of themselves, the Poly IT staff have left open the perfect opportunity to do just that, without doing any noticeable, lasting, or relevant harm to the systems. Why is that good you ask? The less harm you cause, the less likely it is an irritable administrator is going to track you down and harass you for it.

A Quick Note on GPO's
The Group Policy Object can be applied to a user in a number of ways. While different ways might accomplish essentially the same task, the inner mechanics of how they do it can have dire consequences. While the numerous interesting and different ways of doing this will provide interesting fodder for a future entry, for now we only care about the basic two.

A policy can be applied to a computer, or to a user. At Poly, they opt for the latter and have created a general "Open Access" user account with a strict set of policies defined. Because as a general rule, deny policies override allow policies, this lets Sys Admins and other priveleged Faculty use the same student systems with elevated (ie, non-restricted) access.

Step 1: Stealing SYSTEM Privelegs
As you may have guessed based on the note, using a user based policy leaves a whole in your security. If a user can somehow change their credentials, or at least change what credentials Windows thinks they have, they can circumvent almost any policy you've put in place. In our case, this means using an old (and relatively well documented) trick to logon to a computer with the builtin SYSTEM account (designed to allow certain NT services to function properly).

To do this, we need to launch a command prompt (Start | Run | "cmd" | Enter). At the prompt we'll use the "at" command (command line version of the Task Scheduler) to launch Windows Task Manager. The exact command we want is "at xx:xx /interactive taskmgr.exe" where xx:xx represent the time (in 24 hour format) approximately 1 minute from now. When that time rolls around, Windows Task Manager will launch itself... on SYSTEM authority!

Now, we could essentially operate the computer from just this Task Manager, but a GUI might be more pleasing. No problem. On the processes tab of our Task Manager, we want to kill the copy of "explorer.exe" opened by our user. This will close the shell, and essentially (as far as Windows cares anyway) "log us off". Returning to the application tab, click "New Task..." and type "explorer". When Windows relaunches the GUI shell it will do so on SYSTEM authority, and you end up logged on with SYSTEM credentials.

Step 2 - Blocking Policies
Only application that we launch either directly from our Task Manager instance, or from the desktop shell we've just opened will acually have SYSTEM authority. Make sure you're aware of this as you continue with these steps. Windows GPO's are stored in the Registry with some put into effect at logon, and some at runtime. The particular ones we care about go into effect at IE's runtime.

Launch regedit (New Task... | "regedit") to start off. The policy we want is in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer. Right clicking on it and choosing permissions reveals a collection of Microsoft permissions (similar to NTFS permissions). We want to explicitly Deny everyone access to this key, which will have the same effect as disabling the policy.

First, we have to open the advanced permission dialogue and uncheck the "Inherit permissions from parent" box, then choose to Remove current permissions. While this will leave the key with no explicit allows - and thererfore technically a deny - we want to be extra careful and concise with what we do. So, add a permission for "Everyone" and choose Deny for everything. Click OK and close regedit.

Changes made to the registry are "live" in that they don't require a save. However, in general they aren't reprocessed until reboot. With Deep Freeze installed that's obviously not an option. No problem, returning to our "New Task..." button we can run the "gpupdate" command which will requery the registry and refresh our policy.

Step 3 - Accepting Cookies
After the policy is refreshed we're basically ready to be Internet Hooligans (please note, while Deep Freeze will continue to protect the computer, it won't protect you're privacy). The last step is actually telling IE it's ok to accept cookies.

Open the browser, either with the desktop icon, or through the taskname "iexplore" in the "New Task..." button. Click Tools | Internet Options, and lo and behold the "Privacy" tab has appeared! On it, you'll want to change two things. First, you need to set the cookies to low (accept all cookies). Then, in the advanced menu, override automatic cookie handling, set both first and third party cookies to accept all, AND check the "always accept session cookies" box. I know it seems like overkill, but this IS IE we're talking about.

Once you click Okay, you're ready. Browse away in your newly unlocked computer. When you finish, it would probably be prudent to reboot the comptuer, and effectively erase your tracks.

Step 4 - Other Fun Stuff
While logged in with SYSTEM authority, you'll find other options open to you. For example, you're able to edit the security settings in IE, and change your Trusted Sites zone file. This means you can add http://www.aim.com to your Trusted Sites, reset policies for it to low, and suddenly access AIM express (for example). Of course, while in as the SYSTEM account, you can just as easily download and install a full version of AIM.

Basically, once you've got this setup, you are the (local) computer. Anything you could do on your computer you can do on it. Part II of this series: How theses same security principles could be applied in a more effective, AND less intrusive manner.

<?php echo "Hello World!" ?>

This first post is mostly a "Who the hell are you and why should I care?!?!?" type post. I'm Mike, I attend Cal Poly SLO where I'm pursuing a degree in English. Of course, if you read the description of this blog, you already know that. So, what's the meat of the story? I've been working with computers (in a completely random fashion mind you) since I was about seven years old.

It started with an innocent program "Mavis Beacon Teaches Typing" - which my parents required I use at least an hour a day - and somehow grew to what it is today. Speaking of today, a brief overview of my credentials might include: Microsoft AD, all Windows platforms, Network Hardware (consumer to large bussiness), IIS, Apache, Exchange, computer hardware, databases, PHP, ASP (and the obligatory VBScript, which is surpringly useful in windows admin scripts), AJAX, MS-DOS scripting, JavaScript, HTML, XML, CSS, (some) Perl, and an insanely steep learning curve. In fact, based solely on my knowledge of JavaScript, I taught myself ASP/VBScript in one day.

Mostly I'll be posting whatever has been bugging me lately, or what I'm working on. If I find something really exciting in a programming language, I'll likely share it. I'll probably also include some projects I'm working on for constructive criticism (by which I mean, "when you tear my mf head off, please leave at least a small piece of it attached to me").

The blog itself is currently going to be hosted by Blogger. This is for a couple of reasons, not the least of which is the time involved in reinventing this wheel. That of course means it has a blogspot address (http://englishtechnician.blogspot.com), but, it also has a web address (http://www.englishtechnician.com OR http://www.theenglishtechnician.com), and e-mail. If you're really cool, and you want an e-mail address, I'll be more than happy to provide (eg yourname@theenglishtechnician.com). If I ever move the blog, I'll update the two domain name links. No guarantees on the blogspot link.

I suppose that's it (for now). Now I just have to go finish setting those domains/emails up!