Run IE as a less privileged user

A quote from: catch

"Run IE as a less privileged user, all bugs fixed without patching. Gee that was tough."


This kid below is telling me it doesn't matter If I run on a XP limited account, nor if I use a hardened IE. I will assume catch is right here, not the kid can anyone sort this out? & simplify it.

thanks



A quote from: KID
The problem is not with the account...it's the fact that IE, which operates with the OS at the system level, can be used to attain system level privileges or root which you may have heard of jacka*s

The user is not the problem if the browser is calling functions at the system level. Just because the browser is opened by the user does not mean that all functions run by the browser are also run as that user...they're run on the system level. Say you hit a website and IE is trying to interpret script, the function to process that code is passed in a system level process. If that process executes code which is able to exploit a vulnerability in the OS the result could be system level privileges to execute the code of choice, the box is owned - root has been owned...because the process operates at the system level, which is independent of who is logged in or what rights they have. If they can run IE the problem still exists. Sure you could limit the users to be unable to run IE but that's not a very good solution. The culprit here is the OS itself...not the user. Patch the box!

would'nt the fact that you are running it a restricted level prevent root level scripts form running.
Ithink this kid has know idea what he is saying. there may be some issues or expolits you could work at the user level but I have not heard of any. any good admin would make this kid look silly if he tried there system.

I think kid is talking out of his arse. IE is a normal program which executes at the same level as whatever user is running it.

Although there have been many exploits in IE which give user level privileges, as far as I'm aware it has never been implicated in a local privilege elevation vulnerability (Of course many Windows users run everything as admin hence making the distinction rather academic).

It's lies

Slarty

Agreed. He makes no sense at all. The proper way to "harden" IE is to configure the security zones, restricted sites and how you allow it to handle cookies, Active X, etc.

Remember, IE is a program, not a service. Take a closer look at its core capabilities and you'll quickly realize that there are many easier (and logical) places to attempt this type of attack.

Thanks guys that was good info on the subject. So basically all of what the kid said was BS & its safe to say he knows jack when it comes to security? Im going to do some more reading here, before I launch this verbal nuke Im currently in the process of constructing in Kate editor.

After my whole response the kid cant stop.


QUOTE:The kid
Uhhh... not exactly. IE's functionality is fully integrated into Windows at the lowest levels in all versions from Win98 on. For example, it's what allows the Quick Launch bar to work and provides the ability to view the desktop (Active Desktop) and folders as web pages. There are all kinds of vunerabilities that this causes: see http://www.secunia.com for several exploits that can be directly traced to IE's integration at this level. It was a bad idea 5 years ago and it's an even worse idea now!

His points have some truth to them, however, the specific reference I made is to privilege escalation, not buffer overflows and other vulnerabilities which are listed on the site he points you to. Sure, you will see a variety of issues with an app that is integrated with an OS but you will find a pattern of vulnerabilities which really do not include privilege escalation. Anyway, arguing with him is a mute point. I'd let it go and not worry about it.

Quote:

---

Just because the browser is opened by the user does not mean that all functions run by the browser are also run as that user...they're run on the system level.

---

Here's an easy way to settle this debate.......

Close IE, Open the Task Manager, Re-open IE. Now look at the task manager. Under the User Name column, what does it say?

I thought so.....User Level Process! Still subject to privelage escalation, as thehorse13 said, but a user level process nontheless.

Yeah, now that I know he is just trying to spin the subject to save his ass. I gather the conversation is over & that I should just direct him to www.youareanidiot.com

Thanks guys for laying out the truth here on the matter.

It would be a lot easier just to use a decent browser like mozilla :P. And I'm sure that a normal user can spawn a process which can run as root (in *nix os's anyhow). A program can run as a normal user then change it's uid for certain tasks that it has to perform.

ac

It is possible to spawn a process that will run at a higher privelaged user....a good example running Symantec's Live Update as a restricted user giving that user access to a command line that runs with System privelages. The only real way to defend against this type of thing is to keep all software patched and updated and log certain types of events.

EDIT: Cool....275! I'm addicted! :p

Even though IE essentially isn't highly configurable, it is enough. You can stop scripts from running, ActiveX etc. However, i know when Win95 and Win98 were new, Micro$oft had IE running as the system's shell, basicly a GUI for the system. However, i dont know if this is the case for Win2000 and XP. If anyone knows, get back to me, plz?

Windows 2000 and XP are based upon the Windows NT system architecture. As such, the only processes that run under the context of System are core operating processes and applications that run as a service that are set to run under the Local System account. Not even the GUI shell (explorer.exe) runs under the context of System.

Now, this is something I tried.

I have used runas command to start IE as some different user. And I couldn't even save a picture from a webpage... Great way to stop some kinds of spyware and malicius javascripts...

but I still visit windows update at least weekly

For windows95,98, me, the person you were originally talking to is correct... But he is only correct as there is no way to login with a less restrictive account. In those particular operating systems you are always logged in with full privileges. This is not a bug or a flaw, the OS is not designed to allow different users or segmentation of privileges, the functionality just doesn't exist.

Now with any OS based on the NT kernel, Catch is 100% correct that running IE as something other than admin resolves almost all flaws that resolve around IE automatically running scripts/virii etc...


Ikalo- You were probably trying to save the files into a directory that you did not have permissions to save them in. I use run as all the time and never have issues saving files.