News for hackers. Stuff that matters.

A comment on iOS Privacy: Easily get a user's Apple ID password, just by asking. Parent comment

Re:iOS Privacy: Easily get a user's Apple ID password, just ... by gruez on Tuesday October 10, 2017 @10:48AM (#15442228)
>You can do this with the Windows admin password prompt

doesn't work when UAC is enabled. Even if you were able to phish the administrator password, trying to login as the administrator using that password (such as by using runas), you'll still end up with a restricted access token. You still need to somehow click "yes" on UAC to get administrative access, which is no small feat because that prompt is on the secure desktop.

[ Parent | on HN ]
Re:iOS Privacy: Easily get a user's Apple ID password, just ... by vortico on Tuesday October 10, 2017 @10:55AM (#15442293)
That's interesting. I haven't used Windows since UAC came out. Is a Windows password useless to an application then?
[ Parent | on HN ]
Re:iOS Privacy: Easily get a user's Apple ID password, just ... by ksk on Tuesday October 10, 2017 @12:13PM (#15442965)
UAC came out over 10 years ago! In any case, NT is structured quite differently than the typical UNIX variants. When you log in, NT creates two access tokens for you. One with all your privileges, and one with admin rights masked out. When a process is launched it uses the non-admin one by default, even if you are the admin user.

When a thread requires admin privileges, NT will first check if your unmasked token already has those rights, in which case, it will prompt you (UAC) for permission to use the token. This is unlike traditional UNIX where the 'effective user' changes to root on a global level, not just per-thread. So you get 10 minutes (or w/e) as root to do your thing.

[ Parent | on HN ]
Re:iOS Privacy: Easily get a user's Apple ID password, just ... by marksomnian on Wednesday October 11, 2017 @01:49AM (#15447560)
For all of Microsoft's faults, I can't count how many feats of engineering they've pulled off to maintain backwards compatibility.
[ Parent | on HN ]
Re:iOS Privacy: Easily get a user's Apple ID password, just ... by gruez on Tuesday October 10, 2017 @11:17AM (#15442486)
you might be able to work around it if RDP is enabled, by using the credentials to start a RDP session, then clicking the UAC prompt from within the RDP session. problem is, RDP isn't enabled by default, and you need admin permissions to enable it.
[ Parent | on HN ]
Re:iOS Privacy: Easily get a user's Apple ID password, just ... by kminehart on Tuesday October 10, 2017 @10:50AM (#15442244)
> doesn't work when UAC is enabled

Which is funny because disabling UAC is one of the first things I (and many many others) have done since Windows 7 to make using Windows a little more tolerable.

[ Parent | on HN ]
Re:iOS Privacy: Easily get a user's Apple ID password, just ... by amq on Tuesday October 10, 2017 @11:04AM (#15442376)
I could understand disabling UAC on Vista, but I find it perfectly sensible since Win7. Also blame ancient programs which request administrator access without reason.
[ Parent | on HN ]
Re:iOS Privacy: Easily get a user's Apple ID password, just ... by gruez on Tuesday October 10, 2017 @11:20AM (#15442529)
>I find it perfectly sensible since Win7

funny thing is, the thing that made it "sensible" since win7 also makes it insecure. if you care about security, it's prompt for everything or nothing.

https://blogs.msdn.microsoft.com/oldnewthing/20160816-00/?p=...

[ Parent | on HN ]
Re:iOS Privacy: Easily get a user's Apple ID password, just ... by xenophonf on Tuesday October 10, 2017 @11:11AM (#15442441)
That's like running everything as root or passwordless sudo. Seriously: don't do that.
[ Parent | on HN ]