Brute force a GUI login?

Question

I know I have read somewhere that the reason the UAC prompt in Windows 7 was employed is that viruses that would supposedly execute privileged instructions won't be able to "click" the confirm button when prompted with the UAC GUI prompt.

So if I created an application with a GUI login with a login button, will a virus/script be able to brute force it?

Answer 1

A script can simulate keystrokes/mouse clicks on Windows. I believe the UAC prompt is protected by the OS making automating clicking it a more difficult task. (I'm not a windows user; but its straightforward to simulate mouse clicks/movement in windows). Apparently the UAC screen is run as the System user (a user with more permissions than an administrator, but not quite the kernel) so unless you were able to write and execute a script as the System user you would not be able to bypass the UAC clicks.

But in general, having a GUI login with a button doesn't make your login screen any more difficult to break. Any reasonable attacker will examine how your program is checking the password, extract out the saved hash from memory and write some massively parallel GPU code to brute force it. (Unless its done over the network and then they'd stop using your GUI and do the requests directly). But even if somehow constrained to simulating keystrokes and mouse movements/clicks its still trivial to do.

Answer 2

I'm not sure how you think the UAC prompt is related to bruteforcing a GUI login.

The UAC prompt runs in something Microsoft calls a secure desktop. The only processes that are running in the secure desktop environment are trusted processes running as SYSTEM. This is secure as no malware running under user privilege level can execute in the secure desktop environment. It's essentially a clean environment where you can safely allow or reject new processes.

If you have an application already running with a GUI login page, I can most certainly write a piece of malware or script to bruteforce the user accounts. The UAC secure desktop environment has nothing to do with it.