3

Another recommendation I fail to understand.

The explanation is that, if I use admin account and manage to have my computer infected, the malware is able to take control over my entire system. But:

  • The dreaded days of old Windows systems are long gone: nowadays, Windows has UAC, which effectively makes an admin account behave like a standard account, unless the user explicitly authorizes a program to have administrative privileges;
  • Unixlike systems have (almost?) forever had sudo and similar facilities;
  • In my LinuxMint installation, I have to escalate to root privileges (via the aforementioned facilities) almost daily: this is required each time updates are to be installed. And even each time I need to format a USB stick. Logging out to a separate admin account each time that happens would be most tedious;
  • The above problems can be leveraged by suing t from the standard accouninto the admin account and doing the work from there; but I suppose, if sudoing from the admin account is, for some reason, a problem (as the recommendation not to use the admin account still stands), so can be suing into the admin account from the standard account;
  • Even if malware gets installed only on my standard account, with no means to escalate to admin privileges, I'm still screwed. It can add itself to autostart, it can encipher my files, it can spy on my files, it can relink shortcuts and disguise itself as a legitimate program (like Firefox) and steal my passwords from there, etc.

Given the existence of UAC and sudo-like facilities; Given the aforementioned concerns; I fail to understand the basis of the recommendation to always use regular accounts for everyday work and not admin accounts. And yet the recommendation stands. (I'm hearing it over and over, last time I read it on Niebezpiecznik.pl, a popular and acclaimed infosec blog, as one of their 10 recommendations for "Average Joes".)

Why does such recommendation stand? What am I failing to understand?

5

You misunderstand. The recommendation is to use sudo and elevating permissions through the windows built in thingy (where you enter credentials of admin account) instead of using root account or su or admin account by default.

If you use su or root account, you give root permissions to everything you run. If you use sudo, you only give root to apps that need it and hopefully only well trusted apps. This reduces chances of malware getting root access. Even apps that are not malicious by themselves may not be designed to be run as root and have vulnerabilities if they are. A good example of this are web browsers.

On windows, the important thing is UAC does not protect against file permissions. So an app run by admin even without UAC admin privileges may have access to files and folders an app run by normal user would not have access to.

  • Hmm. OK, I get what you're saying, though I find it surprising. The usual wording of this recommendation is to "use standard accounts, not admin accounts"; and, as far as I'm aware, both in Windows and Unix terminology, an "admin" account is an account that can temporarily escalate permissions through sudo (Unix) or UAC (Windows), while a "standard" account is an account that iis denied such possibility. That what you refer to in the first paragraph of your answer is instead called a "root" account in Unix terminology or hidden administrator account in Windows terminology. – gaazkam May 2 '18 at 13:13
  • Of course, I'm not arguing that my interpretation is correct, I'm a no expert and by all means I'm likely to understand this terminology wrongly. – gaazkam May 2 '18 at 13:14
  • @gaazkam on linux/unix, it is IMHO safe to use "admin" account as you define it. You just should not use root. On windows however, UAC is not used for everything. As I said, file permissions for example are different for admin and normal account, even when UAC is not used. There is however another option in windows. When you use a normal account and you want to do something requiring admin privileges, you can just enter the name and password (login) of admin account. This allows you to do most things an admin can do without using admin account. – Peter Harmann May 2 '18 at 13:20
  • I think its worth noting that its also to protect users from themselves. To prevent them from accidentally deleting/modifying/whatevering a system critical file from a fatfingered command- as an example – joedamarsio May 2 '18 at 13:50
  • 1
    And historically, UAC isn't foolproof and can often be bypassed altogether. So I'd argue it is better (on Windows) to use a non-admin account and do what you suggested in your comment. – multithr3at3d May 2 '18 at 13:51
0

The correct updated form for this recommendation would be to always use sudo or UAC with secure configuration i.e. asking for the password when giving lifted privileges to a command or program. It's possible to screw this up:

  • You could have sudo without password with joe ALL= NOPASSWD: ALL or with too long long or too wide credential caching. I'd say the default 15 minutes should be shortened to (e.g. 2 to 5 minutes) on production environments and tty_tickets should always be enabled.

    If you use the system remotely with SSH, consider allowing only key-based authentication for users with sudoer privileges. This way an attacker can't gain root access with the password alone.

  • The User Account Control can be defined to use prompt for consent instead of promp for credentials. Revise (group) policy settings for UAC in Local Policies\Security Options.

0

Imagine you are working on an important production system.

Suddenly you get the "Do you want to allow [program you have never heard of] to make changes to this computer?" popup.

What has happened? Some kind of malware got on your production system, but it it only managed to get executed under your user account. Now it tries a privilege escalation. But because you are not working as an admin, you even get the chance to see it. If you were working as admin, the malware would have been able to obtain admin rights without you noticing anything at all.

  • I appreciate this answer. Even though it doesn't really answer my question - the fact that You've intuitively assumed that I'm asking the question you're answering - proves that Peter Harmann really was right, that I've really gravely misunderstood the recommendation. – gaazkam May 2 '18 at 20:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.