0

Windows is an API-based operating system, whereas Linux is file-based. Hence in my opinion, any operating system API security measures alone aren't effective in Windows. One of such examples would be UAC in my humble opinion. On the other hand, Linux incorporates SELinux and sudo instead. This goes to low-level layers of the operating system, which are harder to manipulate in my humble opinion. The Windows low-level approach (on older Windows Server systems at least) of pressing Alt+Ctrl+Del to login was a good approach in my opinion, but doesn't protect at all in this scenario in my opinion.

In my opinion, UAC only protects against a malfunctioning (digitally OR physically) mouse, which double clicks instead of single clicking and primitive forking malware/fork bombs.

  • Is this the reason Linux has no real UAC equivalent, but rather other and actually effective solutions?

  • Does any compliance measure ever recommend to turn off UAC due to it being nearly useless?

  • Is it technically smart to disable UAC completely if your threat model is not protecting against a malfunctioning mouse which clicks twice with a single click or primitive malware which forks itself and does not bypass UAC?

  • Does the first to third paragraph contain any misconceptions/false information?

  • Does UAC protect against BadUSB-based keystroke injection? No, because you can just click yes and no password is required, right? Or is there some randomization in play here, which a Ducky Script would fail at?

  • Are UAC bypasses common on recent Windows systems? Supposedly there's a backdoor on default settings and at least(!) 77 ways to do it: https://github.com/hfiref0x/UACME

  • Does Linux solve these problems better?

  • According to https://security.stackexchange.com/a/81770 the X window system is vulnerable to keyloggers, whereas Windows with UAC isn't, is this true? If so, does Wayland do better?

12
  • 1
    "In my opinion, UAC only protects against a malfunctioning (digitally OR physically) mouse"... really not sure why you think that. It protects against running unauthorized executables or operations. It's the same as Linux' "sudo" command, though much more secure. Aug 1, 2023 at 20:24
  • @pcalkins because for example it would make me double click and execute an executable instead of dragging it into the trash bin or something like that... Aug 2, 2023 at 14:48
  • "because you can just click yes and no password is required, right?" If you haven't correctly configured it, sure. So configure it to require password entry.
    – Ben Voigt
    Aug 2, 2023 at 15:51
  • In my opinion, UAC only protects against a malfunctioning (digitally OR physically) mouse, This is very much only an opinion. And I suspect only your personal one. Aug 2, 2023 at 18:44
  • @BenVoigt That's the issue at hand - by default it does not require password entry... Aug 2, 2023 at 19:44

0

You must log in to answer this question.

Browse other questions tagged .