Do I Understand Limited/Standard Accounts Correctly?

[macd7]

A while back someone on a security forum linked mechbgons guide which I read and tested on a couple of machines. Impressive site and mechbgon I found your security guide the best on the web. I also tried dl'ing malicous files on an XP machine I was getting ready to reformat to test the my setups security and it passed with flying colors after putting on the limited account with SRP.

Guide here:
http://www.mechbgon.com/build/security2.html

I've seen links this new study that, if I understand correctly, shows that on a patched windows system Anti Virus programs still detect 90% or less of malware.
http://mtc.sri.com/live_data/av_rankings/

And this link shows 92% of critical vulnerabilites on an unpatched Windows system are negated by a limited/standard user account.
http://blogs.zdnet.com/security/?p=2517

To simplify a few things please tell me if I have these things correct.

1. Based on the above links, you'd likely be safer running a limited account as a limited user online with an unpatched system compared to a patched system running as an admin online?

2. UAC 'mimicks' a limited user account. If you want a true security boundary of a limited account you must use a limited account. Correct?

3. Keeping UAC enabled on a limited account in vista/win7 is worthwhile to keep IE protected mode, and file & registry virtulization. Is file & registry virtulization kind of like sandboxing or blocking off your program files and registry?

4. [FONT=&quot]SRP prevents executables from running in places other than the Windows and Program Files directories. So in conjunction with a limited user account which cannot add/remove programs or add/remove anything to Windows or Program File directories, and with the software restriction policy you can only execute files from Windows/Program Files so I fail to see how a nasty infection could take hold in this environment? Seems it would be rock solid security wise.

5. Most interesting to me was this quote on another thread from mechbgon: "[/FONT] In the course of my SiteAdvisor work, I've set up a highly-vulnerable Win2000 system hundreds of times, loaded with all sorts of exploitable out-of-date stuff, and deliberately sent it to MPACK-infested sites and every other sort of dangerous site I could find. It was nearly impossible to get it infected when using a Restricted User account (which is what Win2000 calls a low-rights account). But if I logged on as an Admin, the box was pwned immediately."

So with Win2000 configured as a limited user, compared to Win7 running as admin with UAC enabled, the Win200 box would be more secure?

Hope my questions can help others also and thanks for the great forum you have here!

[FONT=&quot][/FONT]

 

[Chiefcrowe]

I'll try to answer what I can:

1. Yes, definitely safer using a limited acct.!

2. Correct

3. not sure about this one.

4. Yes, that would be pretty solid security, but common sense always should be used when downloading software online, etc.

There is always a possibility even though it may be remote, that something could get through.

5. Not sure about this.. overall i think Win7 may be better but i'd need to test this scenario to be sure.

 

[mechBgon]

I've seen links this new study that, if I understand correctly, shows that on a patched windows system Anti Virus programs still detect 90% or less of malware.
http://mtc.sri.com/live_data/av_rankings/

My own tests were even less optomistic: http://www.antisource.com/article.php/antispyware-comparisons

And this link shows 92% of critical vulnerabilites on an unpatched Windows system are negated by a limited/standard user account.
http://blogs.zdnet.com/security/?p=2517

"Negated" is a little too strong... if you go through the original report, it's more like "at least some level of mitigation," not "LOL I'm invincible"

To simplify a few things please tell me if I have these things correct.

1. Based on the above links, you'd likely be safer running a limited account as a limited user online with an unpatched system compared to a patched system running as an admin online?

It depends what the bad guys are trying to do. If you re-read the SRP page, I've listed a sampler of Bad Things they could still accomplish if their exploit is designed to function within the "padded cell" of a Limited account, like encrypting your documents to hold for ransom. That was rare, but now that Win7 and Vista have changed the rules, I hear the bad guys are adapting. Mark R. of Sysinternals fame says really bluntly that the bad guys will adapt their malware to the new non-Admin norm.

2. UAC 'mimicks' a limited user account. If you want a true security boundary of a limited account you must use a limited account. Correct?

To have a true security boundary, you would log out of the non-Admin account and log into the Admin account when you wanted to do Admin stuff, or at least do a Fast User Switch to the Admin account.

3. Keeping UAC enabled on a limited account in vista/win7 is worthwhile to keep IE protected mode, and file & registry virtulization. Is file & registry virtulization kind of like sandboxing or blocking off your program files and registry?

It lets Vista/7 humor software that wants Admin rights or it won't work properly. The software gets to see an illusion, like that one classic Star Trek where the aliens have Kirk in their little illusion zoo. Sort of.

4. SRP prevents executables from running in places other than the Windows and Program Files directories.

So in conjunction with a limited user account which cannot add/remove programs or add/remove anything to Windows or Program File directories, and with the software restriction policy you can only execute files from Windows/Program Files so I fail to see how a nasty infection could take hold in this environment? Seems it would be rock solid security wise.

It's pretty good. I know of a couple potential loopholes... on WinXP there are a couple places where your Limited account can put files in subdirectories of Program Files or the Windows directory, for example. Also, if the bad guys can come up with a way to call an "approved" program, like CMD.EXE, with parameters that make it do what they want, that's another possible gotcha. I haven't researched that one.

5. Most interesting to me was this quote on another thread from mechbgon:

"In the course of my SiteAdvisor work, I've set up a highly-vulnerable Win2000 system hundreds of times, loaded with all sorts of exploitable out-of-date stuff, and deliberately sent it to MPACK-infested sites and every other sort of dangerous site I could find. It was nearly impossible to get it infected when using a Restricted User account (which is what Win2000 calls a low-rights account). But if I logged on as an Admin, the box was pwned immediately."

So with Win2000 configured as a limited user, compared to Win7 running as admin with UAC enabled, the Win200 box would be more secure?

Win7 would be more secure because it has more anti-exploit features like Data Execution Prevention, Address Space Layout Randomization, SEHOP, Protected Mode and Windows Integrity Control, plus your software doesn't run at Admin level even if you're logged on as an Admin, as long as UAC is enabled (although if you intend to be an Admin all the time, it would be best to max out the UAC slider).

 

[macd7]

excellent info as usual mech :thumbsup:
I've learned quite a bit from reading your stuff thx man