Comments on: Not using the Secure Desktop? http://www.sturmnet.org/blog/archives/2008/04/25/not-using-the-secure-desktop/ General musings and programming stuff Sun, 27 Jul 2008 02:27:11 +0000 http://wordpress.org/?v=1.5.1.3 by: Chris http://www.sturmnet.org/blog/archives/2008/04/25/not-using-the-secure-desktop/#comment-155154 Fri, 25 Apr 2008 11:42:57 +0000 http://www.sturmnet.org/blog/archives/2008/04/25/not-using-the-secure-desktop/#comment-155154 As I understand it, nothing can send messages to windows an a secure desktop (and so cannot click the buttons for you, thereby circumventing the UAC prompt), and cannot otherwise communicate with it. It's also one of the reasons that screensavers run in a secure desktop - so when the mouse is moved and the user is asked to log on, the login entries cannot be intercepted (and an alternative login screen cannot be shown instead of the standard GINA one) From the point of view of this being an attack vector though, although the above will now be possible, it may probably never be used by malicious software, because 99.9% of UAC-enabled Vista machines will use the secure desktop (i.e. there is a very limited number of exposed machines - and they will likely be run by savvy people who are unlikely to run the malicious software anyway) Personally I won't do it though - just in case something slips through :-) As I understand it, nothing can send messages to windows an a secure desktop (and so cannot click the buttons for you, thereby circumventing the UAC prompt), and cannot otherwise communicate with it.
It’s also one of the reasons that screensavers run in a secure desktop - so when the mouse is moved and the user is asked to log on, the login entries cannot be intercepted (and an alternative login screen cannot be shown instead of the standard GINA one)
From the point of view of this being an attack vector though, although the above will now be possible, it may probably never be used by malicious software, because 99.9% of UAC-enabled Vista machines will use the secure desktop (i.e. there is a very limited number of exposed machines - and they will likely be run by savvy people who are unlikely to run the malicious software anyway)
Personally I won’t do it though - just in case something slips through :-)

]]>