An Administrator must first install any program in order for a Limited User to run it. The LUA is prohibited from doing so. Once a legit program is installed only then does a LUA have the needed permissions. Same with malware, you must be an Admin for the malware to first run. A LUA does not have the rights to run any executable code.
In a buffer overflow attack the program the person is legitimately running is tricked into doing the malware's bidding. The executable file doing the damage is iexplore.exe or acrobat.exe. Not allowing an LUA to install it's own software is irrelevant, iexplore.exe IS allowed run, hence, the malware gets to do it's thing if it exploits a flaw in that exe.
An LUA DOES NOT protect from buffer overflow attacks.
The LUA runs up against the wall of permissions. Malware is executable code, in order to invoke the buffer over run, it must have permission to execute. This can only happen under an Admin. LUAs are prohibited to run .exe code. Malware attempting to inject an over run lacks the needed permissions unless within an Admin acct.
No no no no no - you clearly have no idea what a buffer over flow bug is, or how it works.
A program like IE is running. It has a bunch of stuff in RAM, a mix of data and code, all of which is has permission to execute, because it put it there, and because it is a program that is allowed to run. With a buffer overflow you write data beyond the end of where it should have gone, and over into the bit of RAM owned by IE where IE is keeping it's executable code. IE then runs that code, assuming it is it's own code. The RAM belongs to IE, is edited by IE, and is executed by IE. It has all the permissions IE does.
In short - a LUA provides zero protection.
Blaster must first invoke a restart before it can install- this is the first red flag, an uninvoked restart. Blaster throws this unmistakable sign up. You have the opportunity to easily remove Blaster at this point, with no ill effects of the infection. It is a trivial removal at this stage.
Then Blaster must initially run from within Windows Update. A LUA is not allowed to run Windows Update. Only Admins can do so. Blaster will install and deliver its payload if you are an Admin. If within a LUA , Windows Update will balk and require you to shift into an Admin acct. Exactly as happens in a legitimate Windows Update session.
What are your sources for this? It does not tally at all with my in-the-field direct experience with this worm, or any do
entation I have read.
The blaster worm exploits a flaw in the RPC service which is on by default, and runs with system level privileges. It doesn't matter a JOT what user is logged into the system, or what level that user's account has, Blaster does not enter userspace, it works at the system service level. User accounts literally don't enter into it. Like I said - Blaster can infect a system WITH NO ONE LOGGED IN AT ALL.
I get the impression you do not understand how modern multi-user operating systems are architected at all. There simply is no link between low-level services and regular user accounts.
Furthermore, Blaster requires entry through an open port 135. If your computer is sitting behind a router or a software firewall, I don't see how its possible for Blaster to gain entry.
Thankfully routers are now the norm, so our exposure to worms like Blaster and similar worms is massively limited. We are only at risk from people local to our network, so, family and friends at home, co-workers in work, and fellow customers in hotel and coffee shop wifi. This does not mean the danger is over, but that the danger is less. The fewer open ports we expose to the network, the better.
Well, if after 11 years, if there is no visible effects, no misbehavior, no financial accounts compromised, no unauthorized communications, no open ports, never any results from any antiviral, antinspyware, antiadware, antirootkit, CWShredder scans, no observable botnet behavior whatsoever. If I am somehow infected then what is the point? Doesn't malware have to do something? If it just sits there and exhibits no observable or measurable behavior then why did the author write the code to begin with?
I thought you didn't run any AV? So how exactly do you expect anti viral software to pick it up? If you are running all the software you list above then it's hardly realistic to say you don't run AV! Also - Window automatically runs a malware removal tool behind the scenes as part of Windows Update these days. So goodness knows what has been cleaned up after you that you're just not aware of.
That and you could be lucky. You have been doing the equivalent of sleeping around without protection. Not everyone who does that gets an STD, and not everyone who fails to run AV gets nobbled. Luck exists, it is real.
What has luck got to do with it? I deliberately use a system with settings which prohibit 99.999% of executable code from installing and / or running. There may be some peculiar exceptions which exploit vulnerabilities such as Blaster, but even so an infection has to manifest itself eventually. When it does I will instantly see the behavior and immediately research and remove. As of yet , I have never needed to do any such thing.
No that you know of anyway. And luck has everything to do with it. Not everyone who does something dangerous gets killed. You are doing something dangerous, so far you seem to be OK.
I assume your advice applies to the Unix family and the Mac family as well?
Much of my advice does, though not all.
ALL COMPUTER USERS should keep their OS up to date.
ALL COMPUTER USERS need to keep their web plugins up to date - THE MOST IMPORTANT one to watch is Flash.
ALL COMPUTER USERS need to keep their PDF apps up to date, Adobe have a very very bad track record with security, but they are no alone, Preview on the Mac has also had a lot of PDF related bugs, as have other Windows alternatives like Foxit Reader.
ALL COMPUTER USERS need to keep their media player apps up to date because they can be automatically triggered from the web by embedding a media file in a page or tricking you into downloading them.
ALL COMPUTER USERS need to keep their firewall up when ever they leave the house.
WINDOWS USERS need to run AV.
INEXPERT MAC USERS need to run AV. Why only inexpert Mac users - because there are no Mac viruses actually in the wild at the moment. But there are ever more Mac trojans - which the bad guys try to trick people into installing for them in some way. If you're not an expert user, and you ever install anything, then you should run AV, because Mac users ARE getting infected with shit - I've seen it first hand twice last year in work.
MAC & LINUX POWER USERS should consider running AV to protect Windows users who they may share files with. This is really more of an issue in corporate network TBH - and on servers like email servers.
B.
