From: "Rich" 

This is a multi-part message in MIME format.

------=_NextPart_000_03FC_01C7507F.D0F90D80
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

   There is no gaining of admin privileges.  When a setup program =
without a manifest declaring its intended behavior is run a prompt is =
presented to the user.  That is the key.  Without this detection the =
program would otherwise have run as normal and would likely have = silently
failed.  The need for a heuristic goes away when ISVs start = declaring
whether their setup applications require elevation or not.

   The complaint of the "hacker" is that she believes users should have =
to choose between three options not two with the third being, run but = not
elevated.  I'm sure this can be debated on and on.  Three options is = more
complex to users than two and if the user chooses wrong then the = setup
program may appear to work but actually does not.  That is bad and = you
can't expect users to know which is which.  This is for setup = programs,
something the user will run rarely.  The resulting = application, unless it
requires or requests it, does not prompt for = elevation.  This is also a
legacy issue.  ISVs should be declaring their = elevation behavior.  The
documentation for how to do this has been = available for a while.  When
declared the heuristics don't apply.  In = other words, the issue will
become moot.

Rich

  "Antti Kurenniemi"  wrote
in message =
news:45d3ecf6{at}w3.nls.net...
  "mike"  wrote in message=20
  news:qp47t217su4asisj0on59nndl7q4294lar{at}4ax.com...
  > That's because Vista uses a compatibility database and
  > several heuristics to recognize installer executables and,
  > every time the OS detects that an executable is a setup
  > program, "it will only allow running it as administrator."

  So, I would only need to figure out the heuristics rule set, and then =
I=20
  could make my virus look like a setup executable and gain =
administrator=20
  privileges? Well that's just great. Wanna bet that it's already done? =
Just=20
  about the stupidest thing in the world, to let a computer use =
heuristics to=20
  decide if an executable should be given full access...


  Antti Kurenniemi


------=_NextPart_000_03FC_01C7507F.D0F90D80
Content-Type: text/html;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable








   There is
no gaining of =
admin=20
privileges.  When a setup program without a manifest declaring its
= intended=20
behavior is run a prompt is presented to the user.  That is the =
key. =20
Without this detection the program would otherwise have run as normal = and would=20
likely have silently failed.  The need for a heuristic goes away =
when ISVs=20
start declaring whether their setup applications require elevation or=20
not.
 
   The
complaint of the =
"hacker" is that=20
she believes users should have to choose between three options not two = with the=20
third being, run but not elevated.  I'm sure this can be debated on = and=20
on.  Three options is more complex to users than two and if the = user=20
chooses wrong then the setup program may appear to work but actually = does=20
not.  That is bad and you can't expect users to know which is =
which. =20
This is for setup programs, something the user will run rarely.  = The=20
resulting application, unless it requires or requests it, does not = prompt for=20
elevation.  This is also a legacy issue.  ISVs should be
= declaring=20
their elevation behavior.  The documentation for how to do this
has = been=20
available for a while.  When declared the heuristics don't =
apply.  In=20
other words, the issue will become moot.
 
Rich
 

  "Antti Kurenniemi" <NOantti{at}SPAManttikPLEASE.com=">mailto:NOantti{at}SPAManttikPLEASE.com">NOantti{at}SPAManttikPLEASE.com=
>=20
  wrote in message news:45d3ecf6{at}w3.nls.net..."m=
ike"=20
  <mike{at}barkto.com>">mailto:mike{at}barkto.com">mike{at}barkto.com>
wrote =
in message=20
  news:qp47t217su4=
asisj0on59nndl7q4294lar{at}4ax.com...>=20
  That's because Vista uses a compatibility database and> several =

  heuristics to recognize installer executables and,> every time =
the OS=20
  detects that an executable is a setup> program, "it
will only =
allow=20
  running it as administrator."So, I would only
need to figure =
out the=20
  heuristics rule set, and then I could make my virus look like a =
setup=20
  executable and gain administrator privileges? Well that's just =
great.=20
  Wanna bet that it's already done? Just about the stupidest thing =
in the=20
  world, to let a computer use heuristics to decide if an executable =
should=20
  be given full access...Antti=20
Kurenniemi

------=_NextPart_000_03FC_01C7507F.D0F90D80--

--- BBBS/NT v4.01 Flag-5