Re: How safe is a "Limited" XP account?

From: John Brock (jbrock_at_panix.com)
Date: 02/24/05 

Date: Thu, 24 Feb 2005 16:39:57 +0000 (UTC)

In article <m03bvmvqyv.fsf@ripco.com>, Todd H. <comphelp@toddh.net> wrote:

>jbrock@panix.com (John Brock) writes:

>> What bad things can happen to me while using a plain vanilla
>> "Limited" Windows XP user account?

>> In general I am interested in both likely and worst case
>> scenarios. Any thoughts?

>There are more secure OS's out there.
>
>What are your goals? What need motivates your questions?

My motivation is very simple; I use a Limited account on my home
XP system, and I want to understand how much extra security this
buys me. I don't rely on it for security, and in fact I am quite
paranoid about security -- I have a hardware firewall and anti-virus
software, I have never used IE on this computer except to connect
to microsoft.com for updates, and I read all my email via telnet.
So far I seem to have avoided any viruses or spyware. I am well
aware that there are more secure OS's, and I'm appalled at how
poorly Windows is designed in terms of security. Still, you process
words with the computer you've got, and I just want to understand
the one I've got as well as possible.

I think my question really breaks down into two parts:

1) How well does the theoretical security provided by a Limited
account hold up in practice? I.e., how hard is it in practice to
"escalate privileges", and how long do bugs which allow this to
happen go unfixed?

2) How likely is it that a given piece of malware will be coded to
try to escalate privileges if it finds itself running on a Limited
user account, or even function effectively at all in this situation?
My impression is that most Windows users spend most of their time
in accounts with Administrator privileges, so maybe most virus
writers wouldn't consider it worth their effort to write code that
deals with Limited accounts. Or maybe not. I don't know, hence
my question.

I do notice that when I see lists of recommendations for securing
Windows PCs Limited accounts are often not even mentioned, and I've
wondered why that is. Maybe it's because some old or poorly designed
software won't run properly, and because you can't install most
software. Maybe it's assumed that the typical user can't be trusted
to understand and use a Limited account. Or maybe it just doesn't
add as much security as I think it does. Again, my question. 

-- 
John Brock
jbrock@panix.com

Relevant Pages

  • Re: How safe is a "Limited" XP account?
    ... > My motivation is very simple; I use a Limited account on my home ... I don't rely on it for security, and in fact I am quite ... If you're using windows,, using a limited account is definitely better ...
    (microsoft.public.windowsxp.general)
  • Re: How safe is a "Limited" XP account?
    ... > My motivation is very simple; I use a Limited account on my home ... I don't rely on it for security, and in fact I am quite ... If you're using windows,, using a limited account is definitely better ...
    (comp.security.misc)
  • Re: How safe is a "Limited" XP account?
    ... > My motivation is very simple; I use a Limited account on my home ... I don't rely on it for security, and in fact I am quite ... If you're using windows,, using a limited account is definitely better ...
    (comp.os.ms-windows.nt.admin.security)
  • Re: Limited User has some Administrator Privilages
    ... although the security toolkit at http://www.dougknox.com ... limit access, it doesn't appear to limit access to programs, other than ... The limited account can install software, change firewall settings, ...
    (microsoft.public.windowsxp.security_admin)
  • Re: How safe is a "Limited" XP account?
    ... I use a Limited account on my home ... and I want to understand how much extra security this ... try to escalate privileges if it finds itself running on a Limited ... My impression is that most Windows users spend most of their time ...
    (comp.security.misc)