Installing new applications

frank1

Hi,
SuRun is such a great tool that I am installing it on all my machines (and family machines).

The last installation was on my son's new machine and my son asked a very valid question. He asked "since most application installations require to be installed with administrative rights, how is SuRun protecting the system?"

In fact this is how I destroyed my system a couple of months ago. My virus checker didn't find it, so I double clicked to install, asked for it to be run with admin rights, I said yes. That was it. I could no longer boot windows. Lucky I had a backup.

Is there some strategy that could overcome this problem?
Thanks

frank1

Thank you Kay.
I understand what you are saying.

Kay

SuRun is no system protection. It just tries to make life easier for limited users without compromising system security more that Windows itself does.

[indent]In Windows, objects (like files, folders, desktops, pipes, COM objects...) are protected by access control lists (ACLs). If a thread running inside a process tries to get a handle to an object, the system checks the threads ACL against the objects ACL. If the ACL grants access to the object, the thread gets its desired access.[/indent]

You should only start applications that you trust with elevated rights.
SuRun starts all elevated processes with an ACL that grants only one access for the limited user, the right to wait for the process to end. It's not possible for limited processes to directly execute/inject code in the elevated process.
There's only one chance to compromise system security. That is if a virus would send Windows messages to the elevated Process which remote control menus/commands for the process and do something so that the virus is executed with administrative privileges.

If you choose to install untrusted applications, you're on your own.
I'd suggest using a virtual machine for testing apps.
Most of the VMs support snapshots.

stefan

Hi Frank1,

if you have downloaded a file from an unstrusted source, you can always upload it to an antivirus site like www.virustotal.com where it will be scanned by several of the most popular antivirus engines. If one scanner does not recognize the malware, the others maybe will.
Kay's suggestion to install the software in a virtual machine even after that the software passed the scan is of course more secure.

frank1

Running a file in a virtual environment is a great idea and decided to do so for smaller executable files. I tried Sandboxie, which seems simple enough. The more complicated virtual systems appear to be too complicated for casual use. Large installers (>50Mb installers) containing maybe hundreds of compressed files is still a problem. These files may not be suitable for upload to www.virustotal.com either.
Thanks for the ideas.