Security issue - Page 2

Jim Sachs · 01-19-2009, 04:05 PM

OK, the problem must be farther up the chain, then. I was basing my diagnosis on the statement "Closing the browser will resume the screensaver."

According to Dale, that statement is not true, and MA3 really does not resume. There's a section of code I added a couple of months ago in answer to Vista users complaining about all the black-screen flashes as the program is shutting down. My solution was to switch to a window just an instant before exiting. That may be causing problems with the password system in Vista.

rps · 01-19-2009, 04:19 PM

Originally posted by Jim Sachs:

OK, the problem must be farther up the chain, then. I was basing my diagnosis on the statement "Closing the browser will resume the screensaver."

According to Dale, that statement is not true, and MA3 really does not resume. There's a section of code I added a couple of months ago in answer to Vista users complaining about all the black-screen flashes as the program is shutting down. My solution was to switch to a window just an instant before exiting. That may be causing problems with the password system in Vista.

Actually, I don't think that's the problem at all. This is one heck of a security hole, and to be fair, I think it's as much Microsoft's problem as Jim's. Here's what's happening (as far as I can tell):

When the screensaver is launched with "Display logon screen" checked, Vista launches the program in its own "space" (a secure desktop). The logon prompt won't appear until *all* processes in the secure desktop have closed. On my Vista machine, I clicked the website button; then I "requested" c:\windows\system32\cmd.exe, which I was able to save and then run. From my newly opened command window, I was able launch several other windows applications. I didn't get the logon prompt until every last one of them was closed down.

This link may help explain it a little better:

http://www.eggheadcafe.com/forumarch...st25116607.asp

By comparison, Windows XP closes the secure desktop as soon as the screen saver terminates, and kills any child processes immediately. Clicking on the website button on my XP machine terminates the screensaver gives me the logon prompt, but once I've logged in, I never get my browser with the website. (Lost I believe, in the now dead secure desktop.)

I think the solution for Jim is to hide the website button if the screen saver is running in the secure space. It just shouldn't be allowed when it's running from a "locked" screen saver. (I believe that you can detect this by using the WinAPI function OpenInputDesktop. If OpenInputDesktop fails with the last error of "Access is Denied" (error code 5), then you are in secured mode.

Hope this helps!

~Ralph S.

Edgar · 01-19-2009, 04:54 PM

I have duplicated the problem and looking for a good solution.
I will let Jim know as soon as I have a good solution. Thanks for all the info. That helped narrow it down.

feldon34 · 01-19-2009, 05:14 PM

It really seems a shame that it falls to Jim to work around all these bugs and design flaws in Vista.

Jim Sachs · 01-19-2009, 06:00 PM

Thanks, Ralph - that may help.

Dale · 01-19-2009, 08:26 PM

rps, there's a "downside" to the suggested solution of hiding the website button (under the circumstances).

Some people may believe that MA is only a screensaver, and will therefore (without some complicated instructions) NOT be able to get to the website button.

That's relevant to the update issue.

rps · 01-20-2009, 10:24 AM

Originally posted by Dale:

rps, there's a "downside" to the suggested solution of hiding the website button (under the circumstances).

Some people may believe that MA is only a screensaver, and will therefore (without some complicated instructions) NOT be able to get to the website button.

That's relevant to the update issue.

Yeah, I thought of that; but the fact is, if the user has configured their system to require a password once the screensaver has kicked in, then [interactive] access to the web is pretty much a non-starter. The way to handle access to the web is to have the MA3 install program add a shortcut to the start menu that takes the user to the website.

Also, I disagree with your assertion that people who think MA is only a screensaver will not be able to get to the website - the website button *would* be available through the screensaver settings dialog.

~Ralph S.

Dale · 01-20-2009, 11:07 AM

Good discussion points, with advantages and disadvantages. Jim (and perhaps others) will have to sort out the technical underpinnings, benefits, and drawbacks.

And we haven't seen the "MA3 install program" concept yet.

In this case, I'm hoping that a way exists to get the software to work the way it should in Vista (the same as it does in XP). Having different external behavior depending on the OS, isn't a good thing if it can be avoided.

Shinsa · 01-21-2009, 09:10 AM

Vista 64 also allows bypass from the website button.

The really bad part isn't the internet access, as it is being able to type in "c:\" at that prompt! I haven't looked at everything I can do from there, but I was able to browse to my desktop, and open web-friendly files (.TXT, .PDF, etc..).

I'm wondering if there are other screen savers that allow this?

Shinsa · 01-21-2009, 09:46 AM

MAT 2.6 does this as well.

I did verify, that you can not browse to other users files. Only the user account that had the SS start.

Jim Sachs · 01-21-2009, 09:52 AM

And Beta8e still does this?

Dale · 01-21-2009, 11:10 AM

Originally posted by Jim Sachs:

And Beta8e still does this?

Well, the behavior is somewhat different. Vista Ultimate 32-bit.

Clicking on the Website button, I get a blank desktop and a dialog box that says "There is no file extension in "C:\Program". - with the usual "OK" button to click.

Clicking on that, I get the Password (Vista locked) screen.

So, the security problem seems to be fixed. Now, Edgar needs to get rid of the extraneous dialog box (unless we're doing this for humor).

cjmaddy · 01-21-2009, 11:29 AM

Has nobody bothered to read Item 4, in my post?

4, When I click the 'Website' button, MA3 closes down and I get a 'Windows Script Host' box which states the meaningless error message: - 'There is no file extension in "D:\Program". [OK]'

Are we wasting our time?

Edgar · 01-21-2009, 11:39 AM

This is still a bug. Hopefully will be fix in the next build.

Jim Sachs · 01-21-2009, 12:00 PM

Try Beta 8f: http://www.fish-byte.com/MA3Beta.zip

Dale · 01-21-2009, 12:24 PM

Originally posted by cjmaddy:

Has nobody bothered to read Item 4, in my post?

Are we wasting our time?

I read that post (which was not in this thread), and I was confirming it in this thread. Sorry if that gave offense.

I'm sure the bug will be fixed (or maybe already has been fixed in 8f, which I don't immediately have time to confirm).

cjmaddy · 01-21-2009, 12:54 PM

Dale, - no offence taken. - My comment was not intended to appear to be directed at you.

Dale · 01-21-2009, 01:34 PM

Just downloaded 8f. [Note: the .scr file in the .zip has a timestamp earlier than 8e]

Verified that the screen does say Beta8f.

Clicking on the website button now says "Can not find script file "C:\Program Files\SereneScreen\Marine Aquarium 2.6\openserenescreen.js.

Clicking OK then brings up password box.

feldon34 · 01-21-2009, 02:20 PM

Don't be surprised if bug reports in that "READ ME" thread get lost in the shuffle. The thread was never designed for bug reports.

Edgar · 01-21-2009, 02:36 PM

Dale,
Do you have UAC enabled?
I am curious if it is failing to write a file in the MA26 folder.

01-19-2009, 04:05 PM	#21
Jim Sachs Developer Join Date: Dec 2000 Location: Southern Oregon Posts: 9,791	OK, the problem must be farther up the chain, then. I was basing my diagnosis on the statement "Closing the browser will resume the screensaver." According to Dale, that statement is not true, and MA3 really does not resume. There's a section of code I added a couple of months ago in answer to Vista users complaining about all the black-screen flashes as the program is shutting down. My solution was to switch to a window just an instant before exiting. That may be causing problems with the password system in Vista. Jim Sachs Creator of SereneScreen Aquarium

01-19-2009, 04:54 PM	#23
Edgar Prolific/SereneScreen Developer Join Date: Mar 2003 Location: Norwalk, CA Posts: 513	I have duplicated the problem and looking for a good solution. I will let Jim know as soon as I have a good solution. Thanks for all the info. That helped narrow it down. *Edgar Tolentino* Prolific Developer www.prolific.com www.LifeGlobe.com

01-19-2009, 05:14 PM	#24
feldon34 Forum Administrator Join Date: Dec 2000 Location: Rock Hill, SC Posts: 10,939	It really seems a shame that it falls to Jim to work around all these bugs and design flaws in Vista. "Journalism is printing what someone else does not want printed. Everything else is public relations." - George Orwell "If voting changed anything, they'd make it illegal." - Emma Goldman

01-19-2009, 06:00 PM	#25
Jim Sachs Developer Join Date: Dec 2000 Location: Southern Oregon Posts: 9,791	Thanks, Ralph - that may help. Jim Sachs Creator of SereneScreen Aquarium

01-19-2009, 08:26 PM	#26
Dale Banned Join Date: Jun 2005 Location: Western Missouri Posts: 960	rps, there's a "downside" to the suggested solution of hiding the website button (under the circumstances). Some people may believe that MA is only a screensaver, and will therefore (without some complicated instructions) NOT be able to get to the website button. That's relevant to the update issue. Last edited by Dale; 01-19-2009 at 10:33 PM.

01-19-2009, 04:19 PM	#22
rps Registered Join Date: Oct 2008 Posts: 57	Originally posted by Jim Sachs: OK, the problem must be farther up the chain, then. I was basing my diagnosis on the statement "Closing the browser will resume the screensaver." According to Dale, that statement is not true, and MA3 really does not resume. There's a section of code I added a couple of months ago in answer to Vista users complaining about all the black-screen flashes as the program is shutting down. My solution was to switch to a window just an instant before exiting. That may be causing problems with the password system in Vista. Actually, I don't think that's the problem at all. This is one heck of a security hole, and to be fair, I think it's as much Microsoft's problem as Jim's. Here's what's happening (as far as I can tell): When the screensaver is launched with "Display logon screen" checked, Vista launches the program in its own "space" (a secure desktop). The logon prompt won't appear until all processes in the secure desktop have closed. On my Vista machine, I clicked the website button; then I "requested" c:\windows\system32\cmd.exe, which I was able to save and then run. From my newly opened command window, I was able launch several other windows applications. I didn't get the logon prompt until every last one of them was closed down. This link may help explain it a little better: http://www.eggheadcafe.com/forumarch...st25116607.asp By comparison, Windows XP closes the secure desktop as soon as the screen saver terminates, and kills any child processes immediately. Clicking on the website button on my XP machine terminates the screensaver gives me the logon prompt, but once I've logged in, I never get my browser with the website. (Lost I believe, in the now dead secure desktop.) I think the solution for Jim is to hide the website button if the screen saver is running in the secure space. It just shouldn't be allowed when it's running from a "locked" screen saver. (I believe that you can detect this by using the WinAPI function OpenInputDesktop. If OpenInputDesktop fails with the last error of "Access is Denied" (error code 5), then you are in secured mode. Hope this helps! ~Ralph S.

01-20-2009, 10:24 AM	#27
rps Registered Join Date: Oct 2008 Posts: 57	Originally posted by Dale: rps, there's a "downside" to the suggested solution of hiding the website button (under the circumstances). Some people may believe that MA is only a screensaver, and will therefore (without some complicated instructions) NOT be able to get to the website button. That's relevant to the update issue. Yeah, I thought of that; but the fact is, if the user has configured their system to require a password once the screensaver has kicked in, then [interactive] access to the web is pretty much a non-starter. The way to handle access to the web is to have the MA3 install program add a shortcut to the start menu that takes the user to the website. Also, I disagree with your assertion that people who think MA is only a screensaver will not be able to get to the website - the website button would be available through the screensaver settings dialog. ~Ralph S.

01-20-2009, 11:07 AM	#28
Dale Banned Join Date: Jun 2005 Location: Western Missouri Posts: 960	Good discussion points, with advantages and disadvantages. Jim (and perhaps others) will have to sort out the technical underpinnings, benefits, and drawbacks. And we haven't seen the "MA3 install program" concept yet. In this case, I'm hoping that a way exists to get the software to work the way it should in Vista (the same as it does in XP). Having different external behavior depending on the OS, isn't a good thing if it can be avoided.

01-21-2009, 09:10 AM	#29
Shinsa Registered Join Date: Apr 2001 Location: Fayetteville, NC Posts: 407	Vista 64 also allows bypass from the website button. The really bad part isn't the internet access, as it is being able to type in "c:\" at that prompt! I haven't looked at everything I can do from there, but I was able to browse to my desktop, and open web-friendly files (.TXT, .PDF, etc..). I'm wondering if there are other screen savers that allow this? Bob "When you have excluded the impossible, whatever remains, however improbable, must be the truth." _______________________________________________

01-21-2009, 09:46 AM	#30
Shinsa Registered Join Date: Apr 2001 Location: Fayetteville, NC Posts: 407	MAT 2.6 does this as well. I did verify, that you can not browse to other users files. Only the user account that had the SS start. Bob "When you have excluded the impossible, whatever remains, however improbable, must be the truth." _______________________________________________

01-21-2009, 09:52 AM	#31
Jim Sachs Developer Join Date: Dec 2000 Location: Southern Oregon Posts: 9,791	And Beta8e still does this? Jim Sachs Creator of SereneScreen Aquarium

01-21-2009, 11:10 AM	#32
Dale Banned Join Date: Jun 2005 Location: Western Missouri Posts: 960	Originally posted by Jim Sachs: And Beta8e still does this? Well, the behavior is somewhat different. Vista Ultimate 32-bit. Clicking on the Website button, I get a blank desktop and a dialog box that says "There is no file extension in "C:\Program". - with the usual "OK" button to click. Clicking on that, I get the Password (Vista locked) screen. So, the security problem seems to be fixed. Now, Edgar needs to get rid of the extraneous dialog box (unless we're doing this for humor).

01-21-2009, 11:29 AM	#33
cjmaddy Registered Join Date: Nov 2001 Location: Lancashire, UK Posts: 7,854	Has nobody bothered to read Item 4, in my post? 4, When I click the 'Website' button, MA3 closes down and I get a 'Windows Script Host' box which states the meaningless error message: - 'There is no file extension in "D:\Program". [OK]' Are we wasting our time?

01-21-2009, 11:39 AM	#34
Edgar Prolific/SereneScreen Developer Join Date: Mar 2003 Location: Norwalk, CA Posts: 513	This is still a bug. Hopefully will be fix in the next build. *Edgar Tolentino* Prolific Developer www.prolific.com www.LifeGlobe.com

01-21-2009, 12:00 PM	#35
Jim Sachs Developer Join Date: Dec 2000 Location: Southern Oregon Posts: 9,791	Try Beta 8f: http://www.fish-byte.com/MA3Beta.zip Jim Sachs Creator of SereneScreen Aquarium

01-21-2009, 12:24 PM	#36
Dale Banned Join Date: Jun 2005 Location: Western Missouri Posts: 960	Originally posted by cjmaddy: Has nobody bothered to read Item 4, in my post? Are we wasting our time? I read that post (which was not in this thread), and I was confirming it in this thread. Sorry if that gave offense. I'm sure the bug will be fixed (or maybe already has been fixed in 8f, which I don't immediately have time to confirm).

01-21-2009, 12:54 PM	#37
cjmaddy Registered Join Date: Nov 2001 Location: Lancashire, UK Posts: 7,854	Dale, - no offence taken. - My comment was not intended to appear to be directed at you.

01-21-2009, 01:34 PM	#38
Dale Banned Join Date: Jun 2005 Location: Western Missouri Posts: 960	Just downloaded 8f. [Note: the .scr file in the .zip has a timestamp earlier than 8e] Verified that the screen does say Beta8f. Clicking on the website button now says "Can not find script file "C:\Program Files\SereneScreen\Marine Aquarium 2.6\openserenescreen.js. Clicking OK then brings up password box.

01-21-2009, 02:20 PM	#39
feldon34 Forum Administrator Join Date: Dec 2000 Location: Rock Hill, SC Posts: 10,939	Don't be surprised if bug reports in that "READ ME" thread get lost in the shuffle. The thread was never designed for bug reports. "Journalism is printing what someone else does not want printed. Everything else is public relations." - George Orwell "If voting changed anything, they'd make it illegal." - Emma Goldman

01-21-2009, 02:36 PM	#40
Edgar Prolific/SereneScreen Developer Join Date: Mar 2003 Location: Norwalk, CA Posts: 513	Dale, Do you have UAC enabled? I am curious if it is failing to write a file in the MA26 folder. *Edgar Tolentino* Prolific Developer www.prolific.com www.LifeGlobe.com