6

I know that a person with physical access to a computer can do almost anything to it. My main concern with my Windows 7 guest account is privacy and sandboxing. I don't want a guest user to have access to files on other user accounts, and I don't want him to download malware that affects more than just the guest account.

I'm using Truecrypt full system encryption, and my regular user and administrator accounts both have strong passwords. Permissions are set so that C:\Users\MyUser can only be accessed by MyUser. If I were to allow a guest to log onto my computer and turn my back for a few hours, is there any reasonable way he could break out of the guest account, get past file permissions, or install malware that affects other users?

I keep my computer up-to-date constantly, and from what I understand zero-day exploits are pretty rare. The only thing I can think of that a guest can do to get around his limitations is install software that takes advantage of an unpatched exploit in Windows or some 3rd party service that has super user privileges. So I assume I'm relatively safe allowing a guest to have access to my computer. Is this a false assumption?

Note: My primary concern is ignorant or irresponsible guests. If I know someone wants to hurt me, I won't let him use my PC.

Phil
  • 309
  • 1
  • 3
  • 9

3 Answers3

2

Firstly, this point:

I'm using Truecrypt full system encryption

When the system is powered on, and the user has physical access, this is pretty much irrelevant. Disk encryption protects you from theft where the thief either isn't aware of the need for, or cannot acquire the key. It won't help you if the key is in memory and the system in use, as files are all being decrypted on demand.

Now,

I keep my computer up-to-date constantly, and from what I understand zero-day exploits are pretty rare.

Yes and no - it depends what in - in the core of Windows I would say "probably". However, any software you have installed that runs as Administrator, or the SYSTEM account (Windows Services) may be a target for privilege escalation. Once privilege escalation has occurred, anything goes.

That's the scary view, now for a little dose of reality. Does the person you intend to leave your computer alone with know enough about your system to:

  1. Know you have a vulnerable package and what it is.
  2. Know how to exploit it.
  3. Know how to cover their tracks so you don't notice immediately on returning.

If I had to guess, I'd say the odds of this are quite low; however, if you're worried you do have options, such as backing your system up beforehand, or providing them access to your network on their own hardware, which is easier to isolate (but comes with its own set of problems).

  • 1
    Good point about Truecrypt. The main reason I mentioned it was to prevent answers like, "Your guest could reboot the PC with a live CD and have unrestricted access to the contents of your hard drive." – Phil Aug 28 '12 at 13:24
  • Lets don't forget. There is a current 0-day exploit within Java that is being used in the wild. There are also other 0-day exploits that have been linked DIRECTLY to Windows and even OS X in some cases that have been used. So setting up the correct permissions on a system often is an important step. – Ramhound Aug 29 '12 at 10:57
  • Phil that's true. It does add a defence in that sense. @Ramhound in this case, we're talking about exploits that let the user gain elevated credentials, and whether the proposed new user of the system has enough knowledge to use them. They're already being given an account, so can already execute arbitrary code, so the only vulnerabilities that matter are those in processes with higher levels of execution that enable them to escape their account confinement. I know there are unpatched exploits in the wild; the question is a) does the attacker and b) are they somewhere the attacker can use? –  Aug 29 '12 at 12:46
1

If I were to allow a guest to log onto my computer and turn my back for a few hours, is there any reasonable way he could break out of the guest account, get past file permissions, or install malware that affects other users?

If the permissions are setup the correct way. A user who is not set as the owner would not even have the ability to read the file, which means unless they duplicated the entire hdd, they would be unable to copy the files in another user's directory.

The only thing I can think of that a guest can do to get around his limitations is install software that takes advantage of an unpatched exploit in Windows or some 3rd party service that has super user privileges. So I assume I'm relatively safe allowing a guest to have access to my computer. Is this a false assumption?

Windows 7 can be configure not allow normal user accounts to install software. This means they would be limited to non-installed software ( i.e. portable applications ).

Ramhound
  • 496
  • 4
  • 9
1

A malicious user would probably be able to get into the system easy. The easiest way I can think of is having the malicious user install a hardware key-logger on the keyboard. After that, they "accidentally" push the power button or restarts the computer. You may think nothing of it and most people would fall for it too. So you enter your password for the true crypt volume and it is logged.

Now they have the ability to boot off a live cd/usb and create users/reset passwords.

ponsfonze
  • 1,332
  • 11
  • 13