Security Adviser | Roger A. Grimes » Users want OS X to remove elevation prompts

January 27, 2007 | Comments: (0)

Users want OS X to remove elevation prompts

TAGS: None

Users want Apple to remove OS X elevation prompt

Similiar to a behavior in Windows Vista, Mac OS X has long required a secondary authorization to be completed when performing root tasks, even if logged in as the root account already. Although the Mac OS X mechanism works differently than Windows User Account Control (UAC), the effect is the same: It prevents unauthorized tasks requiring elevated privileges that the user has not explicitly authorized. Like Windows Vista, the simple elevation prompt attempts to stop "drive-by" downloads and malicious executions.

I'm a big fan of them. In Windows Vista, using group policy or a registry edit, you can turn on or off UAC, or have a little control over when it prompts a logged in user. I'm assuming this is not the case in OS X, as at least 30 or more people have signed an online petition asking for it to be removed all together.

Personally, I wouldn't want an elevation prompt to be removed. There is too much value. While visiting an unknown web site a few weeks ago in Windows Vista, a zero-day attack was launched against my system. The only way I knew it was happening, was the unexpected UAC dialog box prompting me for my permission to execute something with admin credentials. I returned to the web site, in a Virtual PC session, with Windows XP Pro SP2, and the malware siliently installed itself. I'm a fan of UAC for life.

Yes it's a little annoying, but after a few weeks of using it, you almost don't even notice the elevation dialog box. If anything, the risk is that the average user will click to allow the elevation every time they are prompted, even if initiated by some malicious software program. Still, when I really needed UAC, it saved me.

I encourage all readers to resist the impulse to turn UAC (or the Mac OS X equivalent) off. There is a reason why the vendors felt it important enough to annoy their power user base.

Posted by Roger Grimes on January 27, 2007 03:40 AM

RATE THIS ARTICLE: