Re: Tiny Personal Firewall

From: elfs (elfsat_private)
Date: Tue Mar 05 2002 - 04:13:10 PST

  • Next message: Nick FitzGerald: "RE: IE execution of arbitrary commands without Active Scripting"

    > It  must  be  the  responsibility of the OS to prevent console users
    > interacting  with  applications  when the desktop is locked. No user
    > process should ever be able to bypass the lock mechanism.
    
    If we take a look to WinAPI help for, i.e. MessageBox, we see, that it
    has a flag (WindowsNT only), called MB_SERVICE_NOTIFICATION:
    
    (..)  The  caller  is  a  service  notifying the user of an event. The
    function displays a message box on the current active desktop, even if
    there is no user logged on to the computer (..)
    
    So we can write a small test program:
    
    ---[ test.c ]---
    #include <windows>
    void main()
    {
      Sleep(3000);                      // Pause, to give you time to lock
                                        // the computer
      MessageBox(
        NULL,                           // HWND, should be NULL
        "Who cares if we are locked?",  // Messagebox text
        "Test",                         // Messagebox caption
        MB_OK | MB_SERVICE_NOTIFICATION // Flags
      );
    }
    
    and   this gives a chance for almost any appl to communicate with user
    on WinNT, even if the computer is locked.
    
    
    Just my 0.02 Ls -
    
    elfs,
      Latvia
    



    This archive was generated by hypermail 2b30 : Tue Mar 05 2002 - 20:12:10 PST