How to Prevent hacker intrusion [1]: Avoid using high-privilege users

Why is this topic listed in the first line? -- This is a very common and far-fetched issue. Based on your experience, if you develop good habits and do not use high-Permission users (especially administrators) for daily operations, you can greatly reduce the probability of being hacked. Next, I will introduce it in detail.

★Basic concepts literacy
Considering that this article is intended for layers, Let's explain the terms first.
◇ User Permissions
The so-called "user permission" is, in general, the power of a user. The larger the power is, the more things can be done.

◇ User Group
A user group, as its name implies, is a set of users.
In mainstream operating systems, "User Permissions" are usually linked to "user groups. Different permissions are assigned to different user groups.
To save Users trouble, Windows has a number of built-in user groups (such as Users, Power Users, Guests, and so on ). These built-in user groups have pre-defined several user permissions.

◇ High-Permission users:
The"High-Permission user", Mainly refers to the Administrator group in Windows or the root group in POSIX.
In addition, eliminate a misunderstanding by the way. Many cainiao think that in Windows, only users with the username "Administrator" have Administrator permissions. In fact, even if the user name is not "Administrator",Administrators Group", Also has the Administrator permission.

★Negative textbook
The example of cainiao is not mentioned. Let's just talk about the many programmers I have been using. When using the Linux/Unix system for development, these guys know that they should use the account of a common user for operations. When they need to do some advanced permissions, they should switch to the administrator account (root account ). However, even these developers prefer to use the Administrator for daily operations on their own Windows systems, which is really ironic.
If this is the case for IT Professional Developers, you can imagine a layman who does not understand IT.

★Hazard
If you always log on to the system with the administrator privilege and perform daily work, it means that you have the administrator privilege for every program you run. You know, the Administrator has a lot of authority and can do almost everything.
Suppose you have the above habits. One day, you downloaded a software from the Internet and the software was infected with a virus. Then, when you run the software, the virus will be activated. It also has administrator permissions. In this case, the virus is equal to anti-virus software. If the level of the virus author is higher, you can even cheat anti-virus software or directly kill the anti-virus software.
Apart from viruses, the same is true for Trojans. Assume that when you access the Internet, you do not have to worry about visiting a Trojan-infected website. Once a trojan is activated, it also runs with the Administrator's permissions, which is equally harmful.

★What do you do?
Considering that Windows accounts for the vast majority of users, I just want to talk about it with Windows. I hope fans of Linux and Max OS are not surprising.
To minimize the use of high-Permission users. You 'd better create a non-administrator user after installing the system.

You can make this user belong toPower Users Group", Such:

If you want to be safer, you can just add"Users Group", Such:

In the future, we will mainly use this user for daily operations.
Considering that some users do not understand these two user groups, what is the difference between permissions and administrators. I will give a brief list.

◇ Difference between the Power Users Group and the Administrators group
Compared with the Administrators group, the Power Users Group lacks the following permissions (which only lists the primary permissions ):
1. You cannot add, delete, or Disable other users in the system.
2. Attributes of other users (including passwords, user groups, and so on) cannot be modified)
3. hardware drivers cannot be installed/uninstalled.
4. Some applications cannot be installed/uninstalled.
5. You cannot view system security logs.

◇ Users and Administrators groups
The User group has lower permissions than the Power Users Group. In addition to what the Power Users Group cannot do, the Users Group alsoMissingThe following permissions ):
1. the system time cannot be modified.
2. You cannot modify some system directories (including the/WINDOWS Directory of the system disk, the/WINDOWS/SYSTEM32 directory of the system disk, and the/Program Files directory of the System Disk ).
3. Some system services cannot be started/stopped.
4. You cannot modify all key values in the Registry "HKEY_LOCAL_MECHINE.

From the comparison above, we can see that the Users Group has lower permissions and is safer to use. For example, even if you run a program with a virus, because the virus is the same as you, you only have the permissions of the Users group. As a result, viruses cannot modify or damage important system directories.

★Possible troubles
Generally, the more secure the measure, the more troublesome it is. However, there are solutions to these troubles.

◇ The trouble of switching users
After you log on as a common user, you may need to use an administrator to do something for some reason. However, you (probably open a lot of programs) do not want to cancel the current user.
My suggestions are:
Use the Fast User Switching function to switch users. This feature is available from Windows XP. To put it simply, it allows several different users to log on to the same system at the same time and smoothly switch over. With this function, the trouble is not obvious.

If you are still using an older Windows 2000 system, or you are using a Windows Service version (such as Windows Server 2003 ). In these versions of Windows, the "quick User Switching" function is not available by default. How can this be done?

My suggestions are:
You can start a program with advanced user permissions without logging off the current user.
An example is as follows:
Assume that you are in the environment of an ordinary user, but want to start another program with administrative privileges, such as the command line program (cmd.exe ).
1. First, create a shortcut pointing to cmd.exe. (How can I create shortcuts ?)
2. Select the shortcut with the mouse. In the shortcut menu (right-click menu), select"Attribute"Menu item. The following dialog box is displayed.

3. In the dialog box, click"Advanced"Button. The following dialog box is displayed. Set"Run as another user"Option to check. Now, the shortcut is created.

4. If you want to execute the command line as an administrator in an ordinary user environment, you only need to run the shortcut and the following dialog box will pop up. You only need to enter the Administrator's username and password in the dialog box to start the command line as an administrator.

 

◇ Install software/driver troubles
The main problem is to install software and drivers. To install a driver, you must have the administrator privilege. In addition, many software (such as Office) must be installed by users with the administrator privilege.

My suggestions are:
After the system is installed, the Administrator first needs to complete the above software/drivers. Then, there is no need to use the administrator user. After all, the software you often use is relatively fixed, and it is impossible to install software or drivers in three days (unless you are a software/hardware enthusiast ). Even if you occasionally need to reinstall a software or driver, you can use the method described above to temporarily switch to administrator permissions.

◇ The trouble of modifying the system time
If you usually use "Users Group" instead of "Power Users Group", you do not have the permission to modify the system time.
My suggestions are:
Enable the time synchronization service provided by Windows to automatically synchronize system time.

In addition to the above points, if anyone else has any other troubles, please feel free to contact me. I will add it to this article. The next post in this series will introduce how attackers can fix your passwords and passwords.