9

I recently faced one issue. It appeared my outlook launched a dialog saying it needed password. It looked like this

Outlook password prompt

I noticed the "->" character in the domain name which usually it auto fills. Also the image it is showing is the default windows 7 user image. I have changed it and it doesn't reflect that. e.g. if I launch remote desktop, here is the windows security dialog which comes up.

Remote connection password prompt

What's going on? Is Outlook launching some custom dialog for password? How can user trust such dialog? Is any app free to launch such dialog?

Gilles 'SO- stop being evil'
  • 50,912
  • 13
  • 120
  • 179
Ankush
  • 193
  • 5

1 Answers1

1

What's going on?

Deviant software behavior. It may be a simple bug, or it could be the side effect of a malicious program. it's hard to tell without more information.

Is Outlook launching some custom dialog for password?

It looks like Outlook ow whatever programs you are using are sending data to a standard authentication mechanism. My guess is that there may be some language translation occuring: i.e. from some language to English.

How can user trust such dialog?

You would need some assurance mechanisms in place. An integrity checking mechanism is a good place to start. You will need a know good integrity value and a system capable of periodically checking your current software against the known good values.

Is any app free to launch such dialog?

More or less yes. Windows provides a framework to programmers for presenting GUI components to users. Even if the authentication mechanism is protected the dialogue GUI can be faked and has been on many versions of Windows in the past.

this.josh
  • 8,843
  • 2
  • 29
  • 51
  • Understood. This may be entirely new question, but is there any way in windows which can do some certificate check or something saying this dialog is trusted by windows, similar to what browsers do for genuine eCommerce sites? – Ankush Oct 04 '11 at 10:03
  • @Ankush, simply: no. You can require that Windows only allows properly signed software to execute, but that would prevent pretty much all custom applications from running. – Steve Oct 04 '11 at 14:45