Gadgets for Windows Sidebar Security

  • Article

This overview contains information about the security model of the Windows Sidebar.

  • Introduction

  • Packaging

  • Downloading

  • HTML runtime

  • User Account Control

  • Parental Controls

  • Full Trust

  • For Further Reference

Introduction

Gadgets for Sidebar, though developed using the functionality of the Microsoft HTML (MSHTML) runtime, are not limited by the standard browser security model. Since gadgets are locally installed mini-applications that provide a rich set of system access APIs, a packaging and deployment method similar to a typical executable distribution is employed.

Packaging

A gadget is downloaded as a "package" of resources and configuration files. The package is distributed as a zip file or as a Windows cabinet (.cab) file. Both methods of distribution require the file extension, .zip or .cab, to be changed to .gadget. If the file is packaged as a .cab file, you can use a code signing certificate to provide information about the origin of the gadget. The user is then presented with this information before the gadget files are extracted. The signtool.exe application included with Visual Studio 2005 can be used to sign a gadget.

Note   There is no requirement for gadgets to be digitally signed since the certificates are costly and not commonly used by the developer community likely to create gadgets.

Downloading

Windows Defender is a free program that helps protect your computer against pop-ups, slow performance, and security threats caused by spyware and other unwanted software. When integrated with Internet Explorer, Windows Defender performs file scanning on downloads to help ensure that one does not accidentally download malicious software. Gadget packages are included in the Windows Defender scan.

Note   The latest version of Microsoft Internet Explorer has a new security feature called Protected Mode. Protected Mode is an enhancement designed to protect users while browsing the internet from malicious software running in the context of an untrusted remote Web page. Protected Mode does not apply to gadgets because they run on the local computer.

The Protected Mode dialog.

HTML runtime

The gadget security model can be compared with Internet Explorer and associated domain sandboxing security models. However, gadgets have more in common with HTML Applications (HTAs) than they do with HTML content in Internet Explorer. Because gadgets have a similar download and installation process as other executable code, gadgets have been provided with a similar set of capabilities. The MSHTML runtime is configured with the set of permissions given to HTAs or the Local Machine Zone security configuration.

Gadgets are configured differently from Web pages in several ways:

  • Because gadgets are considered executable code, they can instantiate any installed ActiveX object when the option "Initialize and script ActiveX controls not marked as safe for scripting" is enabled in Internet Explorer.
    The Internet Explorer Security Settings dialog showing the 'Initialize and script ActiveX controls not marked as safe for scripting' radio button selection.
  • Since gadgets can aggregate data from various locations, "Access data sources across domains" is enabled in Internet Explorer.
    The Internet Explorer Security Settings dialog showing the 'Access data sources across domains' radio button selection.

User Account Control

User Account Control (UAC) is a new feature of Microsoft Windows Vista that improves security when running as a standard user. Gadgets run with standard user privileges in the Administrator Approval Mode of UAC even if the user is a member of the administrators group. This helps prevent gadget code from modifying protected resources.

As an additional precaution, Sidebar Gadgets do not display the UAC elevation prompts that are used to run programs with full administrator privileges. If a gadget launches an application installed on the computer, however, that application may display UAC elevation prompts. For example, if a gadget attempts to delete a file in the System32 directory, the delete operation would not succeed and no elevation prompt would be shown to the user. This failure happens because most critical files cannot be modified by standard users.

Parental Controls

Windows Vista includes a new parental controls feature to help enforce various safe browsing and execution policies on a computer. For example, a parent might only allow a child to run games that are G-rated and only browse to specific Web sites. The policy for Web browsing applies to gadgets in the Sidebar also; if the parental control policy only allows a child to browse to Web sites "A" and "B", attempts to communicate with site "C" will fail.

Full Trust

The choice to run a gadget is presented to the user in the same way that the choice to run any application downloaded from the internet is presented. Information about the author of the gadget is displayed in a dialog box that indicates there is risk associated with this file. After the user accepts the warning, the gadget will run with all of the permissions associated with their login account.

The Security Warning dialog presented to a user when a gadget is installed.

Note   An individual gadget may only have a single function such as reading files and information from the computer, accessing information from one or more domains, or displaying buttons and information for a utility. However, gadgets mix and match functionality in a variety of ways and, in aggregate, have the same set of functionality as other code.

Additional Security for Corporations

In a computing environment controlled by group policy, the use of gadgets can be further limited. The Sidebar supports three gadget folders, %systemdrive%\Program Files\Windows Sidebar\Shared Gadgets and %systemdrive%\Program Files\Windows Sidebar\Gadgets that can only be modified by the Administrator group and the %systemdrive%\Users\%user%\AppData\Local\Microsoft\Windows Sidebar\Gadgets folder where gadgets downloaded by the user are installed.

Note  The Shared Gadgets folder provides access to a gadget for all users of the machine.

The Windows Sidebar has the following group policy options available:

  • Turn off Windows Sidebar.

    This policy allows administrators to completely disable the Windows Sidebar.

  • Disable unpacking and installation of gadgets that are not digitally signed.

    This policy allows administrators to require that all gadgets installed by a user are digitally signed. This policy only affects gadgets that are downloaded and installed by double-clicking on the gadget package. All previously installed gadgets, as well as those installed manually, will still function.

  • Turn off user-installed gadgets.

    This policy allows administrators to block gadgets not placed into either the Gadgets or the Shared Gadgets folders (both of which can only be modified by a user in the administrator group). Gadgets installed into the %systemdrive%\Users\%user%\AppData\Local\Microsoft\Windows Sidebar\Gadgets folder will not display in the Gadget Gallery dialog box or be allowed to run.

  • Override the "Get more gadgets online" link.

    The Gadget Gallery dialog box provides a link where users can discover more gadgets. By default, this link points to an online Microsoft Web site; however, administrators can specify that this link point to another Web site. Administrators can then more easily distribute gadgets that are approved for use within their organization.

For Further Reference

Windows Defender World Wide Web link

User Account Control World Wide Web link

Parental Controls World Wide Web link