Linked by Thom Holwerda on Sat 31st Jan 2009 10:45 UTC
Privacy, Security, Encryption Yesterday, we reported on the security flaw in Windows 7's UAC slider dialog, and today, Microsoft has given a response to the situation, but it doesn't seem like the company intends to fix it. "This is not a vulnerability. The intent of the default configuration of UAC is that users don't get prompted when making changes to Windows settings. This includes changing the UAC prompting level." I hope this reply came from a marketing drone, because if they intend on keeping this behaviour as-is in Windows 7 RTM, they're going to face a serious shitstorm - and rightfully so. Let's hope the Sinfoskies and Larson-Greens at Microsoft rectify this situation as soon as possible.
Permalink for comment 346363
To read all comments associated with this story, please click here.
RE: Not that serious
by Thom_Holwerda on Sat 31st Jan 2009 14:10 UTC in reply to "Not that serious"
Member since:

People seem to overlook the fact that, for this to even propagate in the first place, the user needs to have execution privileges on the system already.

This simple technique works on every admin account, and seeing most home users are still admins, this is a very serious security issue.

Reply Parent Score: 2