Linked by Thom Holwerda on Sat 31st Jan 2009 10:45 UTC
Privacy, Security, Encryption Yesterday, we reported on the security flaw in Windows 7's UAC slider dialog, and today, Microsoft has given a response to the situation, but it doesn't seem like the company intends to fix it. "This is not a vulnerability. The intent of the default configuration of UAC is that users don't get prompted when making changes to Windows settings. This includes changing the UAC prompting level." I hope this reply came from a marketing drone, because if they intend on keeping this behaviour as-is in Windows 7 RTM, they're going to face a serious shitstorm - and rightfully so. Let's hope the Sinfoskies and Larson-Greens at Microsoft rectify this situation as soon as possible.
Permalink for comment 346500
To read all comments associated with this story, please click here.
what about other sources of exploits...
by Panajev on Sun 1st Feb 2009 12:55 UTC
Panajev
Member since:
2008-01-09

I see the reasoning by several people here (probably similar reasoning that MS guy used) is basically:

"this is a problem only if you get some malware installed on your system first and to do that you will have to OK an UAC prompt so what good does it do to make the suggested fix here?"

IMHO, if a UAC prompt came up saying "you are trying to change UAC behaviour, please confirm [...]" and message came in the UAC prompt only when you tried to modify UAC settings, few users would press OK without thinking twice.

Besides all the answers already given as far as the reasons why this hole must be closed anyways, there are other more subtle ways for this problem to manifest itself... IE, other browsers, other plugins, other OS components, etc... exploits allowing such malicious UAC disabling scripts to be downloaded into your system and started. Something getting through your web browser couldbe quite dangerous too.

Reply Score: 1