Linked by Thom Holwerda on Sat 31st Jan 2009 10:45 UTC
Privacy, Security, Encryption Yesterday, we reported on the security flaw in Windows 7's UAC slider dialog, and today, Microsoft has given a response to the situation, but it doesn't seem like the company intends to fix it. "This is not a vulnerability. The intent of the default configuration of UAC is that users don't get prompted when making changes to Windows settings. This includes changing the UAC prompting level." I hope this reply came from a marketing drone, because if they intend on keeping this behaviour as-is in Windows 7 RTM, they're going to face a serious shitstorm - and rightfully so. Let's hope the Sinfoskies and Larson-Greens at Microsoft rectify this situation as soon as possible.
Thread beginning with comment 346362
To read all comments associated with this story, please click here.
Not that serious
by Nelson on Sat 31st Jan 2009 14:08 UTC
Nelson
Member since:
2005-11-29

People seem to overlook the fact that, for this to even propagate in the first place, the user needs to have execution privileges on the system already.

You want to know how else I can turn UAC off? I can break into your home, take your keyboard, and type in the key combination myself.

That's basically what this amounts to. You're stuck in the situation where to turn UAC off you need to first bypass UAC and get installed on the machine. That's why it's not considered a vulnerability.

The way UAC is more silent in Windows 7 is, it does not prompt for executables that are signed by Microsoft. This means that most of the system components require no elevation at all, since they're being done by the user at his Computer.

The real protection comes in, when an unknown and unsigned program attempts to run on your machine. That's when UAC gets all noisy.

The distinction between Windows 7's UAC and Vista's UAC is this distinction. Vista's UAC locked down the machine, even from seemingly harmless tasks (Deleting a shortcut, for example). Windows 7's UAC is much smarter about it's protection, and uses digital signatures to be more lenient.

I think the best "solution" I've seen is to not allow SendKeys to operate on signed executables. Problem solved, now get to it Microsoft.

Ps:

I'd like to add on, for those who think that this can be compounded with other social engineering malware, that it's irrelevant.

If one UAC dialog can't prevent a user from realizing he's running a dangerous program, then ten UAC dialogs won't be able to stop him either, so the point is moot.

Edited 2009-01-31 14:10 UTC

Reply Score: 3

RE: Not that serious
by Thom_Holwerda on Sat 31st Jan 2009 14:10 in reply to "Not that serious"
Thom_Holwerda Member since:
2005-06-29

People seem to overlook the fact that, for this to even propagate in the first place, the user needs to have execution privileges on the system already.


This simple technique works on every admin account, and seeing most home users are still admins, this is a very serious security issue.

Reply Parent Score: 2

RE[2]: Not that serious
by Nelson on Sat 31st Jan 2009 14:31 in reply to "RE: Not that serious"
Nelson Member since:
2005-11-29

UAC still prompts for elevation on Administrator accounts.

Try it.

Reply Parent Score: 1

RE: Not that serious
by darknexus on Sat 31st Jan 2009 14:49 in reply to "Not that serious"
darknexus Member since:
2008-07-15

Just one little problem with what you're saying. A script can change these settings... without a prompt. Now, how can a script be run? Well, let's see here... given how many people seem to illegally download commercial software on the Windows platform, one could simply embed this script in their installer. If the default settings aren't changed, it will run, no problem. And then everything is open.
So the defaults can be changed. How many average home users do you know who have any idea what UAC actually is, or how to change it? Even if they were told how, how many of them know or care why?
Yes, you're going to have complainers about UAC regardless of the decisions MS makes. This, however, is a legitimate complaint as it does not require physical interaction to disable UAC. This is a situation where the default security level is insufficient to prevent a script from making changes to the security policy. This is a huge no-no. The fix? Exempt UAC changes from being scripted, forcing a prompt whenever the UAC setting is changed. Leave the other prompts as they are, but always prompt when changing any UAC-related settings. This isn't too difficult, wouldn't interfere with the average home user, and those who did want to change the UAC settings would know why they were changing them anyway. Clicking one extra continue button in this one instance wouldn't hurt them.
Microsoft had better fix this, seriously. If they don't, they might as well drop security altogether, as they're leaving the front door wide open anyway.

Reply Parent Score: 5

RE[2]: Not that serious
by Nelson on Sat 31st Jan 2009 14:57 in reply to "RE: Not that serious"
Nelson Member since:
2005-11-29

And how does that installer run? After it's authorized by the user with UAC.

Voila.

This is the equivalent of saying "I can turn off your house alarm from inside your house". Well, obviously. Just how are you going to get inside the house? You're going to trip the alarm somehow in the process of trying to break in.

That's the simplest terms I can put it in, I hope you can understand.

Look, I think you don't understand the purpose of UAC. The purpose of UAC is to allow Least User Access to the machine. To allow you to perform everyday computer tasks, without being an everyday administrator. It just so happens that a lot of malware tries to perform administrative actions.

UAC is not a safety net to be used without antimalware / antiviruses, it is just a privilege elevator. People make UAC out to be more than it really is.

It is working as intended, because for the program to be able to execute, one way or the other, you need to elevate your privileges with UAC.

If the user downloads a malicious installer, he's already been social engineered into running a malicious program, and into consenting with UAC that this program is safe to run.

This is the circular logic I don't get, how can something which under every circumstance is stopped from executing, be a headline catching critical system flaw? It's ridiculous and it's sad that such FUD is spread on this site.

Facts people, they're good.

Edited 2009-01-31 15:00 UTC

Reply Parent Score: 1