Linked by Thom Holwerda on Sat 31st Jan 2009 10:45 UTC
Privacy, Security, Encryption Yesterday, we reported on the security flaw in Windows 7's UAC slider dialog, and today, Microsoft has given a response to the situation, but it doesn't seem like the company intends to fix it. "This is not a vulnerability. The intent of the default configuration of UAC is that users don't get prompted when making changes to Windows settings. This includes changing the UAC prompting level." I hope this reply came from a marketing drone, because if they intend on keeping this behaviour as-is in Windows 7 RTM, they're going to face a serious shitstorm - and rightfully so. Let's hope the Sinfoskies and Larson-Greens at Microsoft rectify this situation as soon as possible.
Thread beginning with comment 346369
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[3]: Not that serious
by Thom_Holwerda on Sat 31st Jan 2009 14:38 UTC in reply to "RE[2]: Not that serious"
Thom_Holwerda
Member since:
2005-06-29

UAC still prompts for elevation on Administrator accounts.


Ah, I see you don't get what this flaw is about.

The problem is that the in the default setting for Windows 7, changes to Windows' settings DO NOT trigger UAC - and this INCLUDES the slider for UAC.

In other words, on admin accounts, with Windows 7's DEFAULT UAC settings, you can maliciously disable UAC without the user ever seeing any prompt whatsoever.

Get it now?

Reply Parent Score: 2

RE[4]: Not that serious
by Nelson on Sat 31st Jan 2009 14:52 in reply to "RE[3]: Not that serious"
Nelson Member since:
2005-11-29

No. For this (the proposed exploit) to even propagate on the system, he'd need to authorize it to run, which would trigger UAC.

That's the angle from which it's looked at by Microsoft: It cannot be remotely exploited without social engineering, the user needs to have already run the program (And consented with UAC) before any of this is allowed to happen.

You're talking about the program already executing on the users machine, which means UAC has one way or the other already been defeated.

Like I said, in cases of social engineering, if the user is gullible, not one UAC dialog, or ten UAC dialogs will be able to stop him from being exploited.

Reply Parent Score: -1

RE[5]: Not that serious
by Gone fishing on Sat 31st Jan 2009 15:03 in reply to "RE[4]: Not that serious"
Gone fishing Member since:
2006-02-22

My understanding was:

The user gets a file such as see_girl_naked.vbs The file runs a script that emulates some key strokes and poof no UAC. But you could have a nice new mail server installed

What should happen is a warning see_girl_naked.vbs wishes to modify your system files click yes to allow. Obviously if you say yes your an idiot and very little can save you.

Reply Parent Score: 4

RE[5]: Not that serious
by WorknMan on Sat 31st Jan 2009 16:53 in reply to "RE[4]: Not that serious"
WorknMan Member since:
2005-11-13

No. For this (the proposed exploit) to even propagate on the system, he'd need to authorize it to run, which would trigger UAC.

That's the angle from which it's looked at by Microsoft: It cannot be remotely exploited without social engineering, the user needs to have already run the program (And consented with UAC) before any of this is allowed to happen.


And how do you suppose most malware gets on a user's machine, through osmosis?

If it promises nude pics of Angelina Jolie, they WILL run it! MS needs to make UAC prompt if there are any changes to its setting under ANY circumstances.

Edited 2009-01-31 16:53 UTC

Reply Parent Score: 4