Linked by Thom Holwerda on Sat 31st Jan 2009 10:45 UTC
Privacy, Security, Encryption Yesterday, we reported on the security flaw in Windows 7's UAC slider dialog, and today, Microsoft has given a response to the situation, but it doesn't seem like the company intends to fix it. "This is not a vulnerability. The intent of the default configuration of UAC is that users don't get prompted when making changes to Windows settings. This includes changing the UAC prompting level." I hope this reply came from a marketing drone, because if they intend on keeping this behaviour as-is in Windows 7 RTM, they're going to face a serious shitstorm - and rightfully so. Let's hope the Sinfoskies and Larson-Greens at Microsoft rectify this situation as soon as possible.
Thread beginning with comment 346373
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[2]: Not that serious
by Nelson on Sat 31st Jan 2009 14:57 UTC in reply to "RE: Not that serious"
Nelson
Member since:
2005-11-29

And how does that installer run? After it's authorized by the user with UAC.

Voila.

This is the equivalent of saying "I can turn off your house alarm from inside your house". Well, obviously. Just how are you going to get inside the house? You're going to trip the alarm somehow in the process of trying to break in.

That's the simplest terms I can put it in, I hope you can understand.

Look, I think you don't understand the purpose of UAC. The purpose of UAC is to allow Least User Access to the machine. To allow you to perform everyday computer tasks, without being an everyday administrator. It just so happens that a lot of malware tries to perform administrative actions.

UAC is not a safety net to be used without antimalware / antiviruses, it is just a privilege elevator. People make UAC out to be more than it really is.

It is working as intended, because for the program to be able to execute, one way or the other, you need to elevate your privileges with UAC.

If the user downloads a malicious installer, he's already been social engineered into running a malicious program, and into consenting with UAC that this program is safe to run.

This is the circular logic I don't get, how can something which under every circumstance is stopped from executing, be a headline catching critical system flaw? It's ridiculous and it's sad that such FUD is spread on this site.

Facts people, they're good.

Edited 2009-01-31 15:00 UTC

Reply Parent Score: 1

RE[3]: Not that serious
by wanderingk88 on Mon 2nd Feb 2009 13:36 in reply to "RE[2]: Not that serious"
wanderingk88 Member since:
2008-06-26

I understand what you say, but are you sure there are no ways to prompt the execution of a VBScript by way of malware installation without prompting the OS that it's trying to run an unsigned executable?

If anything, the amount of naked_chick.jpg.vbs exploits are surely going to rise.

Either way, even if it doesn't prompt a full-blown vulnerability by itself, it gives way for a lot of exploits, and always having social engineering on your mind, you can do a lot of things, even trick people into installing things that do not have a "CLICK HERE.exe" installer, but a "CLICK HERE.vbs" installer, which can happily disable UAC and then run all the unsigned binaries it wants. I've seen my dad install all kinds of crap on his system this way, regardless of .exe extension.

Reply Parent Score: 1