Is Windows 7′s UAC still insecure?
Microsoft made some changes to UAC after the Windows community discovered a huge security flaw that allowed the UAC setting to be changed without the user knowing at all. These changes are applied in Windows 7 RC. But the guys over at OSNews still believe that UAC is insecure.
In order to decrease the number of UAC prompts in Windows 7, Microsoft gave some Windows apps and processes auto-elevated privileges that don’t trigger any UAC prompts. However, the downside of this is that these apps can be exploited to wreak havoc on the computer. A proof-of-concept exploit has been developed by injecting its code into the memory of a process with such apps that have special privileges. This is what Holwerda from OSNews has to say about UAC:
At this point in time, the default UAC level in Windows 7, and all levels below that, are insecure. You might as well turn UAC off completely, as it makes no difference to have it either off or at the default level. This entire flaw becomes null the moment you set UAC to its highest setting (as that disables auto-elevation).
You can read the entire article over at OSNews
Related posts:
Tags: windows 7, windows 7 security, windows 7 uac
To discuss this topic, head on over to our forums!
5 Responses to “Is Windows 7′s UAC still insecure?”
Leave a Reply
To discuss this topic, head on over to our forums!
Loading ...
Well, isn’t this what you all wanted?
why would we want this?
That was (pretty much) my thought on the subject. People complain about how invasive (and controlling) UAC is in Vista, so the new OS allows greater flexibility in how it works. By creating greater flexibility, however, that means that it will be less secure. Sorry but if you put a door in a wall, it is less secure than just the wall, even if you lock the door. At this point, people have what they want but some will eventually complain that MS is selling them an OS with a security flaw. This is one where MS can never really win the PR game….
Stephen
well, the video shows build 7000, there has been an incredible amount of changes since then. am I wrong?
I’d be happy with a mixture between the safest and the 2nd lowest solution. Most secure, but no desktop dimming, as it takes a lot of time longer to appear and disappear.