http://www.istartedsomething.com/20090130/uac-security-flaw-windows-7-beta-proof/
Sacrificing security for usability: UAC security flaw in Windows 7
uacbrokenwindows7 (with proof of concept code)
We soon realized the implications are even worse than originally thought. You could automate a restart after UAC has been changed, add a program to the user’s startup folder and because UAC is now off, run with full administrative privileges ready to wreak havoc.
Windows7 is being rushed, they (M$) need to release it working corectly maybe October 2110.
I read the kernel has a monster sized exploit hole also.
http://www.ibtimes.com/articles/20090514/researchers-find-zero-day-security-hole-windows-7.htm
watcher13
offlineMember
Don't take this a criticism, Lee. I happen tp be a member of the large school that believes that ALL versions of Windows were rushed out before they were ready so that MS would always have some bright and shiny new thing to entice the public to buy. Mac does similar, but by constantly making small changes to the same version, 10.1, .2, .318, (making up numbers here) Leopard, Panther, Iguana (and names, too), whatever, they don't look like they're doing the same. But many of those changes weren't updates but upgrades you had to buy. My impression on Apple, however, is that they at least wait until the stuff is ready. As I wrote here a few months ago, a friend of mine, who codes, was working on an enterprise problem with 95 about a year or so after it came out. After literally spending hours on the phone with tech support looking at various lines, the rep. said, "You really don't want to know what went into this code", insinuating that MS had just thrown together any code it could to make 95 kind of work on time for rollout. In fact, I think every single Windows rollout, with the possible exception of Workgroups and 3.5, has been late. The Bill Gates business model.
On the other hand, I think MS gets a bad rap with UAC. Really, it just has the same mechanics as a heuristic. Of course, UAC isn't all that effective against threats, but it isn't supposed to be. It's supposed to be a necessary tool to allow you the benefit of running with lower privileges, which is, of course, the actual protection. People are just not accustomed and don't understand the value of answering, "did you intend for this or that to happen". I may get less prompts than other users, based on my software and computing habits, but I've never found the one click (though actually that's not even the secure way to do it!) to be a problem. Unfortunately, previous use of Windows has conditioned people into believing this double check is an annoyance, without potential protective value, that's why they compromised in the case of 7. Also unfortunately, too many people believe in the "hope" principal of computer security. And they're usually the ones that end up hopeless.
http://blogs.msdn.com/aaron_margosis/
The new “LUA bug” of Vista/Win7
First and foremost, that approach makes the invalid assumption that the elevated app is running under the same user identity as the desktop user who originally logged on. This is the new “LUA bug” of Vista and Win7.
You must log in to post.
