Microsoft 'neutered' UAC in Windows 7, says researcher

Blocks only 1 out of 8 Trojans from executing, claims Sophos

Microsoft's decision to reduce the number of annoying security messages that Windows 7 delivers when users install software makes the new operating system more vulnerable to malware infection than Vista, a researcher said today.

"UAC was neutered too much by Microsoft," argued Chester Wisniewski, a senior security advisory with Sophos, talking about Windows' Users Account Control (UAC), the security feature Microsoft debuted with Vista.

UAC prompts users for their consent before allowing tasks such as program and device driver installation to take place. In an effect to quash user complaints -- which had condemned the constant intrusions -- Microsoft modified UAC so it appears less frequently in Windows 7.

That wasn't a good idea, said Wisniewski.

"We wanted to know if UAC was going to be effective in Windows 7," he said. "So we grabbed the next 10 [malware] samples that came in and tried them out."

The 10 samples, most of them Trojan horses, were loaded onto a clean Windows 7 PC that lacked antivirus software, simulating payloads that an actual exploit would deposit on a compromised computer. Wisniewski then ran each piece of malware, as if a user had been duped into launching a file attachment or had surfed to a malicious site and been victimized by an drive-by attack and subsequent silent download.

Of the 10 samples, two would not run under Windows 7 -- not surprising since they were likely designed to execute on the far-more-common Windows XP and Vista -- and only one of the remaining eight triggered an UAC prompt, said Wisniewski.

He acknowledged that the test was quick-and-dirty, and didn't accurately portray how secure Windows 7 was overall, or even how well it would withstand attack if protected by antivirus software, even basic programs like Microsoft's free Security Essentials . The point was to see how much Windows 7's reconfigured UAC would help block malware that made it past security software or got by other defensive measures of the operating system, like DEP (Data Execution Protection) and ASLR (Address Space Layout Randomization).

"UAC is really not protecting users properly," Wisniewski said. "Frankly, people should turn it back into the more aggressive mode, like Vista," he said, speaking of the ability to set the feature's prompting frequency. "And if you find it annoying, you might just as well turn it off, because otherwise it's not doing any good."

UAC's effectiveness has been questioned before. Last February, for instance, a developer for a Virginia-based company that sells secure messaging software to the U.S. government and a well-known blogger claimed that a change to UAC 7 could be exploited by attackers to secretly disable the feature. Microsoft first denied that it was a bug, saying instead that it was by design, but then backpedaled and promised to fix the problem .

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags MicrosoftsecurityWindows 7

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?