A month has barely passed since the public beta debut of Windows 7 and we have our first horror story.UAC (user account control) was the major gripe with Windows Vista which annoyed most tech savvy users and confused ordinary consumers. Microsoft has changed the behavior in Windows 7, lowering the requirement for user interaction when changing system settings. The apparent downside to this is, according to reports, the way Microsoft has changed the behavior makes it extremely easy for malware authors to write code to disable UAC without user intervention.
By default, Windows 7's UAC setting is set to "Notify me only when programs try to make changes to my computer" and "Don't notify me when I make changes to Windows settings". Microsoft makes the distinction between a (third party) program and Windows settings with a special signed Windows 7 security certificate. The applications/applets which manage Windows settings are signed with this certificate. Control panel items are signed with this certificate so they don't prompt UAC if you change any system settings.
The issue is as these applets are signed to not prompt for UAC, you could emulate some keyboard inputs and within a few moments have UAC disabled on a machine without user interaction. Rafael Rivera has done exactly that and posted concept code using some simple VBScript at his site. Malware authors could easily bake this into a fake program to trick the user to execute it.
You'd think this would be easy to fix right? Well you're right but beta testers have been filing bugs with Microsoft (via its connect program) and have met resistance from the software company when Microsoft employees state the behavior is "by design". We have contacted company officials for a statement on the issue but at the time of writing have not received a response.
http://www.istartedsomething.com/20090130/...s-7-beta-proof/
Last edited by Brandon Live on 30 Jan 2009 - 17:28
That's not the issue; the issue is with UAC being unable to protect itself when a less paranoid security level is used.
The thing is, malware running even with standard user privileges is plenty bad. It can still add itself to run at start-up (for that user), and can still read / write / delete data in any locations that user can access.
So the most important boundary is the Low IL -> Medium IL one, used by IE in Protected Mode and some other processes, which is still protected just as much as in Vista (or moreso) in this default state.
Last edited by Brandon Live on 31 Jan 2009 - 21:02
Ah, right, machine already compromised.
I can emulate keyboard inputs too! By breaking into a house and using the keyboard.
UAC is there to stop users owning their computer from running trojans. So the "machine already compromised" argument don't apply here; it's not there to protect from remote exploits, it's there to protect users from themselves.
The second paragraph was in general about the topic and billyea, sorry if I was unclear.
In Win7 you have less prompts because it's less safer than Vista.
Would the script be effective if the same UAC default setting is used, but secured desktop is enabled?
This is curious because changing such a critical security setting should ALWAYS prompt a UAC regardless of the current UAC setting. I will test this script out tomorrow and see what happens.
LMAO - Really? Microsoft? Really? Delirium ensues.
The best suggested workaround as posted is to force a Secure Desktop UAC dialog whenever the security level is being changed. Or better yet, if they have the ability to temporarily modify the UAC prompt level for a particular task (in this case, switching UAC levels) make the user enter their password for that dialog only.
When everything is prompted by UAC, people complain. When only a portion is prompted, people complain. Whatever MS does, there is always someone who tells you that they are an idiot. That's why the slider is there. Windows is trying to give you some respect and cut you some slack when it thinks you can take care of making sound decisions. Otherwise, why not crank it up back to Vista levels if you think you can't judge what programs are potentially harmful?
+1
That would be a mistake if you value performance.
I am running 7 on a testbed PIII with only 512MB of RAM and it works way better than Vista with 2 or 3X that.
I am running 7 on a testbed PIII with only 512MB of RAM and it works way better than Vista with 2 or 3X that.
As much as I love Win7, I could deal with sticking with Vista on both of my computers (E4500 and 2GB RAM, and a Q6600 8GB RAM). Is 7 faster? Yes. But Vista is already extremely fast.
On 7 you can up the slider to its max level and it'll be just as noisy as Vista. But of course, secure at the same time.
On 7 you can up the slider to its max level and it'll be just as noisy as Vista. But of course, secure at the same time.
So that means reducing slider level down means you are prone to attacks?
P.S. I'm talking about those "know all" fools.
Last edited by RealFduch on 30 Jan 2009 - 13:16
How's that for corking myself? LOL
How's that for corking myself? LOL
UAC in Vista was good. It worked like it should.
But because of dumbass ikspertz like you, Cork, MS cripped its default mode in Windows 7.
How's that for corking myself? LOL
It's funny, you're so monumentally thick that you forgot that Vista is not affected by this.
Hit the nail on the head there.
How's that for corking myself? LOL
How's that for corking myself? LOL
LOL! What *nix machines?
sudo rm -rf /home/cork1958
Oops... He has been erased from Neowin...
Oh? He's using OS X?
sudo rm -rf /Users/cork1958
Problem solved.
But because of dumbass ikspertz like you, Cork, MS cripped its default mode in Windows 7.
Couldn't say it any better.
With XP, I used to run as Limited User, and it was a pain to run all sorts of "Run As" CMD files. But with Windows Vista, I am able to skip my batch files and go straight to putting Administrator password thanks to UAC.
While i agree the default level could be higher\include Secure Desktop, This is a perfect example of how the user base shot themselves in the foot. You did not want security when given UAC in Vista, You just went ahead and disabled it. Now, When it does not ask you for permissions when doing system changes, You cry over settings being non-secured. You asked for it, Really, This is the price you pay for not having to put up with a UAC dialog every now and then when altering your system.
In the end, If you knew how to disable it then, You know how to crank it up now.
Has anyone tried using ZoneAlarm? Between ZoneAlarm and Vista UAC, I'd rather use Vista UAC!
Because a program isn't directly modifying settings. A program is indirectly modifying settings.
This vulnerability was known about back in the Vista days, and it's one of the reasons why Secure Desktop exists (so that an application emulating a keyboard can't confirm a UAC dialog).
Some people don't like to admit it, but Microsoft does listen to user feedback, and they listened to user feedback on this. Unfortunately.
This is getting ridiculous.
I told you many times. It WAS the same as in Linux/MacOSX. Even better sometimes.
If you want to try to sound credible then provide some differences at least.
It's "leading" because of licensing. LOL, do you honestly think ubiquity has anything to do with quality or reliability or positive user experience?
How the hell else could a niche company be moving the entire industry forward in terms of OS design and implementation, while grabbing chunks of the premium end of the market, while maintaining the kind of margins they do, afford to price themselves out of the bulk of the market (deliberately), and still walk away with the more than the lion's share of the proceeds?? And keep doing this year after year - and even (hopefully more than just this past quarter) in a lousy economy?
This niche computer company has been setting the bar in every single area for years now. Everything is compared to Apple products. The first thing people do is do an OS X comparison, or an iPhone/iPod comparison. "OS X-like" and 'Apple-like" are not just random phrases you happen to see a lot of. They're coveted titles. Synonymous with how competitors want their products to be. If imitation is flattery, Apple must be blushing about six shades of red.
That didn't just happen because the seas parted or because the sun and moon were aligned a certain way, LOL.
Last edited by LTD on 30 Jan 2009 - 14:36
Around here in Europe I don't see loads of iPhones or iPods being used.
As far as OS's go, I guess you've totally forgotten the shear mess and nightmare all those past MacOSs used to be eh? Made Win98 look like the best thing ever.
And OSX, yeah, because Apple couldn't come up with it's own good underlying code, might as well borrow it from Darwin eh? Sure helps your security overnight when you grab some unix code, but hardly innovative seeing how old that is.
And how great was OSX at first anyways? I sure don't remember it being that hot, and seeing even the Apple faithful moaning about it was something. But heck, only took how many updates later before it started working close to how it should have been? 3?
Sure it's nice business wise to be able to charge more for something when you have fanboys such as yourself willing to pay the "apple tax" for it.
I still think the OSX UI is silly, the Dock is a joke, and about the only real think users point out are expose and spaces, yay. You wouldn't need expose in the first place if you could manage and find your windows quick and easy from the get go. And as for spaces, wow, virtual desktops, any *nix user has had that years before you even new about OSX.
I remember uses them back in 96. Hardly new.
And what sites do you visit for reviews? I don't hear "OSX like" or "apple like" when I'm checking out hardware or software reviews all the time. Everyone compares Win7 to older Windows versions or Linux from what i've seen. The only people who keep bringing up OSX are the Apple fans who like to point out the new Win7 taskbar, like pinning is anything new to Windows either.
You can stop laughing now.
http://edge-op.org/iowa/www.iowaconsumerca...000/PX07278.pdf
Some quotes from M$:
"The bits we deliver in Sept 05 PDC must be compelling, even in beta form. UI must be hot. We will be directly compared
against tiger."
"In many ways Jobs took our WinFS and Avalon pitch word for word and delivered it. The
difference was he had more stable bits than we did."
"He says he is blown away by the WinFS clone functionality - it’s already working"
"Any idea how I can get my hands on the developer bits apple released at their conference
this week?"
They really look up to Apple
Quoting an ignorant person's ignorant statement isn't a good way to make a point, unless your point is that some people are ignorant.
Windows NT (including 2000/XP) has always had generally the same security model as Linux and the Mac. You can run as a standard user, and then you will have to enter admin credentials when performing an admin task.
You don't really think that running as an admin (which I believe is still the Mac OS default) is better on a Mac than on Windows, do you?
It's Mr. abcdefg to you
So Jim Allchin and Vic Gundotra are/were ignorant?
Is it that once you left M$ and jump to Google you become ignorant?
One more quote:
"I don’t believe we will have search this fast. We will have a developer message which
they don’t and won’t. But, they qot the 80% and they will receive wide credit for this." - Jim Allchin
Does it hurt?
So Jim Allchin and Vic Gundotra are/were ignorant?
Is it that once you left M$ and jump to Google you become ignorant?
One more quote:
"I don’t believe we will have search this fast. We will have a developer message which
they don’t and won’t. But, they qot the 80% and they will receive wide credit for this." - Jim Allchin
Does it hurt?
It always hurts when the leaner and meaner competition does it about 100 times better than you can, and then keeps publicizing it.
And not just Allchin and others from the past, but current MS insiders know this. If any one of them had the opportunity to take a lateral position at Apple, they'd jump ship faster than you can say Live Live Search. Or is it the new Live Windows Live Search? Or the New Windows Live MSN Hotmail? Or Mesh something . . .
Windows is a third-rate product. Just because most of the world uses it doesn't mean it's better. For example, IE still has a majority, but it's clearly a dirty piece of rubbish.
"I don’t believe we will have search this fast. We will have a developer message which
they don’t and won’t. But, they qot the 80% and they will receive wide credit for this." - Jim Allchin
Does it hurt?
No... that was before the reset. My team (WDS) are the reason that Vista ended up with faster search (post-reset).
Windows is a third-rate product. Just because most of the world uses it doesn't mean it's better. For example, IE still has a majority, but it's clearly a dirty piece of rubbish.
IE has it's problems, but IE8RC1 is working great here, so "piece of rubbish" I don't think so. Hell, let me toss that back at you, I think Safari is a piece of rubbish.
And Pioneered the use of USB and Firewire? Maybe firewire but I don't see that many Firewire devices being used or sold, not with USB2. And USB3 will soon make it pointless.
When did Apple start using USB anyways? Got a date for that? Cuz I still have my old Win95b CD with USB support from 96.
The laptops are also popular in Hollywood because Apple gives them away for free marketing/product placement and there are a lot of people around here who don't mind spending more money than they need to for something sexy, like the MacBook Pro.
You bought into niche/bandwagon marketing and paid too much for your gear and programs for what amounts to PC parts with limited functionality.
PS the iPhone does rule in design and OS/interface, but not in features. Though they are getting better.
A) you'd argue the exact opposite point if OS X had 95% market share and Windows was a popcorn fart in the big picture...
B) your ignorance is PROFOUND if you think the world runs on Windows because of "licensing". Windows runs the applications people USE in business, entertainment (professional and recreational), games, etc. etc. and the hardware people OWN.
Don't get me wrong, I think OS X is a very capable OS. But the world's most powerful and successful companies, as well as the VAST majority of professional content CREATORS (despite your Mac spin to the contrary), do their work and create the digital content of the world on PCs running Windows in one flavor or another.
And those people, like me, can afford to buy whatever hardware and software we want for our homes and our companies, no compromise, period.
"Licensing" NEVER enters into the equation.
And when somebody does give us a MacBook Pro as a gift*, we install Vista on it.
* Because if we want top of the line features and design, we buy a far better Sony for far less money.
How the hell else could a niche company be moving the entire industry forward in terms of OS design and implementation, while grabbing chunks of the premium end of the market, while maintaining the kind of margins they do, afford to price themselves out of the bulk of the market (deliberately), and still walk away with the more than the lion's share of the proceeds?? And keep doing this year after year - and even (hopefully more than just this past quarter) in a lousy economy?
This niche computer company has been setting the bar in every single area for years now. Everything is compared to Apple products. The first thing people do is do an OS X comparison, or an iPhone/iPod comparison. "OS X-like" and 'Apple-like" are not just random phrases you happen to see a lot of. They're coveted titles. Synonymous with how competitors want their products to be. If imitation is flattery, Apple must be blushing about six shades of red.
That didn't just happen because the seas parted or because the sun and moon were aligned a certain way, LOL.
In 32 years the best the niche company could do is 8% of the desktop market, a half-baked phone (technically) and a music player.
Windows powers 90% of the desktops in the world, as well as ATM's, mobile phones, power stations, game consoles, navy warships and PDA's.
Moving the entire industry forward? Please - maybe design agencies, students and upper working-class yuppies think they are "moving forwards" but I think you'll find that's about it.
In my eyes Apple is still pretty niche when after 32 years of head on work to topple Microsoft has resulted in a phone, a music player and 8% market share. (for desktops - let's not even go along the server route!)
Best you can say for Apple is nice GUI. Seriously though, that's it. Form over function is the stigma most people that work in IT professionally assign to all of Apple's products.
Why is MS arguing this
Last edited by yakumo on 30 Jan 2009 - 12:33
Makes sense to me.
Precisely. Those who know what's going on leave it enabled. They know that it'll probably save them at some point.
Those who think they know what's going on disable UAC, because they heard about it on $publication (ex. zdnet).
Wrong! Disabling UAC turned me into a SUPER1337PROFESSIONALPOWERUSER!!!!
Of course, I should start doing what you kiddies do - whining and insulting each other. I was making a living in IT before most of you were born.
Too damn bad Darwin's law has been invalidated by the self-sustaining infinite support mechanisms in place in society today.
We could do with a good bit of culling.
Too damn bad Darwin's law has been invalidated by the self-sustaining infinite support mechanisms in place in society today.
We could do with a good bit of culling.
Your an idiot. you are less secure with UAC Off.
Please, stop believing everything you read ...
Please, stop believing everything you read ...
It's actually not a big issue with corporations. User privledges are defined server side, and disabling UAC wouldn't enable malware to run at anything higher than it could with UAC enabled.
It had better not be. We're living in a different world now. The tech landscape looks quite different form a few years ago. MS can no longer take its position for granted.
Nothing is secure...if you want something that is totally secure, then dont use a computer.
I agree that the way it is in Vista is fine, that's how it's been in unix/linux since the start.
hit start, type uac, you get uac settings, put it up one notch and it becomes the same as Vista.
This article is entirely about a vulnerability that only exists when it's on the default level for an Administrator account.
And like I said there should only be one level, not two, not three, just one, if users want to cry about "too many prompts" then they can cry, at the end of the day it's about a more secure system.
Vista has basically done it the same way Linux, BSD and OS X has done it for years, yet you don't hear the *nix users bitching about it now do you?
The average Linux user and the average computer user are miles apart in comfortability with security permissions etc. That is something MS should try to educate the Average Joe Windows user about this time around.
The last time I've seen this huge amount of "ByDesignWontFix" is with.... Windows ME.
Win7 is good, much better than Vista, but I do get the feeling that it's being rushed out the door.
I just hope that the next build we will have (beta testers) will fix some of the many bugs that where reported.
The last time I've seen this huge amount of "ByDesignWontFix" is with.... Windows ME.
Win7 is good, much better than Vista, but I do get the feeling that it's being rushed out the door.
I just hope that the next build we will have (beta testers) will fix some of the many bugs that where reported.
People think its being rushed, but remember, Vista took 5 years to release!!!
Windows 7 is shaping up to be Microsoft's most impressive OS to date!
in the end its never the people/customer/publics fualt blame everyone else
MS can't win. It's not entirely their fault. These issues will continue to plague this company at the expense of the user.
The solution given is very simple: enable UAC and secured desktop whenever anyone or anything make changes to the UAC setting regardless of the current setting.
They can still keep the default setting (where users aren't pestered with UAC prompt for making changes with the security certificate scheme), but make UAC mandatory for any changes to the UAC setting.
I think you're confusing a beta operating system with a simple video card issue that a certain company can't seem to fix properly.
http://blogs.chron.com/techblog/archives/2...n.html#c1226188
...this is fixed...
Exactly what I have done.
But if it's shipped as-is with this behavior, then the majority of home users would never even think of turning the UAC a notch higher.
Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!
Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.