Comments on: Malware can turn off UAC in Windows 7; “By design” says Microsoft

By: Sonic

Sonic — Wed, 31 Dec 1969 18:00:00 +0000

Looks like this issue has been fixed in Windows 7 RTM. I’m running Windows 7 Home Premium since October 22, 2009.

By: Somebody

Somebody — Wed, 31 Dec 1969 18:00:00 +0000

seems like UIPI prevents the sendkeys, or other equivalents

By: Somebody

Somebody — Wed, 31 Dec 1969 18:00:00 +0000

The UAC Settings page does not accept the sendkeys input

By: matt’s blog » Blog Archive » Windows 7 UAC — Door is Wide Open

Wed, 31 Dec 1969 18:00:00 +0000

[...] some folks did just that. They created a simple VB script to stand in place of the user and “press” the right [...]

By: Филипп Смирнов

Филипп Смирнов — Wed, 31 Dec 1969 18:00:00 +0000

{Читаю {ваш|этот|} блог, и понимаю, что {ничего|нифига} не понимаю. Все так запутано. :)

By: At least 62 gaping security holes in Windows 7 Release Candidate « Reformed Musings

Wed, 31 Dec 1969 18:00:00 +0000

[...] According to Rafael at Within Windows, Microsoft claims that all this is by design. Rafael makes the same recommendation as Leo: [...]

By: Karun AB » Windows 7: A second look

Karun AB » Windows 7: A second look — Wed, 31 Dec 1969 18:00:00 +0000

[...] were raised by certain tech users made popular by Long Zheng and Rafael Rivera in posts such as Malware can turn off UAC in Windows 7; “By design” says Microsoft. Clearly, Microsoft needs to move back to Secure Desktop for changes to UAC. We don’t mind UAC [...]

By: Черноморец

Черноморец — Wed, 31 Dec 1969 18:00:00 +0000

Извините, как можно добавить свой материал на сайт?

By: Darryl

Darryl — Wed, 31 Dec 1969 18:00:00 +0000

I recall Mark Minasi commenting that if compatibility is 9-o-clock and security is 3-o-clock, MS set it to about 10-o-clock with Vista’s UAC and integrity levels and so on. Me? I’d have slammed that sucker all the way over to 2-o-clock as a minimum!

It isn’t that it’s annoying or any kind of a problem after you do initial setup and it’s much better than using XP with Limited User Access, though I implemented that enterprise-wide a few years back. Even then (with XP) I never reinstalled anything from scratch but used a fully-configured image backup if I had to flatten the machine and rebuild it.

The real issue is “drive-by” web sites…a few times, not often in the last 2.5 years I’ve been running Vista, but a few times I’ve been Googling things and researching and…Whoa!…what’s this? A UAC prompt? Deny!!! Normally I ‘right-click’ on multiple topics in my Google searches and select ‘Open in New Tab’ before I start reading on topic.

Best illustration I’ve heard for UAC I’ve heard: when you’re done with your car, you have to take the key-fob and press the lock button…the car doesn’t ‘just know’ that you’re done with it when you get out and walk away. Similarly, you have to press the unlock button because the car also doesn’t ‘just know’ that you are the right person to allow to drive it/get inside it.

I welcome UAC and wish they’d made secure ’stiffer’ – even as an option. When I upgrade to Windows 7 I will most definitely set UAC to behave as in Vista. If I can’t do that…I won’t change.

By: Personal Blog — John Keyes – Linkeyes 1st February 2009

Personal Blog — John Keyes – Linkeyes 1st February 2009 — Wed, 31 Dec 1969 18:00:00 +0000

[...] up as a mirror when the display is off. Loads of people hate Vista’s UAC, but in Windows 7 UAC can be turned off by malware and it’s ‘by-design’! An amazing story by Jeffrey Zeldman on his family roots. One of the worst escape attempts ever? [...]

By: Malware puede modificar la UAC « Windows 7 Blog

Malware puede modificar la UAC « Windows 7 Blog — Wed, 31 Dec 1969 18:00:00 +0000

[...] http://www.withinwindows.com/2009/01/30/malware-can-turn-off-uac-in-windows-7-by-design-says-microso... Escrito en Bug, Microsoft, UAC, Windowss 7 [...]

By: Microsoft comenta mudanças presentes no Windows 7 RC « Live DeskMod’s

Microsoft comenta mudanças presentes no Windows 7 RC « Live DeskMod’s — Wed, 31 Dec 1969 18:00:00 +0000

[...] Só que nem tudo são rosas, e tem muito beta tester oficial irritado com o tratamento que a Microsoft está dando ao programa. A principal queixa é em relação à pouca informação que Redmond libera acerca do que está sendo feito no novo Windows. Ao invés de ser uma via de duas mãos, o programa beta está parecendo uma de mão única, na qual apenas os beta testers relatam bugs e problemas, mas não recebem respostas claras sobre o que a Microsoft pretende fazer ou fez em relação a eles. O caso-símbolo dessa celeuma é, sem dúvida, o imbróglio em que se envolveram Long Zheng e Rafael Rivera, por conta de uma falha no UAC. [...]

By: Cliven

Cliven — Wed, 31 Dec 1969 18:00:00 +0000

The UAC is great for the fact that it prevents idiots from doing bad things to their machines, but it delays far too many normal operations, and a scale-back for those of use who know how to manage our systems is welcome, in my book. I don’t need to be hand-held through my job, especially when it costs me time and causes me aggravation. That modifying the UAC does not *itself* prompt you is a very, very bad idea, however: this security chasm should be reviewed and revised.

Forcing users to remember the Admin acct user pw but making the default acct be of limited access might go a long way towards fixing the root cause of the need for the UAC, but users would doubtless lock themselves out en masse. Sigh.

@ MagicAndre1981

I’m not sure what you are using for comparison, but I have observed that Vista boxes tend to stutter and hang until I shut off nearly every one of the OS’s shiny new features, even when the units have 4G of RAM. I have been told that Vista 32 is faster than Vista 64, which makes sense, but the pretty much uniformly lower speed on Vista boxes I have observed, compared to XP boxes with far older/lower capacity hardware , is striking.

@ Israel Lopez

That the UAC prompts repeatedly without offering an “do not prompt again” checkbox is, as Dutch said, an annoyance. No amount of rationalization is going to change the fact that an Admin user should not have to “plant the flag” repeatedly for the same app. Period. Try working in a production environment where you are constantly making system changes and having to deal with the UAC repeatedly: it sucks. Mac OS has this repetitive prompt (with a password requirement and *occasional* case-sensitivity on the *user name*, to boot!) and it is one of the many reasons that I will not buy a Mac, despite having been an Apple Certified Desktop Technician.

By: Microsoft comenta mudanças presentes no Windows 7 RC — WinAjuda — Diga adeus à sua tecla F1

Wed, 31 Dec 1969 18:00:00 +0000

By: Sacrificing security for usability: UAC security flaw in Windows 7 beta (with proof of concept code) | Window7s

Wed, 31 Dec 1969 18:00:00 +0000

[...] be just as easy in C++ EXE) to do that – emulate a few keyboard inputs – without prompting UAC. You can download and try it out for yourself here, but bear in mind it actually does disable [...]

By: Sacrificing security for usability: UAC security flaw in Windows 7 beta (with proof of concept code) « Window7s

Wed, 31 Dec 1969 18:00:00 +0000

By: Daniel.Jozsef

Daniel.Jozsef — Wed, 31 Dec 1969 18:00:00 +0000

Now-now, what’s this talk about “less secure”?!
If we’re talking about security as a trait inherent to the OS, the UAC has nothing to do with it. Security in this case depends on how easy it is to defeat policies set by the administrator, like steal or damage data from a restricted account or without access to an account whatsoever. Administrator is absolute. That’s the way it was through all the years of multi-user computing.
If Microsoft wants to help the world of computing by reducing the “human factor”, I think a two-login model for new installations would be far more appropriate: az administrator user for installing software and changing system-wide settings, and a RESTRICTED user for everything else – work, surfing the web, games, etc.
That’s the way I’m using my Windows XP account, without any antivirus software, and yet I haven’t had ANY malware or virus problems, EVER.

By: Israel Lopez

Israel Lopez — Wed, 31 Dec 1969 18:00:00 +0000

Dutch, the problem is if you authorize something once, the next time maybe it could be adware or malware trying to get something done, so since there is the possibility you authorized something once, but in an hour from now someone else might be on your computer or malware might be trying to install, you have to confirm once again.

I think the easy fix is for Microsoft to request Admin rights ALWAYS, even if you have UAC turned off, in order to change the UAC security level and settings. As long as the highest security mode does not ask you to confirm things twice like Vista did sometimes, it is all fine. Windows Vista’s UAC didn’t annoy me much, what annoyed me was having to click first on one pop up and then another one to confirm… Seven doesn’t have this duplicate popup issue. All they need is to lock UAC settings from being modified always.

By: Tobbis Blog » UAC unter Windows 7 deaktivieren

Tobbis Blog » UAC unter Windows 7 deaktivieren — Wed, 31 Dec 1969 18:00:00 +0000

[...] eben jenem System durch Sicherheitslücken eher negativ aufgefallen. Demonstriert von Rafael Rivera und Long Zheng in einem Proof-Of-Concept. Microsoft will sich der Sache annehmen und verspricht, [...]

By: Microsoft soluciona el problema de seguridad del UAC en Windows 7 « Miguelthepooh’s Blog

Wed, 31 Dec 1969 18:00:00 +0000

[...] Con el tiempo, Microsoft empieza a dar señas cada vez más claras de que “ya no son los mismos de antes”. Dentro de esas señas esta el escuchar el feedback de los usuarios y actuar diligentemente frente a vulnerabilidades de seguridad. Decimos esto porque, después de Redmond afirmara que aquella grave vulnerabilidad del UAC de Windows 7 no iba a ser reparada porque era algo hecho así a propósito, han dado un paso atrás para anunciar que el problema ha sido solucionado en la Release Candidate de Win7 (respondiendo a la petición/denuncia de Long Zheng y Rafael Rivera). [...]

By: Dutch

Dutch — Wed, 31 Dec 1969 18:00:00 +0000

Often the cure is worse than the disease.

I have turned UAC off mainly because it continued to ask permission for same action I was repeating over and over, as an Admin, during configuration and installation of software within the same login session. In addition, some processes running through DCOM using a “secure” non-interactive user were not working if I had UAC on. I do admit that a different software design -based on what XP’s security permitted, over which I have obviously no control- and some extra configuration on Vista would have helped the latter, it was the constant UAC prompts that finally made me decide to turn it off.

If UAC does protect my computer (according to MS it does) why should it continue to bother me (Administrator, not a user with Admin priviliges) on the same issue over and over again. If it was a ‘Allow’ the first time why wouldn’t it be a ‘Cancel’ next time. Maybe a checkbox with “Don’t ask me again” would have solved the problem with very little effort. The actual solution in W7 looks more an overshoot to me.

By: Windows 7: die neue Benutzerkontensteuerung | Windows Vista Blog

Windows 7: die neue Benutzerkontensteuerung | Windows Vista Blog — Wed, 31 Dec 1969 18:00:00 +0000

[...] jüngster Zeit ist die Benutzerkontosteuerung von Windows 7 (Beta) auch wieder in die Kritik geraten. Diesmal aber nicht auf Grund des Nervfaktors, sondern weil diese in der [...]

By: Security Summary: 09-02-2009 | ContraRISK

Security Summary: 09-02-2009 | ContraRISK — Wed, 31 Dec 1969 18:00:00 +0000

[...] of Microsoft’s forthcoming OS, Windows 7, has a User Account Control (UAC) system that can be thwarted with a simple script, claims developer Rafael Rivera. But Microsoft insists this isn’t actually a problem because [...]

By: Criminosos usam falsa multa em parabrisas para disseminar vírus « Agência Vibe

Wed, 31 Dec 1969 18:00:00 +0000

[...] do Wndows”, no entanto, inclui o próprio UAC. Com isso, o programador Rafael Rivera conseguiu criar um pequeno programa capaz de desativar totalmente a função de segurança sem que o usuário seja [...]

By: 4sysops - Windows 7 UAC vulnerabilities

4sysops - Windows 7 UAC vulnerabilities — Wed, 31 Dec 1969 18:00:00 +0000

[...] party software is able to disable UAC without giving UAC the chance to prompt the user for consent. Rafael Rivera wrote a proof-of-concept VBscript program that demonstrates how malware could disable UAC. [...]