Windows 7 UAC Flawed

UAC or User Access control force program execution to go through user permissions. This is one feature that was improved in Windows 7 to reduce the annoyance caused in windows Vista.
But now as per Sophos senior security engineer found that  User Account Control is flawed.

As expected, UAC prompts the user for permission before granting elevated privileges but was ineffective in stopping common samples of malware from running, in a Windows 7-based system without virus protection.

Whereas two of the ten chosen malware samples for the test would not run in Windows 7 without UAC turned on at all, only one sample W32/Autorun-ATK was controlled by UAC. The other seven ran as though they were being blocked only by a stack of dominoes.

On October 22nd, we settled in at SophosLabs and loaded a full release copy of Windows 7 on a clean machine. We configured it to follow the system defaults for User Account Control (UAC) and did not load any anti-virus software.

We grabbed the next 10 unique samples that arrived in the SophosLabs feed to see how well the newer, more secure version of Windows and UAC held up. Unfortunately, despite Microsoft’s claims, Windows 7 disappointed just like earlier versions of Windows. The good news is that, of the freshest 10 samples that arrived, 2 would not operate correctly under Windows 7.

The findings are, of course, not surprising, since the main problem with Windows 7’s UAC lies in the over-expectation of the average end user.

Just like end users, enterprises already migrating to Windows 7 face the same security issues. Eric Voskuil, CTO, BeyondTrust — the company that issued a report earlier this year, claiming that 92% of critical Microsoft vulnerabilities are mitigated by Least Privilege accounts:

In response to feedback that users were forced to respond to too many prompts in Windows Vista, the new operating system introduces a new approach to User Account Control (UAC), providing a four-position “slider” feature to control how often UAC pop-ups occur. While these changes to Windows 7’s UAC benefit the home user market, enterprises must recognize that the new slider feature can only be applied to users logged in as administrators and may increase security risks.

Further, Windows 7 introduces no new features to solve the application compatibility issues experienced by standard users in previous versions of the operating system. “The most secure configuration option for enterprises that deploy Windows 7 remains running end-users as standard users, with administrator rights removed,” said Eric Voskuil, CTO, BeyondTrust.

Is it a step in the right direction, or does it have the potential to provide a lot of users with a false feeling of security?

Subscribe to Twitter updates, or RSS, join Facebook for more Tech updates.