News

Microsoft Plans To Fix UAC Security in Windows 7 RC

• By Jabulani Leffall
• February 5, 2009

A debate erupted this week over the effectiveness of the user account control (UAC) feature in Microsoft's newly released Windows 7 Beta operating system. Critics claimed that changes to the UAC in the OS resulted in security vulnerabilities.

Early in the week, independent researchers Rafael Rivera and Long Zheng described an exploit that could turn off the UAC prompt, which typically notifies the user of changes about to be made to the computer. The two created a proof-of-concept VBScript that they claimed can "disable" the UAC, opening the way for malware to install itself on a Windows 7-based PC.

Microsoft officials countered that the security notification system in Windows 7 Beta works just fine by design. However, late on Thursday, the company went further, and described two planned changes to the UAC in response to user feedback. Those changes will be seen in the upcoming Release Candidate (RC) version of Windows 7, explained Microsoft executives Jon DeVaan and Steven Sinofsky in the "Engineering Windows 7" blog.

"First, the UAC control panel will run in a high integrity process, which requires elevation," DeVaan and Sinofsky wrote. "That was already in the works before this discussion and doing this prevents all the mechanics around SendKeys and the like from working. Second, changing the level of the UAC will also prompt for confirmation."

Apparently, by prompting the user about any change to the UAC level, that will address the potential exploit.

"The feedback is that UAC is special, because it can be used to disable silently future warnings if that change is not elevated and so to change the UAC setting an elevation will be required," DeVaan and Sinofsky explained.

DeVaan is Microsoft's senior vice president of the Windows Core Operating System Division. Sinofsky is senior vice president of the Windows and Windows Live Engineering Group.

The UAC debate first got fired up with the release of Windows Vista, which introduced the new security feature. Users complained that Vista's UAC was pushing too many prompts at them.

Roger Halbheer, Microsoft's chief security advisor for Europe the Middle East and Africa, explained in a blog that Redmond heard users' Vista complaints "loud and clear." He added that the way that the UAC now works in the Windows 7 Beta does not constitute a vulnerability.

"We can debate now, when we should generally show a UAC prompt but this is a completely different debate than to claim this being vulnerability," Halbheer wrote. He cautioned critics to "think about all the Windows Vista discussions."

In an earlier post, DeVaan also denied that the UAC's behavior in Windows 7 Beta represented a vulnerability.

"We know that the recent feedback does not represent a security vulnerability because malicious software would already need to be running on the system," DeVaan wrote in an extended discussion of the UAC. He added that "we know that UAC is not 100% effective at stopping malware once it is running."

The security pros I spoke with this week likely had not heard of Microsoft's proposed RC changes to the UAC in Windows 7. However, they did agree that when it comes to security, someone will always be disappointed.

"When Windows Vista was released, many people were very upset about the level of notifications UAC presented to end users," said Jason Miller, security and data team manager at Shavlik Technologies. "Microsoft was bombarded by complaints that UAC was set at a level that presented continuous notifications to users. By changing the way they notify changes to the system, they are listening to their customers."

Windows 7 Beta includes a slider control for the UAC that adjusts the frequency of security prompts to the user.

Miller said he doesn't see the emergence of these latest proofs-of-concept exploits as something that will give Microsoft a black eye with Windows 7. He added that the previous "losing streaks for Windows, specifically in Vista, was application stability, nonexistent drivers and other usability issues."

Randy Abrams, director of technical education at ESET, suggested that the release of the UAC, based on the failed Office 97 Macro protection scheme in which the user enables or disables macros, was a losing proposition from the start.

"The fundamental flaw in the design is that it puts the average user in a position to make a decision they are not qualified to make," he said. "Of course users complain about a barrage of questions they don't know the answers to."

Many security experts, including Abrams, have suggested that even for advanced users, the UAC often provides too little information to make an informed decision. Possibly, Microsoft might consider that limitation when it rolls out the release candidate version of Windows 7.

Abrams didn't think that Microsoft was exactly letting its guard down with Windows 7.

"I wouldn't say that Microsoft has gotten lazy with security," Abrams added. "I would say that complaints from users about the pain of security are causing Microsoft to require less security."