A security researcher is warning of a possible security hole in the latest
beta version of Windows 7.
Long Zheng has posted a
description
and a proof-of-concept for a problem which could allow an attacker to skirt
the User Account Control (UAC) component in the new version of Microsoft's
operating system.
Advertisement
UAC is designed to monitor a computer and notify the user when a program
attempts to alter the system. Originally designed to help prevent malware
infections, the software was disabled by many users and
widely
mocked for the barrage of dialogue boxes it created in some systems.
To improve the software in Windows 7, Microsoft has set new guidelines for
UAC which allow changes to Windows settings, but require authorisation to
otherwise alter the system.
Zheng explained that the problem is that UAC itself is controlled through
system settings. This can allow an attacker to completely disable the
protections without user notification, according to the researcher.
"We soon realised that the implications are even worse than originally
thought," Zheng wrote. "You could automate a restart after UAC has been changed,
add a program to the user's startup folder and, because UAC is now off, run with
full administrative privileges ready to wreak havoc."
The researcher noted that the issue can be easily fixed by changing the UAC
setting to notify users when Windows settings are altered, and that Microsoft
could remedy the problem by prompting the user when the UAC setting is altered.
However, Zhang claims that Microsoft is dismissing the report, and that the
problem may go unfixed.
"The reason I'm blogging about this flaw is not because of its security
implications - it is blatantly simple to fix - but [because of] Microsoft's
apparent ignorance towards the matter on their official Windows 7 beta feedback
channel by noting the issue as 'by design' and hinting that it won't be fixed in
the retail version," the researcher wrote.
At the time of publication, Microsoft had yet to return a request for comment
on the UAC security issue or Zheng's posting.
Do you agree?
Have your say on this article