"Very Severe Hole" In Vista UAC Design

Posted by kdawson on Tuesday February 13, 2007 @09:07AM from the she-said-he-said dept.

Cuts and bruises writes "Hacker Joanna Rutkowska has flagged a "very severe hole" in the design of Windows Vista's User Account Controls (UAC) feature. The issue is that Vista automatically assumes that all setup programs (application installers) should be run with administrator privileges — and gives the user no option to let them run without elevated privileges. This means that a freeware Tetris installer would be allowed to load kernel drivers. Microsoft's Mark Russinovich acknowledges the risk factor but says it was a 'design choice' to balance security with ease of use."

1 of 813 comments (clear)

Min score:

Reason:

Sort:

Apple was right.. by HockeyPuck · 2007-02-13 09:14 · Score: 1, Redundant

Normally I don't give any credit to marketing droids... but Apple's "Security" switcher ad is right on target:

http://images.apple.com/movies/us/apple/getamac/ap ple-getamac-security_480x376.mov