Security Hole In Windows 7 UAC

An anonymous reader writes "A prolific blogger is warning of a possible security hole in the latest beta version of Windows 7. Long Zheng has posted both a description and a proof of concept for an issue that could allow an attacker to skirt the User Account Control component in the new version of Windows. The problem, explains Zheng, is that UAC itself is controlled through system settings. This can allow an attacker to completely disable the protections without user notification. Zheng notes that the issue can be easily fixed by changing the UAC setting to notify users when Windows settings are altered, and that Microsoft could remedy the problem by prompting the user when the UAC setting is altered."

Comments

Short: Don't work as Administrator

[Anonymous Coward]

This was discussed elsewhere (heise.de) earlier...

Short answer: this only works iff you are logged in as Administrator already...

Prompting the user when this setting is altered is quite worthless - if I have a script on my computer that can simulate keypresses and mouse clicks *nothing* will hinder it to click on "I've read the warning". Even adding captchas/moving the warning around/whatever will only be a fake-solution that will only work 'till there's a better script.

Re:Short: Don't work as Administrator

[nstlgc]

Saying that you shouldn't be running as administrator is stupid; UAC's purpose was to make it safe to use administrator accounts.

Uh no. UAC's purpose is to make it possible (in practice) not to use administrator accounts. Pretty much the complete opposite.

Re:Short: Don't work as Administrator

[Darkon]

Anyway, Administrator accounts are the default and therefore what 99% of users are going to be using.

And only when Microsoft change this will Windows be half way towards being secure.

Re:Short: Don't work as Administrator

[drsmithy]

Prompting the user when this setting is altered is quite worthless - if I have a script on my computer that can simulate keypresses and mouse clicks *nothing* will hinder it to click on "I've read the warning".

You mean apart from the inability of your script to interact with the separate Desktop that UAC prompts occur on ?

Re:Short: Don't work as Administrator

[Kjella]

The real problem, and one that doesn't have a good techincal or sociological fix, is that most windows users are doing administration duties that far exceed their skills. Users get confronted with all sorts of dialogs they don't understand but just want to get on with it. I bet you, that if you popped up a page to someone saying "This video needs a newer version of flash" and redirected them to some completely bogus page that gave them a plugin with a completely bogus signature most people would go ahead and install it anyway. What is the latest version anyway? Couldn't even remember who makes it, and those companies keep on merging and rebranding and whatnot. No amount of UAC, or running as an unprivilidged user could possibly fix that because they are the ones with the admin keys and they're handing them out too easily.

Most users don't understand trust, they want to see a nice little lock icon telling them this site is safe, this site is bad. Same goes for plugins. Same goes for software. If you try educating them they'll just go blank *bad thing* *bad thing* *REALLY bad thing* but they won't understand and just want the simple answer. There's some very professional looking sites out there that appear to give you good software. They often even look better than the real deal because the frauds are all about appearances while the real sites focus on delivering good software, no offence intended. While it does amount to some degree of security scissors, most users would be better of if they only downloaded from safe, verified sources of software and plugins. If only Linux would stop asking all the other technical questions, the repository model would be much better for these people. It's not the end-all and be-all of security but it concentrates 99% of the superuser tasks in one place and makes it that much harder for some random application to throw up a superuser prompt.

Re:Short: Don't work as Administrator

[rhsanborn]

Something they've been trained to do as a result of shortcuts and hacks used by applications written for Windows for years. I'm reasonably sure a check book balancing application shouldn't need administrator privileges to run, but so many applications are written that way, probably a little because it's easier, and a little because so many people use administrator accounts that it doesn't matter.

Microsoft is in a tough position with regards to this. A large portion of the annoyance with Vista was 1) compatibility, which stemmed from bad time frames and poor vendor interaction, admitted, but also from enforcing proper security and structure that they hadn't done, that broke poorly written code. 2) from UAC going off very frequently due to applications constantly trying to elevate their privileges which is in most cases unnecessary.

Re:Short: Don't work as Administrator

[denis-The-menace]

Easier said than done.
Many developers are lazy and create apps that only work if the USER is an administrator. Other times it will only work if the user that installed the app is the USER (Again, need administrator to install it in the first place!).

BTW: Fixing this is my bread and butter.

How hard is it to copy something...

[51M02]

correctly.

I mean, Linux and MacOSX (and others) have sudo for years, the original code dating back to 1980 according to Wikipedia.

The concept is not new : type your password to gain access to some privileges. That way bots and virus can't do everything while you can still administrative tasks easily.

My question is how hard is it to copy some 25 years old functionality (marketing it as brand new) and still don't get it right.

It's a double-edged sword

[jimicus]

With Vista, there's no (official, at least) way to disable UAC except by a user actively going to Control Panel and disabling it.

This breaks a lot of things - particularly a lot of stuff concerning scripted/automated installers.

The obvious solution to this is to provide a way for a script to disable and enable UAC. But as soon as you do that, a lot of the protection offered by UAC disappears.

Re:It's a double-edged sword

[yakumo.unr]

The obvious solution to this is to provide a way for a script to disable and enable UAC. But as soon as you do that, ALL of the protection offered by UAC disappears.

Fixed.

Re:Microsoft already replied

[Jurily]

That's the problem with UAC. Too many prompts and users will just get frustrated and either disable it or blindly hit Ok.

I disagree. I used Vista exclusively for 5 months, and I only ever got a UAC question when I was trying to change some system settings, and that one time when I didn't, it turned out to be a trojan.

It's not that hard to anticipate a UAC question, really. Just ask yourself: "Would Linux require root for this?"
Actually, UAC is much more permissive.

And the people who get frustrated with it, shouldn't have admin rights in the first place.
Sure, the initial setup and configuration is packed with these, but it's worth it.

Security in UAC

[SeaFox]

The biggest security hole in Windows 7's UAC is the user.

Re:Microsoft already replied

[Anonymous Coward]

they should really make the user account non admin by default, and fuck up all programs written by twelve years old kids each assuming to be the god of the machine. I did tried to use a non admin account, but almost no game worked correctly, even most of the non Microsoft applications tried to write garbage everywhere in the system; no really, the log file in the program folder or windows directory, the savegame in a profile stored beneath the installation directory....

"A prolific blogger ..."

[timmarhy]

people if that's not a big big warning sign i don't know what is. you know what this guy has discovered? if you login as administrator, attackers can do the same things you can.

This is no different to me browsing the web as root in linux and running any shit that pops up

Re:Microsoft already replied

[mwlewis]

Isn't that exactly what you quoted? If it's possible for malware to do this on your machine, then somehow it's already gotten past UAC, whether by some other hole, or by the user allowing it. What, exactly, do you suppose UAC is supposed to do in that case?

Re:Microsoft already replied

[MrNaz]

There is no way to properly prevent further attacks once a box is compromised. That's the nature of being compromised.

Re:Microsoft already replied

[macs4all]

"There's no good reason for writing there,"

Says who? Why is it wrong to keep configuration files, which are changed very infrequently, in with the program? And if you feel that strongly, why not actually stop me writing there instead of mapping it somewhere else without telling me? At the moment, if I alter a file for (say) a service, I get no warning and no indication of anything other than a successful write to the file, but whichever account the service runs as sees something different. Unacceptable behaviour.

Um, isn't that exactly what happens in OS X with Preferences?

In OS X (and *NIX???), USER preferences are stored in the USER's "Home" directory. That way, permissions to write the "Applications" directory can be more tightly controlled, AND the USER can be granted permission to write in a relatively safe place (safe "system-wise", that is).

Far be it for me to laud anything MacroSuck does; but, to me, this "symlink" just appears to be MS's attempt to provide a modicum of security for system and application files, while not breaking backward compatibility for every-single-bullshit-written-app that required Admin privileges just because the DEVELOPER was TOO LAZY to put USER settings in the PER USER "Documents and Settings" Directory(ies), and instead wanted to spray files all over the SYSTEM and APPLICATION directories (which are NOT USER-SPECIFIC, of course). And before you cite the meme that "Windows Vista7 doesn't care about backward compatibility.", keep in mind just HOW stupid and suicidal such a move would be for MS if it were TRULY the case...

With OS X's Package approach, you get the best of both worlds: Dependencies are grouped together for easy maintenance, copying, and REMOVAL; but things like Preferences are not only PER USER, but they are in a place that can be written WITHOUT FEAR OF SYSTEM COMPROMISE!!!

Sheesh! Is it REALLY so hard???

Re:Microsoft already replied

[Foolhardy]

The preference files in the Windows user directories are hidden in arcane locations.

It took me 5 seconds to google some docs for user profile paths: User Data and Settings Management

Makes sense that the Outlook data would be in C:\Documents and Settings\\Program Data\Microsoft\Outlook but it's not.

Instead, the roaming stuff goes into:
C:\Documents and Settings\USERNAME\Application Data\Microsoft\Outlook
And the non-roaming stuff goes into
C:\Documents and Settings\USERNAME\Local Settings\Application Data\Microsoft\Outlook
Doesn't seem so awful.

The only way to ehfin find it is to back the stuff up! What if the computer crashed and I can't RUN outlook???? I'm hosed (this actually happened)

Copy the user profile over?