Big security hole punched in Windows 7

 

A prolific Aussie blogger is warning of a possible security hole in the latest beta version of Windows 7.

Researcher Long Zheng has posted both a description and a proof of concept for an issue which could allow an attacker to skirt the User Account Control (UAC) component in the new version of Windows.

UAC is designed to monitor a system and notify the user when a program attempts to alter the system.

Originally designed to help prevent malware infections, the software was disabled by many users and widely mocked for the barrage of dialog boxes it created in some systems.

To improve the software in Windows 7, Microsoft has set new guidelines for UAC which allow changes to Windows settings but require authorization to otherwise alter the system.

The problem, explains Zheng, is that UAC itself is controlled through system settings. This, argues the researcher, can allow an attacker to completely disable the protections without user notification.

"We soon realised the implications are even worse than originally thought," Zheng wrote.

"You could automate a restart after UAC has been changed, add a program to the user’s startup folder and because UAC is now off, run with full administrative privileges ready to wreak havoc."

The researcher notes that the issue can be easily fixed by changing the UAC setting to notify users when Windows settings are altered, and that Microsoft could remedy the problem by prompting the user when the UAC setting is altered.

However, Zheng alleges that Microsoft is dismissing the report, and that the problem may go unfixed.

"The reason I’m blogging about this flaw is not because of its security implications, it is blatantly simple to fix, but Microsoft’s apparent ignorance towards the matter on their official Windows 7 beta feedback channel by noting the issue as 'by design' and hinting it won’t be fixed in the retail version," the researcher wrote.

At the time of publication, Microsoft had yet to return a request for comment on the UAC security issue or Zheng's posting.

Copyright ©v3.co.uk


Big security hole punched in Windows 7
 
 
 
Top Stories
Australia's digital crescendo
Barely unpacked from his move from Amsterdam, Southern Cross Austereo's new digital boss Vijay Solanki is looking for Australia's untapped potential.
 
Turnbull nabs UK govt digital guru as DTO chief
Inaugural CEO to lead change agenda.
 
NBN to offer TV connections through fibre for greenfields
Ditching aerials to come at a cost.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Windows 10 drops 29 July... but only for some
Jul 6, 2015
If you've reserved your copy of Windows 10 and are keenly awaiting its 29 July release, don't ...
Xerocon is heading to Melbourne!
Jul 1, 2015
We're not saying Xero is our FAVOURITE or anything, but Xero's 2015 Xerocon conference is being ...
New Microsoft Office apps for Android phones
Jun 26, 2015
Microsoft's latest Office apps for Android now work on phones as well as tablets, further ...
Windows 10 UK price revealed, but don't believe everything you hear
Jun 26, 2015
Windows 10 £99 price tag for users in the UK (who presumably don't already have Win 7 Pro ...
Now Xero notifies iOS users of new transactions
Jun 24, 2015
The latest version of Xero's iPhone app includes notifications when new transactions arrive from ...
Latest Comments
Polls
Is site blocking effective in stopping piracy?


   |   View results
Yes
  2%
 
No
  86%
 
Somewhat
  12%
TOTAL VOTES: 786

Vote