Big security hole punched in Windows 7

 

A prolific Aussie blogger is warning of a possible security hole in the latest beta version of Windows 7.

Researcher Long Zheng has posted both a description and a proof of concept for an issue which could allow an attacker to skirt the User Account Control (UAC) component in the new version of Windows.

UAC is designed to monitor a system and notify the user when a program attempts to alter the system.

Originally designed to help prevent malware infections, the software was disabled by many users and widely mocked for the barrage of dialog boxes it created in some systems.

To improve the software in Windows 7, Microsoft has set new guidelines for UAC which allow changes to Windows settings but require authorization to otherwise alter the system.

The problem, explains Zheng, is that UAC itself is controlled through system settings. This, argues the researcher, can allow an attacker to completely disable the protections without user notification.

"We soon realised the implications are even worse than originally thought," Zheng wrote.

"You could automate a restart after UAC has been changed, add a program to the user’s startup folder and because UAC is now off, run with full administrative privileges ready to wreak havoc."

The researcher notes that the issue can be easily fixed by changing the UAC setting to notify users when Windows settings are altered, and that Microsoft could remedy the problem by prompting the user when the UAC setting is altered.

However, Zheng alleges that Microsoft is dismissing the report, and that the problem may go unfixed.

"The reason I’m blogging about this flaw is not because of its security implications, it is blatantly simple to fix, but Microsoft’s apparent ignorance towards the matter on their official Windows 7 beta feedback channel by noting the issue as 'by design' and hinting it won’t be fixed in the retail version," the researcher wrote.

At the time of publication, Microsoft had yet to return a request for comment on the UAC security issue or Zheng's posting.

Copyright ©v3.co.uk


Big security hole punched in Windows 7
 
 
 
Top Stories
The True Cost of BYOD - 2014 survey
Twelve months on from our first study, is BYOD a better proposition?
 
Photos: Unboxing the Magnus supercomputer
Pawsey's biggest beast slots into place.
 
ANZ looks to life beyond the transaction
If digital disruptors think an online payments startup could rock the big four, they’ve missed the point of why people use banks, says Patrick Maes.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Pass on carbon tax savings, warns ACCC
Jul 24, 2014
The ACCC is warning businesses that supply "regulated goods" to pass on any cost savings ...
Have customers that won't pay debts?
Jul 10, 2014
The ACCC and ASIC have updated their advice when it comes to collecting debts.
Carpet cleaner faces court over online testimonials
Jul 4, 2014
The ACCC has initiated proceedings against A Whistle (1979) Pty Ltd, the franchisor of Electrodry...
You can now get 15GB of free online storage using Microsoft OneDrive
Jun 25, 2014
Cloud storage has reached both the capacity and price where it's a viable alternative to local ...
Another clever trick you can perform with Xero
Jun 25, 2014
Here is another way to reach out to particular subsets of your customers using Xero.
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  29%
 
Application integration concerns
  3%
 
Security and compliance concerns
  27%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  22%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  4%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 1125

Vote