Big security hole punched in Windows 7

 

A prolific Aussie blogger is warning of a possible security hole in the latest beta version of Windows 7.

Researcher Long Zheng has posted both a description and a proof of concept for an issue which could allow an attacker to skirt the User Account Control (UAC) component in the new version of Windows.

UAC is designed to monitor a system and notify the user when a program attempts to alter the system.

Originally designed to help prevent malware infections, the software was disabled by many users and widely mocked for the barrage of dialog boxes it created in some systems.

To improve the software in Windows 7, Microsoft has set new guidelines for UAC which allow changes to Windows settings but require authorization to otherwise alter the system.

The problem, explains Zheng, is that UAC itself is controlled through system settings. This, argues the researcher, can allow an attacker to completely disable the protections without user notification.

"We soon realised the implications are even worse than originally thought," Zheng wrote.

"You could automate a restart after UAC has been changed, add a program to the user’s startup folder and because UAC is now off, run with full administrative privileges ready to wreak havoc."

The researcher notes that the issue can be easily fixed by changing the UAC setting to notify users when Windows settings are altered, and that Microsoft could remedy the problem by prompting the user when the UAC setting is altered.

However, Zheng alleges that Microsoft is dismissing the report, and that the problem may go unfixed.

"The reason I’m blogging about this flaw is not because of its security implications, it is blatantly simple to fix, but Microsoft’s apparent ignorance towards the matter on their official Windows 7 beta feedback channel by noting the issue as 'by design' and hinting it won’t be fixed in the retail version," the researcher wrote.

At the time of publication, Microsoft had yet to return a request for comment on the UAC security issue or Zheng's posting.

Copyright ©v3.co.uk


Big security hole punched in Windows 7
 
 
 
Top Stories
Photos: iTnews Benchmark Awards countdown begins
Just a few days left until entries close for 2014.
 
Australian Govt to rethink cyber security strategy
Six-year old policy to be refreshed.
 
The failure of the antivirus industry
[Blog post] Insights from AVAR 2014.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
More 4G from Optus in Darwin
Nov 21, 2014
Click to see where Optus has expanded coverage to the suburbs near Darwin.
Optus steps up regional 4G coverage
Nov 20, 2014
Once 700Mhz services are working, Optus claims regional users will have a "faster and more ...
This Huawei 4G phone costs $99
Nov 12, 2014
The $99 Huawei Ascend Y550, available through Vodafone, enters the budget market as one of the ...
4G smartphones: Microsoft's Lumia 830
Nov 7, 2014
Microsoft has announced its flagship Windows Phone, the Nokia Lumia 830 4G, will be available in ...
Do you direct debit customers? Read this
Oct 10, 2014
Authorities have been targeting direct debit practices with iiNet and Dodo receiving formal ...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  38%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  8%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  5%
TOTAL VOTES: 1064

Vote