The User Account Control feature in Microsoft Windows 7 is irking some in the security community who say Microsoft may have traded security for usability.
Concerns about the User Account Control feature in Microsoft
Windows 7 have resurfaced.
UAC first appeared in Windows Vista as a way to bolster
Windows security by limiting standard user privileges until an administrator
authorizes a privilege level increase. In
Microsoft adjusted the feature to provide the user with four
choices for the UAC prompt and set the default setting to notify the user when
programs are attempting to change settings.
changes to UAC
have set off red flags for some. In response to complaints
about usability, Microsoft changed the feature to reduce the number of
notifications for common activities, such as installing applications from
Internet Explorer, explained Paul Cooke, director of Windows Client Enterprise
Security at Microsoft.
"We have also made it easier for administrators to look
at specific Windows settings on the system without needing administrative
privileges by refactoring many of our control panel applications to separate
interfaces for viewing system settings from those that modify them," he
But Ray Dickenson, CTO of
Authentium, blogged those changes have
come with a security cost.
"My personal observation as a user is that Windows 7 is
much more pleasant to use than Vista ... However, as is nearly always the case,
increasing operating system usability also increases security risks-risks of
infection and compromise of data and functionality," Dickenson blogged. "The
changes to Windows 7 UAC have made it easy for malware writers to turn UAC off
entirely without the user's knowledge. Microsoft recommends keeping UAC turned
on and yet allows malware to turn it off without the user's knowledge."
Earlier in 2009, Windows bloggers Rafael
Rivera and Long Zheng posted proof-of-concept code that circumvented UAC
the Windows 7 beta, allowing attackers to use pre-approved Microsoft
applications to trick the operating system into granting malware full access
Sophos Security Advisor Chester Wisniewski agreed with the
duo in a white paper, stating that "malware has been observed spoofing
UAC-style prompts to obtain user permission to operate unimpeded."
Wisniewski wrote, "The UAC concept is user-driven
rather than expert-driven, so it is a questionable approach in a world where
end-user expertise is rare ... Although personal files and tools will require
user approval and operation, core system assets should be more rigorously
In an interview with eWEEK, he added that the UAC controls
reduce the number of pop-ups but are "less effective at stopping malware
than in Vista if you ignore the flesh between keyboard
He added, "Vista's UAC was so
nag-prone that you became numb to it very quickly. I just re-installed [Windows
7] on my laptop and only had a small number of UAC prompts through loading my
entire enterprise application load. Much better."
Cooke said Microsoft's approach with Windows 7 was to give users
more control over the number of prompts they receive and to make the
prompts more meaningful when they appear by quieting the system in general.
"Before UAC was introduced, most Windows consumer and
enterprise users ran with administrative rights, which meant that ISVs could
inadvertently make their applications dependent on administrative rights,"
he said. "Applications running with administrative rights have the
ability to tamper with all user and Windows system data, including the ability
to disable antivirus and other security measures ... [UAC] gives users a more
compatible choice to secure their systems by running with standard user rights
instead of administrator rights."