Comments on: UAC in Windows 7 still broken, Microsoft won’t/can’t fix code-injection vulnerability

By: Nyerguds

Nyerguds — Wed, 27 Jan 2010 10:53:44 +0000

Wait, you mean YOU can tell in ANY CASE what exploit a virus has used to get into your system? Nope, you can’t. Not like the antivirus gives you the virus’ source code. The fact remains that this is yet another way for viruses and malware to totally take over your system.

By: Nyerguds

Nyerguds — Wed, 27 Jan 2010 10:50:48 +0000

If we were only talking about a program, there wouldn’t be a problem. This is the entire OPERATING SYSTEM. They had a good opportunity to implement stuff like this when they made NTFS, and they didn’t. What’s stopping them from making an NTFS2 for their next Windows and integrate a full user rights file system into it?

And I AM a programmer. This isn’t about “fixing bugs” at all, because it’s not supposed to be an “new implemented features” that can have bugs at all. This is about ignoring a core requirement of the operating system, by building on a previous one instead of starting by revising some of the core.

By: Ghilli

Ghilli — Sat, 02 Jan 2010 12:14:18 +0000

I posted twice because I want this to be separate.

You guys ask for change but you don’t give a description of what you want. You sit there at your computer reading an article, by someone you don’t know you can trust who based it on the info of another person (who is apparently not a trust-able source any way – a few posts up), typing that you agree that its a problem.

You guys wanted more security > they gave it to you > you get mad because it’s “annoying” > they tweak it to give you an option to turn it off > u get pissed because now viruses can turn it off as well (not: “it doesn’t work”)

You admitted in the beginning of your article that you are not a programmer, which brings me to my question do you have any idea how much time goes into writing a program? do you have any idea how long it takes to fix the bugs in the program? do you know how long it takes to even find these bugs? I’m a programmer, and even as a novice I realize the difficulties that exist in this field of work.

By: Ghilli

Ghilli — Sat, 02 Jan 2010 11:21:13 +0000

I’m agreeing with GS1 – If you run antivirus software you will be FINE; I also used to run firefox (with the no script add-on) nearly everday, i downloaded anything that I wanted, my hard drive space was my limit, and I never got a serious virus, all I EVER got was some addware, and that is not luck.

BTW my computer ran great for the 4-5 years that i used it, and it still works now; though i am having problems with it – the reason i bought a new comp with win7 (also the need to upgrade played a part)

anyway u want a solution to your win7-UAC problem here it is: get some AV and malware protection and stop the viruses from even getting to the point where they are able to “exploit” anything – and if it’s a program that you downloaded chances are that you know what it is; if you don’t then its your own fault

To be honest with you when I was google-ing and found this i was looking for some info on why certain programs wouldn’t run on win7 because of new security features

Just a question: Can ANY of you HONESTLY say that you have gotten a virus (or other) because of THIS “exploit”?

And just so you know, thanks to your article and video, hackers/programmers who wouldn’t have figured it out just did.

By: GS1

GS1 — Sat, 14 Nov 2009 07:56:02 +0000

Every piece of software and every OS has vulnerabilities
If it was coded it can be exploited!

As has been said over & over again. The problem is most computer users are too ill informed and ignorant.
They simply fire up their system, run no AV or Firewall and use IE.
They download and run any executable then they are shocked when they find there system has been compromised/infected.

What is needed is more education and a pro active approach,
I used to run XP everyday as Admin (With FF & No/Script) and i NEVER got an infection/virus/malware/worm etc and i am not a system administrator,
I am simply an advanced user.

But i suppose as i type this someone somewhere is trying to find exploits for Windows 7 and its only a matter of time before its unleashed and causes mayhem.

By: L’Antivirus gratuito di Windows 7 serve a compensare il bug nella UAC? | saggiamente

Mon, 19 Oct 2009 13:02:58 +0000

[...] E su Windows? Beh, ancora deve uscire ed è già attanagliato da qualche ombra di troppo. La Gestione Account (UAC) introdotta con Vista e che ritroviamo su Seven ha un grosso bug di sicurezza, che a quanto pare la Microsoft non ha voluto o saputo risolvere. Dopo gli infiniti problemi di Windows XP in fatto di malware, Microsoft ha mutuato dai sistemi Unix-Like (come OsX o Linux) il concetto che gli utenti di base non sono Amministratori e quindi non possono compiere interventi delicati sul sistema. Su OsX infatti, quando una applicazione tenta di modificare il sistema, viene richiesta una password amministrativa per procedere. Purtroppo su Vista il risultato è stato un tedioso susseguirsi di popup, che ha sollevato non poche polemiche. Così è stato introdotto un meccanismo che permette di disabilitare, selettivamente, tali avvisi. Sin dalle primissime release di Windows 7, è stato evidenziato un Bug permette di eseguire uno script che disabilita le notifiche e permette, di fatto, di eseguire codice dannoso con privilegi di amministratore. Più volte è stato segnalato il problema dai beta tester, ma non è servito a nulla. Anche l’ultima Release Candidate presenta lo stesso bug, così come la versione che dal 22 ottobre sarà venduta sugli scaffali di tutto il mondo e nei prossimi computer. Sembra che si voglia privilegiare l’usabilità a sfavore della sicurezza (fonte UAC in Windows 7 still broken, Microsoft won’t/can’t fix code-injection vulnerability). [...]

By: Ross

Ross — Fri, 24 Jul 2009 02:11:54 +0000

Ya Windows 7 rocks… For a word processor / email client. If you want to do any real work or gaming though, your productivity will suffer. You’ll find yourself back in XP to remain competitive.

By: Ross

Ross — Fri, 24 Jul 2009 02:04:29 +0000

If you’re not surfing around sites with questionable content, you really don’t need any security at all. I’ve spent the last year in XP Pro with no firewall, and no virus software and with no problems. Every once in a blue moon I’d get whatever AntiVirus is most popular at the time and do a quick scan only to find that I had no malware or viruses or any other malicious software.

That being said, if someone wants to hack you, they will. They just wont be hacking you from a Microsoft Windows cocoon, most likely. Bringing Windows to a hack fight is like bringing a spoon to a gun fight.

By: UAC, UAC, go away, come again some other day | Everything Microsoft

UAC, UAC, go away, come again some other day | Everything Microsoft — Wed, 24 Jun 2009 06:08:28 +0000

[...] was reading Mark Russinovich’s latest UAC article and Long Zheng’s latest scribblings and… developed quite the headache. Honestly, I’m tired of trying to sort out what UAC really is [...]

By: Nobody Real

Nobody Real — Fri, 19 Jun 2009 22:51:23 +0000

You do realize that WriteProcessMemory and CreateRemoteThread are *NOT* non-privileged API’s. They require permissions normal users don’t have. I think it’s highly deceptive to claim they’re unprivileged API’s when they’re not.