RSSSophos study suggests Windows 7 UAC's default setting is self-defeating
By Scott M. Fulton, III | Published November 5, 2009, 4:08 PM
A blog post Tuesday by Sophos senior security engineer Chester Wisniewski stated that recent Sophos tests revealed that User Account Control -- the part of Windows that prompts the user for permission before granting elevated privileges -- was ineffective in stopping common samples of malware from running, in a Windows 7-based system without virus protection.
Whereas two of the ten chosen malware samples for the test would not run in Win7 without UAC turned on at all, only one more sample (a low-prevalence worm code-named W32/Autorun-ATK) was thwarted by UAC. The other seven ran as though they were being blocked only by a stack of dominoes.
Those items that ran unimpeded were: Troj/FakeAV-AFY and Troj/FakeAV-AFX, two low-prevalence Trojans that pretend to be a free anti-virus test; Mal/EncPk-KY and Mal/EncPk-KP, two garden-variety spam viruses; Troj/Agent-LIW, a low-prevalence Trojan that adjusts the behavior of Internet Explorer; Troj/Zbot-JN, a variation of the Trojan that attempts to steal online banking login information by first masquerading as an anonymous e-mail request for a date; and W32/Autorun-ATC, a garden-variety worm that changes the startup script.
"User Account Control did block one sample; however, its failure to block anything else just reinforces my warning prior to the Windows 7 launch that UAC's default configuration is not effective at protecting a PC from modern malware," Wisniewski wrote.
That default configuration is a new setting for Windows 7, that's one level down (and one level less annoying for some users) than Vista's default. During the testing process earlier this year, Windows 7 generated considerable controversy for effectively enabling some applications to generate a kind of "privilege self-elevation privilege" for themselves, which some saw as a vulnerability gift-wrapped for anyone wanting to go exploiting it. Others complained about a more sweeping potential problem: that the whole point of generating the message in the first place (stopping privilege elevation) is forfeited if developers leave a back door wide open.
As Wisniewski told Betanews this afternoon, his intention was not to prove UAC pointless in and of itself, but to suggest that Windows 7 may be vulnerable right out of the box unless and until users do something above and beyond the default.
"This was a quick test to determine if the efficacy of restricting administrative rights through the use of UAC alone will protect against malware infecting a computer running Windows 7," Wisniewski told us. "I did not test how it would have behaved if UAC was dialed up, or perhaps run in what people are calling 'Vista mode.'"
But if anti-virus is the solution to the problem (of course, Sophos is an anti-virus software maker), then what good is UAC at all, even if it's dialed up? Is Chet suggesting the whole thing is pointless anyway?
"I am performing some follow-up testing, although as is the case with malicious software, it does take a bit of time to safely perform these tests. With the data I have at the moment, I am not making recommendations as to what you do with UAC," he responded, "merely warning people that it does not protect a machine effectively against malware. I think Microsoft acknowledges this with their efforts on Microsoft Security Essentials and Forefront." But isn't UAC generally effective against malicious applications that seek elevated privilege levels, even if they're not among the most dangerous viruses cited by Sophos?
"We did not select specific malicious or difficult samples, merely the most recent ten at the time. Most were 'Fake AV' even if the sample names did not indicate that. We have generic detection for malicious packers and other nastiness that proactively finds many samples...With proper anti-malware protection, Windows 7 is far safer," acknowledged Sophos' security engineer.
"One benefit that UAC could have provided," he continued, "is an additional layer of protection that would help in the event that your anti-virus has failed to detect a new sample. It does not appear from my results that this is the case."
Just turn it off... simple.
You'll be met with an 'are you absolutely sure you really, really wanna do that?' message, but it'll be the last one you see.
Party on.
Score: 0
|It makes absolutely no difference at all how Microsoft makes a operating system or how secure they or anyone else thinks it is. There will always be someone out there in this big world of ours ready to prove that it can be broken. So if anyone thinks they are safe because their windows OS is the best, they are mistaken. When you run the internet you take the risk of these things happening and it will and there is not much we can about it. Your never 100% safe with any software, be it a OS or a antivirus or a firewall. Even still today, with my own customers they all seem to think, well I have the best OS or I have a anti virus and I am protected and when they do get a virus or some other bad thing, they simple do not understand that and the first thing I hear, is well, you made a mistake, I have a anti virus and I am protected. How wrong that is to believe.
If you have a computer, and your connected to the Internet, your NOT 100% safe and any OS, anti virus, firewall maker will tell you that. Nice isn't it.. :) Why you ask, because we have stupid ignorant people in this world that live only to hurt others and destroy their property...
Score: 1
|I dont have this problem because I have the most secure windows ever made. Vista....I wont be buying that insecure W7.
Score: -4
|lol
Score: 0
|A recent IDC report (International Data Corporation) proclaimed that Sophos is 'Focused on serving the enterprise market exclusively' and so this is them trying to keep their business customers from thinking about changing their AV provider if\when they role out Windows7.
They are happy to slam Windows7 and\or UAC as they are a bit pissed at Microsoft for not giving them any seal of approval for their products and not involving them along with other AV companies on the development of Windows7's security interoperability.
Also it is a bit cheeky of them to slam Windows7 when they don't have any products that they officially suppport when running on Windows7!
Score: 1
|If UAC doesn't help then WTF? It's supposed to help, but with it on or off, makes no difference, it's a POS; why bother?!
Score: -2
|It's not an Anti-Virus program, genius.
Score: 0
|I like the comments about UAC replacing AV software - they are correct - it would be a JOKE for Windows to provide built-in AV software. They have been torn down and taken to court over providing a WEB BROWSER as part of the OS installation - they would be torn to shreds if they offered a free/built-in AV solution as well.
Score: 2
|If it weren't for the *fact* that I know Scott is simply trying to make sure the masses aren't deluded into believing they are exempt from viruses/malware regardless of the OS, I'd think this was simply an overstatement of the obvious. Once again, use a reputable AV software package.
Quick reminder: The VAST majority of viruses get into users systems *with their permission*. Opening strange emails/attachments, visiting elicit sites (ESPECIALLY porn/hack sites), installing *free* software (please, PLEASE do not read that I'm against Open Source - I use OpenOffice on a daily basis, as well as many other Open Source tools), etc.
Score: 2
|Lol, what kind of stupid test is this? Of course FakeAV's installed without problems. They don't use ANY system drivers since they are fake AV's. And programs that don't do any system wide changes don't even require admin rights.
Score: 0
|Aside from all this discussion about "this article is basically an AV software company ad", I'm troubled: why is there no result of UAC on maximum? rather than "may be self defeating", we would "know" whether UAC on "maximum" offers added security compared to UAC "default". But UAC "maximum" does not seem to have been tested. Why?
Score: 1
|because the article is about default settings, which many users don't know how to change anyways (or don't bother to change)
Score: 0
|"But UAC "maximum" does not seem to have been tested. Why?
1.) UAC is not anti-virus.
2.) Sophos wants to present Windows 7 as needing AV (like no-one knew that...) Setting UAC to maximum would not help spread that perception....
Score: 2
|Imagine that..
An anti-virus company says a product that is *not* an anti-virus product doesn't catch viruses. Thought provoking, isn't it?
1.) UAC is not anti-virus software. Microsoft knows this. Hence the release of MSE.
2.) Sophos knows this. Betanews knows this. This is an ad. Nothing more.
3.) The "viruses" they used (most of which are actually trojans), do not attack a system without user intervention. They must be explicitly run, either via a malicious program, or as they did...by running them manually. This is *not* representative of *any* real-world situation.
This story has been on the net for several days now. It has been *thoroughly* discredited on numerous sites...even Slashdot.
Imagine my surprise when it gets picked up here... What, did you notice the hits the story generated on Slashdot and other sites and thought you simply had get yourself a piece of that action, Scott?
Score: 6
|*awaits the sophos ads on betanews.com*, oh wait, I don't see any ads anymore.
Score: 2
|Heck... if Microsoft could, they would add MSE and be done with the controversy, but then again, people complain of Microsoft monopolizing the Browser market for including a Browser which --like the Antivirus-- has become an essential tool in an operating system, they will not be able to. It is a shame because the end user is the one who has to live with the lack of proper protection from the moment they start their computer for the first time.
Score: 0
|By the way, the way things are going, Ad blocking add ons and software will end up blocking Betanews if they keep posting infomertials. Scott, you need to resist the temptation... no matter how much Sophos pays for it.
Score: 0
|Ya imagine that, remarkable isn't it. But PC_Tool is correct....
Score: 1
|UAC in its entirely is self-defeating when users press the ok button automatically without reading just to quickly get passed its annoyance.....
Score: 3
|Which is why all users should run a "limited user" account. Then, when they get a prompt, they'll have to do more than press "OK".
Score: -1
|Has UAC somehow become synonymous with Anti-virus or Anti-Malware applications? Hmm...interesting.
"One benefit that UAC could have provided," he continued, "is an additional layer of protection that would help in the event that your anti-virus has failed to detect a new sample. It does not appear from my results that this is the case."
Why on earth would anyone need anti-virus software if Windows 7 UAC was somehow this miraculous? If that were the case they'd have to be called file repairers or something, because their only use would be to clean and repair infected files, not prevent them from affecting the system.
UAC is a safe-guard, not a substitute in any capacity for an av or am program. UAC prevents really, um, adventurous people....who travel the internet and click on any and every website, from being the victim of the typical 'get to website, website downloads and installs "something", ouch!' syndrome.
Personally, I don't think UAC is pointless. It may be, for the smart majority who know to perhaps, install programs like Web of Trust before we go clicking through the web, or those who have tried and true AV programs....but it certainly isn't for Grandma and Grandpa or every now and again PC users who just don't know what they SHOULD, the basics of surfing. It may not prevent virus or malware infections that are complex or advanced enough to come into the system in some unscrupulous way, but it will more than likely pop up big and bright if anything tries to run an .exe or .com or .bat file.
Score: 7
|Problem was, people with knowledge of computers rant about the UAC. Thinking it's redundant and annoying. So the average joe or below average computer users will listen to the person with knowledge in computers saying, "HEY!! I don't want UAC also because it's annoying" Yet they have no knowledge what the UAC is. They then go surfing the net and then a pop-up appears. I better clicks YES to scan for a virus since the UAC is disable. *watches the virus install* Here the best part from the user. "Stupid Microsoft, why didn't they added a feature to warn me about installing a program that could be harmful to my computer"
You have to keep in mind. Even though we have a background in computers. We have to take consideration for the non computer knowledge people.
Score: 1
|UAC sucks and has since vista. I never liked it and always turned it off. On windows 7 i have it set to never notify. But i use Microsoft Security Essentials. Which does catch stuff seemingly well. But no antivirus is perfect, of that i know for a fact.
Microsoft needs to scrap UAC in favor of something that works but is not annoying. Maybe thats why they offered Microsoft Security Essentials for free.
I should also add that Microsoft Security Essentials should come preinstalled on every pc. Sure it would anger every antivirus company on earth but it would make pc's safer. Cause far to many pc owners are brainless newbs who know nothing about how to protect themselves.
Score: -5
|It's far more better than that you see you in Linux and OS X, it's so convenient to press that OK button rather than typing our password!!
Score: 2
|Granted, the procedure on OS X and Linux to elevate priviledges is more complicated than on Windows. But here is the catch: on OS X and Linux, you are only asked to elevate priviledges when you need to. And it will ask you once, whereas UAC will routinely ask you at least twice per operation.
Another problem is that Windows apps are used to be able to get admin rights (for example, in order to edit the registry), whereas OS X and Linux apps have widely respected conventions that make it possible for them to never require admin rights.
Score: 1
|Set any program to run as admin and each time you run it you get a UAC prompt. This is silly, just like all those 'are you sure?' prompts when leaving a game. For this reason alone I'm thinking of disabling UAC in 7.
Score: 0
|He acknowledged Microsoft's free Security Essentials, but did he test Windows 7's default UAC together with MSSE (which, in my tests, downloads and installs faster than any other free AV with real-time protection; the initial update and scan may take longer, but user perceptions about the hassle level will be based solely on the download and install)?
I suspect he did test it, but doesn't want to point out that MSSE would have stopped everything which wasn't stopped by UAC or other Windows 7 security features.
Score: 1
|I don't see how the default setting could be "self-defeating". It only allows for apps on MS's "whitelist" to auto elevate. And as far as I know only windows components are on said list. Apps run as admin still will trigger a UAC prompt.
And as for infecting a PC with no AV, I don't see how anything could protect against that...except well AV SOFTWARE lol
Score: 2
|Exactly. And this guy works for an AV Software company. It just seems to me like he trying to prove that computers need AV Protection which we all know is true. It's just like what johnrc2 said, this is a non-story and certainly not news.
Score: 3
|Wow, so this guy basically infected a system that didnt have any AV installed? That must have been so difficult. /s Seriously UAC wasnt meant to stop infections by any means, and I am sure this guy knows this. Sounds to me like he just wants to get his companys name out there by bashing UAC, etc. And you notice he didnt even test it with UAC turned on MAX just too see if there was any difference.
UAC is a safeguard. It may not be perfect but it is an added measure that only Vista and Win 7 have.
What a douche. "Hey a look at me I can infect a system that doesnt have AV software on it with trojans and worms oh my".
Score: 5
|I agree. This "non-story" is all over the Internet, blindly repeated on every blog.
Score: 4
|UAC as implemented in W7 is useless to a power user. I put up with it for a few weeks and then modified the account settings not to bother me anymore with absurd OK prompts.
It needs a SECURE, ENCRYPTED white list. I find it amazing that MS hasn't done this yet.
Score: 0
|