Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security Operating Systems Software Windows

Tricking Vista's UAC To Hide Malware 221

Posted by kdawson from the protective-coloration dept.
Vista's User Account Control, love it or hate it, represents a barrier against unwanted software getting run on users' computers. A Symantec researcher has found a simple way to spoof UAC and says that it shouldn't be completely trusted. The trick is to disguise the UAC warning dialog in the color associated with alerts generated by Windows itself.
This discussion has been archived. No new comments can be posted.

Tricking Vista's UAC To Hide Malware More

Tricking Vista's UAC To Hide Malware

Comments Filter:

  • Importance? (Score:4, Funny)

    by MrNonchalant ( 767683 ) on Monday February 26, 2007 @07:52AM (#18151678)

    "Would the user treat this UAC with the same amount of caution?" His answer: No. Users will, as Microsoft intended when it selected those colors, note the teal border of the spoofed UAC and likely click through without a second thought, he said.
    I've been using Vista for a month. There were color differences?

    • Re: (Score:2, Insightful)

      by leuk_he ( 194174 )
      Never noticed these colors as well.

      I did try to cut the number of warnings given, but uac still is not yet at a level it is user friendly.

      Let me point out:
      -It sometimes tells the publisher is unknown, and sometimes it show the publisher, but say it is unverified. It is just a conspiracy with verisign [microsoft.com] to sell code signing certificates.
      -Java vm had fine grained access controls [unix.org.ua] a long time ago, and the NSA build these into windows NT 4.0 also. But all UAC allows is to give full access(=admin that can install d

      • Re:Importance? (Score:4, Interesting)

        by gunnk ( 463227 ) <gunnkNO@SPAMmail.fpg.unc.edu> on Monday February 26, 2007 @08:40AM (#18152026) Homepage
        What I want to know is if the system can't tell that *I* double-clicked on an icon to start a program, how does the system know that *I* clicked "Allow"?

        If I had to enter my password to continue I would understand the difference, but just a click to continue? Does this work at all?

        • Re:Importance? (Score:4, Interesting)

          by MrNonchalant ( 767683 ) on Monday February 26, 2007 @08:46AM (#18152098)
          The environment you click that button in is a separate and theoretically secure desktop. That's why the screen dims: to indicate that. It's the same armor that protects your Windows password from keyloggers. Whether or not it's secure remains a largely open question. There are no exploits I've heard of to breach it, and Microsoft would (eventually) patch said exploits if they became apparent.
          • The really stupid part about UAC, as I see it, is this:

            The anti-password-keylogging protection which you mention is at least initiated by the user, by pressing Ctrl-Alt-Delete, which the Windows kernel treats specially and only dispatches to the security subsystem -- therefore, it is impossible to write a trojan which would simulate the Windows C-A-D logon procedure, since the trojan couldn't know if the user presses C-A-D.

            On the other hand, a UAC prompt, at least as I've understood it, is initiated by

    • Re: (Score:2, Informative)

      by Asztal_ ( 914605 )

      I guess if you didn't notice, it's possibly because you knew what you were doing at the time and just clicked allow/continue without second thought. Or maybe you just didn't install/run unsigned software, which would generally be a good idea anyway.

      This is essentially allowing a trusted program (RunLegacyCPLElevated.exe) to load and execute untrusted (unsigned, etc) code in its own, trusted, context... I don't see how that can possibly be secure, or how they can say it's not a problem. The obvious choice

      • Re: (Score:2)

        by leuk_he ( 194174 )
        I am using/installing open source software. Since vista was/is new to me i have to carefully read what it press. But open source software is seldom digitally signed. The only value of a digital signed is that you know who wrote the software, it will never say anything about quality, and so far it never was about any guarantee made by the supplier of the software.

        If ths software is supposed to come from a major publisher, (like Microsoft, or adobe, or symantic) it might be worth something. However if you run

  • paraphrase (Score:2, Interesting)

    by physicsboy500 ( 645835 )

    I love Microsoft's response:

    Meh... the same users who show enough common sense to click on the "you've won a free ipod enter your credit card information here" will obviously be able to know the difference between a good system message and a bad system message

    Hooray for apathy!

    • Re:paraphrase (Score:5, Funny)

      by risk one ( 1013529 ) on Monday February 26, 2007 @08:22AM (#18151870)

      Hooray for apathy!
      Meh... it's alright, I guess. I could take it or leave it.

    • Re:paraphrase (Score:4, Funny)

      by SydBarrett ( 65592 ) on Monday February 26, 2007 @08:47AM (#18152116)
      So, Vista is gonna prevent me from winning Ipods?

      Screw that, if i'm the 999,999th vistor I deserve a prize and I dont care what no washington computer fatcat wants to do with my internet windows.

    • Here's my paraphrasing. (Admittedly biased.)

      "It would start with a user falling for any one of the current hacker tricks."

      Now, call me dense, but... why exactly doesn't the hacker use this trick to DO WHAT HE WANTED?

      I mean, think about it. Assume you can convince a user to run any program once, and you want to set up a botnet.

      Should you:

      A. Send the user a program that sets up an elaborate trust circumvention mechanism so he can be convinced to run the program which installs the botnet?

      or:

      B. Just send him th
  • Basically its a way to get a green pop-up, which usually means safe applications. It relies on the user blindly saying "yes" to these green pop-ups

    • Re: (Score:3, Interesting)

      by POTSandPANS ( 781918 )
      After using vista for about an hour on a customer's computer, I was pretty much trained to click yes on all those things too.

      The problem is that while we may actually read those warnings, most users are going to see it as an extra step they need to do in order to get their free ipod/car/vacation/porn. It wouldn't surprise me if directions to help users "get rid of those annoying uac popups permanently" soon show up on a few malware-providing websites. Just look at the firewall rule set on some people's comp

    • No tricking involved (Score:5, Insightful)

      by LinuxGeek ( 6139 ) * <djand...nc@@@gmail...com> on Monday February 26, 2007 @08:57AM (#18152206)
      The main problem I have seen with Vista since the first RCs is the monotonous regularity that these messages pop up with during regular system use. The old adage that practice makes perfect is incorrect; Practice makes permanent is the real outcome and microsoft is basically forcing their customers to practice hitting that continue button while still trying to concentrate on the tasks at hand.

      I have found myself clicking continue at the same time my thought registers to *not* click because of something not looking quite right. Since I am no longer developing software for a living, the only OS on my system is Ubuntu! Thank God for Debian, Ubuntu, Red Hat, et al. for their tremendous efforts to give everyone a reasonable alternative; whether we choose to use it is certainly a choice, but we do have the choice.

      • Re:No tricking involved (Score:4, Insightful)

        by 99BottlesOfBeerInMyF ( 813746 ) on Monday February 26, 2007 @10:17AM (#18153074)

        ...microsoft is basically forcing their customers to practice hitting that continue button while still trying to concentrate on the tasks at hand.

        The "OK/Cancel mistake" has been in usability textbooks as an example of what no to do for more than a decade now. It is quite clear to anyone who has had any formal training in human-computer interaction that either MS hires the worst UI people on the planet, or the marketing department overrides all of the UI people's proposed changes. It is also clear that either MS is only vaguely aware that UI deign is an important part of security, or they are a lot more interested in providing the perception of security than the reality. My opinions is that Vista security is a lot like searches at the airport. For the most part it is completely ineffective at actually increasing overall security when it is important, but it is very, very visible and "in your face" so people assume "something is being done" and are mollified.

        • Re: (Score:2)

          by MORB ( 793798 )
          I think the only actual purpose of those UAC dialogs is just to shift the blame to the user (even though most probably end up always clicking ok without looking out of habit) if something goes wrong.

          • Re: (Score:2)

            by cp.tar ( 871488 )

            So, first they make you accept the EULA which says something like "yeah, you did pay us for this software, but if something goes wrong, it sucks to be you", then they give you the kind of security where everything that goes wrong is your fault because hey, you allowed it...

            Does anyone need any more proof that Microsoft is Lawful Evil?

  • Not an issue (Score:3, Insightful)

    by picob ( 1025968 ) on Monday February 26, 2007 @07:55AM (#18151692)
    I couldn't say it better than a header in TFA:

    Microsoft: Not an Issue

  • We need to cut down on the complexity. (Score:4, Insightful)

    by Anonymous Coward on Monday February 26, 2007 @07:56AM (#18151700)
    With every release of Windows, Microsoft seems to devise some new, overly-complicated scheme to try to protect Windows users. The scheme they came up with may sound great, but then it falls flat on its face because of some minor flaw or workaround.

    So maybe what they need to do is to get back to the fundamentals. We only need to look as far as OpenBSD to see how keeping things simple and intelligent results in a very secure operating system. Instead of writing new (and probably buggy) code to try and prevent things like malware, they just repeatedly go over the code they already have, to try to ensure that it is exploit-free. And it works. OpenBSD is a damn secure system.

    • Oh please. OpenBSD is just as susceptible to someone downloading an evil binary and clicking "Yes" as Windows is. User level permissions are more than sufficient to start up some malware automatically every login, not to mention sufficient to wipe out all of your important data. (No, /usr/bin generally isn't that important.) I love OpenBSD, but please, be rational.

      • Re:We need to cut down on the complexity. (Score:4, Insightful)

        by peragrin ( 659227 ) on Monday February 26, 2007 @08:51AM (#18152152)
        Why don't you be rational. So that user's directory get's trashed. but trashing that directory also kills off the malware. If it doesn't a simple search for that user's remaining files will. All that remains is a simple backup restore and your good to go. total time to repair maybe an hour.

        To clean a Windows box means reinstalling the entire damn thing.

        It is also a lot harder to use a *nix based box as a botnet zombie. It isn't impossible, but each machine has to be manually cracked, unlike Windows up to XP which it can be fully automated. I will hold off on final Vista judgments until more information can be gathered.

        To Quote Scotty in Star Trek III The more they over think the plumbing the easier it is to stop up the drain.

        Simple *nix user level security has proven for over 20 years to be more effective than anything MSFT has produce in the same amount of time.

        ACL's make life easier for large installs, but it is the small ones that cause the most problems. That is why large *nix installs use both.

        • Re: (Score:2)

          by caluml ( 551744 )
          It is also a lot harder to use a *nix based box as a botnet zombie. It isn't impossible, but each machine has to be manually cracked

          Eh? Says who?

        • Re: (Score:3, Insightful)

          by MajinBlayze ( 942250 )
          To the *NIX crowd: Please, please, please stop trivializing the destruction of a user's home folder. For home use, there is rarely more than 1 user, and loosing all documents/etc is marginally better than reinstalling the whole OS. There is no reason that an application should have this kind of permission, IMO, we need to look past user level permissions to application level permissions, as this is where real security exists.

          • To the *NIX crowd: Please, please, please stop trivializing the destruction of a user's home folder. For home use, there is rarely more than 1 user, and loosing[sic] all documents/etc is marginally better than reinstalling the whole OS.

            There is one important reason why compromising a user account versus compromising a machine makes a difference and that is, just compromising a user account does not necessarily give a worm author sufficient access to add a machine to a useful and profitable botnet. As such, even if a worm author can destroy everything in the user's home directory, they aren't going to because it doesn't make them any money. Being so poor you can't afford shoes won't help you outrun any muggers, but it is likely to decrea

          • But it's impossible to run a privileged service (port under 1024) as a normal user in Linux. That'll stop a lot of random mail relays, as well as other "fake" servers. You can't just use a random user-privileged unix account to serve up your phishing site, or to do a lot of things that a typical Windows pwning will allow.

      • OpenBSD is just as susceptible to someone downloading an evil binary and clicking "Yes" as Windows is.

        This is not exactly true. On OpenBSD finding a local elevation vulnerability to allow you to root the machine from an untrusted account is nontrivial. To date, that is not the case with Windows, including Vista which already has unpatched, outstanding elevations. Further, on OpenBSD the user can install software as the local user for the most part, whereas users are prompted for admin access to run installers, by default, in Windows. Finally, you can install TrustedBSD and run said malicious evil binary w

    • The security model in BSD and Windows are the fundamentally same. Resources on the system are protected by access lists defined for users/groups. Administrators/Root have full access to change anything in the system, absolutely no way around that. Windows screwed the pooch because in its migration from Win98 (single-user, no security) to the Win2k/XP platform (already mature user and ACL implementation) they had to keep app compat or lose the market (computers were not powerful enough to get virtualization

  • Different colors?? (Score:5, Interesting)

    by drawfour ( 791912 ) on Monday February 26, 2007 @07:58AM (#18151712)
    While it may be true that different colored borders are supposed to mean varying levels of "trust", as in what component is running, I don't think any user would know that. The text in the dialogs doesn't appear to be different (that I can tell), so why would a border color make me go "Oh, I should let that action happen, I bet that's some Control Panel action", especially when I wasn't working with the control panel.

    To be honest, Vista's UAC saved my butt recently. I have no idea what application was vulnerable -- but it somehow tried to run exec.exe, which was downloaded into one of my temp folders. The file was deleted after it failed to run (because I said "no"), and then would appear back in a few seconds and try to run again. I'm happy that whatever application was vulnerable wasn't able to do anything to my system.

    <tangent> Anyway, while some people may say it's annoying, I'm not sure exactly how many actions a typical user would take that would require UAC prompts. After the first few days of configuring, installing apps, etc..., I have little need to do anything that requires UAC prompts. Defrag is set up to run every night, anti virus is set up to download updates, my resolution settings don't change, etc... </tangent>
    • > why would a border color make me go "Oh, I should let that action happen, I bet that's some Control Panel action", especially when I wasn't working with the control panel.

      Colorcoding is an attempt to make the user differentiate, not a piece of extra information.

      Consider the situation of the unknowing user, who is confronted with a warning but has insufficient information on its meaning. There will be many of those. In some cases, denying access can give no feedback, in others it can immediately make

    • Re: (Score:2, Insightful)

      by dysfunct ( 940221 ) *

      I don't think any user would know that.

      I wouldn't be too sure about that. The article mentions that "the dialog is bordered by Vista's own greenish color to signify the file is part of the operating system". Since this dialog will likely pop up frequently with a low chance that the user triggered it unintentionally (i.e. the user knows what he/she is doing) it might actually lower the barrier of clicking "Allow".

      Don't forget that even though a user might not consciously notice the color after a lot of us

    • Somehow an unknown executable ended up in your temp folder. You have no idea how it did. Some application is trying to run that unknown executable every few seconds. You dont know which application is doing that. You dont know what else that application is doing to your system. But you think the UAC has saved your butt. And further suddenly all UAC dialogs stopped. Instead of asking yourself with much trepedation "why?" you become happier! "All others are getting the annoying UAC dialog. But whatever malwar

      • Re: (Score:2)

        by AJWM ( 19027 )
        Somehow an unknown executable ended up in your temp folder. You have no idea how it did. Some application is trying to run that unknown executable every few seconds. You dont know which application is doing that. You dont know what else that application is doing to your system.

        You just described the normal everyday experience of 99% of people running any application on Windows. They don't know from "temp folder", and they sure as hell don't know what else that application -- whether it's Office or IE or Ou

  • C'mon, give MS a break here! (Score:5, Insightful)

    by pla ( 258480 ) on Monday February 26, 2007 @07:59AM (#18151726) Journal
    That pops up a UAC dialog, but because RunLegacyCPLElevated.exe is set to run those Control Panel plug-ins with full administrative privileges, the dialog is bordered by Vista's own greenish color to signify the file is part of the operating system.

    So we make fun of Homeland Security for their meaningless color-coded threat levels, but take the colored borders of confirmation dialogs on Vista as gospel?

    Sorry, this does not constitute a threat. Just one more indication that we need some form of licensure before letting people anywhere near a computer.



    I'll gladly join in on the MS bashing - when appropriate. In this case, any blame rests solidly with users who have no idea what they should or shouldn't let run on their computers.

    • Re: (Score:2)

      by teridon ( 139550 )
      Ah, elistism at its finest.

      Computers seem to be heading in the direction of becoming more like appliances; something you just use to do what you want. Why should a normal computer user know exactly what's going on behind the scenes for every action they do?

      I consider myself an advanced windows user, but I'm still not sure at all times what every application and service and background process is doing. If you tell me you DO know EVERYTHING that is happening -- well you are very special. Also, why should I

      • Re:C'mon, give MS a break here! (Score:4, Insightful)

        by stokessd ( 89903 ) on Monday February 26, 2007 @09:15AM (#18152354) Homepage
        "Computers seem to be heading in the direction of becoming more like appliances; "

        True, and we are in a dangerous "middle-ground" between a complex tool that only knowledgeable people use, and a true appliance that anybody uses.

        The problem is that the operating system is too brittle and vulnerable to be considered an appliance. Do you ever think about how you use your toaster? If I put this new organic untrusted bread in the toaster will my toaster be taken over and corrupt the blender and waffle maker and start a kitchen rebellion? If I put in this DVD of "Ishtar" in my DVD player will it require a weekend to reinstall it's OS and useful applications?

        No, that doesn't happen because appliances are robust and there isn't much a user can do to hurt them when used in their intended ways.

        Now the current computers (particularly windows) are becoming appliances but haven't gotten to the critical point where they really become appliances. that transition will happen when a big chunk of the OS is hidden from the user and the user works in a Sandbox. It will be a lot less useful because it will only do what it was designed to do, but it will be safe and reliable for it's intended purpose. Then it will be an appliance.

        The problem is that computers are sold as the answer to lots of the average user's non-problems. Like any good for sale in a capitalistic society, it's jammed down the throats of everybody the seller can get their hands on. So lots of people who maybe shouldn't be using computers (in their current unrestrained form) are using them (they are the ones who you get your spam from).

        This is a windows problem not only because of shoddy engineering, but also because of Microsoft's position in the market. Let's look at the three major OS's:

        Linux (BSD et al): It's a computer hobbiest's paradice, lots of great code, well defined heirarchy. Plus in general hard to get your hands on if you are "Joe User" who just wants to get a computer to e-mail the kids at school. This means that the people who are using this os WANT to use it for some reason (insert long list here), and they are going out of their way to use it. This means that this segment is typically very computer savvy and not likely to be pwned as a group.

        Macintosh: This is also a "Harder to get" computer for two reasons. First, they are very expensive compared to the best-buy special. Second they are only sold in a few places. These two reasons make the Mac a sought-out computer rather than what the sales droid told you to buy. The average user is probably less computer savvy than the average Linux user, but in the case of the Mac, apple also "has your back" to some degree with frequent patches and a well designed core OS that minimizes your risk to begin with.

        Windows: This is the default OS you get if you close your eyes and pick a computer. This means that if you have no clue about computers, chances are you get a windows box. Its fertile ground for stupid users to take advantage of (can I interest you in a free screensaver?). And in addition to that, MS has huge legacy issues that they can't change or they break business apps. MS has painted itself into this corner by selling to the lowest common denominator.

        Change the borders to any color you like, there are still a huge amount of computer users that shouldn't be computer users under the current OS choices.

        • Re: (Score:2, Insightful)

          by Cycloid Torus ( 645618 )
          There - right there in the 4th paragraph - you defined it - the next OS - the one my spouse, my kid, my mother-in-law ALL need YESTERDAY. They will never have half the knowledge of PCs that I have - and I find what I know to be inadequate over and over. I can't get really upset with the sludge I have to scrape out of their boxes.

          I think (hope, pray, etc) that Open Source will provide well constructed (custom?) Sandbox OS for all of my relatives who look to me to fix their little problems now - with a ser

      • Re: (Score:2, Insightful)

        by pla ( 258480 )
        Ah, elistism at its finest.

        I know, right? Daring to think that people would bother to learn how to properly feed and care for a $500+ investment. I can act like quite the insensitive bastard some days...



        Also, why should I care? Sometimes I just want to get my work done!

        And I just want my car to get me to work. But if I don't know the condition of literally hundreds of seemingly-irrelevant aspects of that vehicle, it either won't continue getting me there every morning for very long, or in the w

      • Re: (Score:2)

        by sydb ( 176695 )
        No, computers are not becoming like appliances. Appliances do one thing or a small set of things well. Computers - "general purpose" computers - do whatever can be done by a Turing machine. This is the problem. A toaster does not run bread, it toasts it (I nearly said a toaster does not execute bread but that's debatable). Computers execute programs and users can't know what their computers do unless they educate themselves about how they work and the programs they run.

        In the 70s and 80s you could buy dedic
    • >>In this case, any blame rests solidly with users who have no idea what they should or shouldn't let run on their computers.

      There is a problem with this, ever seen a dialog box pop up saying that such and such is attempting to run, will you allow?

      This is especially the case with Norton Internet Firewall, and the such and such can often be something like mspooler.exe, which to a standard user, or total novice is utterly meaningless.

      Rather than pop up and say some obscurely named app is trying run, wha

    • Re: (Score:2)

      by hxnwix ( 652290 )

      So we make fun of Homeland Security for their meaningless color-coded threat levels, but take the colored borders of confirmation dialogs on Vista as gospel

      I believe that the Homeland Security system is mainly employed to incite fear in the voting public. That is why it's disparaged and believed to be useless - those of us who dislike it see it as a propoganda reinforcement apparatus.

      UAC can also be seen through a cynical lense: it alerts the user to even the most trivial harmless request so that when anything of any sort goes wrong, Microsoft can plausibly say that the user permitted it.

      Nonetheless, UAC using the color green to incorrectly indicate that the

    • So we make fun of Homeland Security for their meaningless color-coded threat levels, but take the colored borders of confirmation dialogs on Vista as gospel?


      I know, red isn't the color of danger, heck if they watched Dr Who they'd know that
      Mauve is the color of danger.

      Sheesh, how unprofessional can you get?
  • Better listen up; this is coming from Symantec, the guys that brought us Norton Internet Security. These guys KNOW how to really mess computers up.

    • Re: (Score:2)

      by dr_d_19 ( 206418 )
      That's actually no joke. I haven't been able to uninstall (always "fails") from any of the computers where I've found it preinstalled. It always ends up in some half installed state generating errors at every boot and messing up Outlook.

    • I got Norton Utilities for Windows once, as I needed to undelete some files.

      After I was done, I noticed it had some Norton Desktop performance tuner stuff, which I installed out of curiosity (I wasn't expecting much, tbh).

      It was a goddamn joke - it displayed a shedload of shiny dials and meters, and had all sorts of omnipresent UI crap for me to play with to 'improve' my settings and performance.

      The only trouble was, the mere act of installing all this shit made my PC take twice as long to start up, a

      • I just "fixed" my aunt's computer by removing Norton's shitware. It used to take 30-60 seconds to open up any Word document because the thing decided to virus scan it EVERY time it was opened. And this is on an Athlon X2 laptop with a gig of RAM. Sans Norton, it's running like the brand-new computer it is. I just installed AVG and Firefox for her, and she's off and running.
  • Just get it to vibrate around like those horrible "you're the 99999th visitor!" pop-ups, and anyone would click whatever to get rid of it. Furthermore, you could change it to one of those "are you stupid?" pop-ups, that the "no" button moves around. There are a zillion ways to get someone to click the button you want.

  • Anti-Virus makers, make Virus.... same old scare (Score:5, Insightful)

    by Jackie_Chan_Fan ( 730745 ) on Monday February 26, 2007 @08:39AM (#18152018)
    These guys are pointing this out, because they want to sell symantec products. Thats the only reason why this article came out. It's the only reason why Symantec released this statement. They want to put the message out there that "You're not secure without Norton"

    This is a corporate propaganda directive, possibly directly from the CEO him/herself. "Find something, and lets use it to make us money"

    The old anti virus company making viruses, just to fuel sales... has come true. They dont have to release the viruses though, but simply they figured something out, and to tell the world that something.

    Profit at all costs.
    • Actually, I feel quite secure with my XP SP2 behind a well configured router, without any anti-virus. I don't think I've got any viruses on it, but if I do, it doesn't feel as slow as a computer running Norton.

    • These are the same guys that sell Mac OS antivirus through fear [slashdot.org] and can never have enough access [informationweek.com] to the Vista kernel.

      Microsoft has some big problems with security, but Symantec is sickeningly desperate. I used to depend on Norton/Symantec to keep my computer from dying. Now I just want the company to die (as desperate companies sometimes do). They sound like one big Mad Money "sell-sell-sell" button, just wanting to sell something to the public for whatever they use.

  • Hey -- this is simply a setuid root shell, a potential security hole as old as Unix. Apparently programmers never learn from experience. When I administer a system, a program which runs other programs based on user input doesn't get to be setuid root.

  • I am colourblind (Score:4, Informative)

    by Kimos ( 859729 ) <kimos.slashdot@[ ]il.com ['gma' in gap]> on Monday February 26, 2007 @10:44AM (#18153390) Homepage
    I don't use Vista so I don't fully understand. Do the colours of the popups provide security-related information? Seems pretty ridiculous and unfair, considering I'm not the only person in the world who is colourblind...
  • So basically Symantec is saying:
    1) Sneak in a file with a virus payload
    2) Execute that file, triggering the UAC
    3) User blindly clicks "OK"

    Of course, the point of UAC is to prompt the user when something is trying to run that requires admin privledges. Users know that when they see this box randomly pop up that something unusual is happening.

    Unless they just said to install some software or tried to change a setting themselves, seeing this pop up when they visit
  • Wow...
    If I can infect your system with a trojan and drop files onto your hard drive and then remotely run code, I can get you to click OK to a box that could infect your system.

    Truly groundbreaking work here. Seriously, I mean, if all I have to do to possibly infect your system, is infect your system... well hell, Vista will probably be recalled!

    As usual, TFA doesn't live up to the summary hype. But that won't stop the MS haters from jumping on board with a "See! It's broken!"

    Really, the story for me here i

  • My biggest beef with UAC (Score:3, Interesting)

    by JackPT ( 1068740 ) on Monday February 26, 2007 @12:01PM (#18154544)
    My problem with UAC is that I bought a new computer recently, with Vista pre-installed and during the initial setup it prompted me to create a user account. The user account had full admin privileges. I immediately set up a lower privilege account for general webbrowsing etc, and when using that account not only do I have UAC confirmation messages, but I also have to enter a password. That is a good thing - rather like 'su' in Unix like operating systems or Ubuntu's locked screed admin method. Users just aren't going to realise the importance of what they're doing with just binary yes or no security questions. If anything with the initial account defaulting to admin, Pavlov's dog like, they're going to be conditioned to hit yes without thinking. People aren't paranoid even though people are out to get them.

    To rectify this problem Microsoft should make it clear during installation that the initial admin account shouldn't be used as the main account. This is not clear during the installation.

    Good things:

    - Internet Explorer's protected mode.
    - Making sure the heap is in a different place on each computer.
    - UAC is good for experienced or computer literate users (nobody else.

    Bad things:

    - UAC, in its present form, is just training computer illiterate people to click yes. There is an emphasis with a consumer operating system to educate the user. Not necessarily enforce (that would restrict freedom) but it should educate. All or nothing is not good.
    - Idiot reviewers thinking that an operating system is the largest contributory factor in the speed of a computer. Saying Vista is faster than XP when it's been run on a new, much faster computer, is a little like trading a saloon car for an Aston Martin and saying that the Aston Martin is faster because of the upholstery.
    • - UAC is good for experienced or computer literate users (nobody else.

      Yes and no.

      Maybe if UAC was less repetitive when first configuring Vista I'd agree, but to turn it off and then turn it back on when configured proves that computer savvyists don't need it, but afterwards it may save our butts when we'll one day accidentally run an executable but get a warning.

      Computer illiterates on the other hand, they get bloatware on IE cause they click yes to accept and run any ActiveX and certificate bs so they'll d

Slashdot Top Deals

Heisenberg may have been here.

Close