Microsoft response to UAC 'issue'

That is the most retarded response I've heard. There is no reason that Microsoft can't divide each control panel into user-configurable and system-configurable options like every other operating system. This is just passing the blame on to the user when Microsoft could prevent another attack point.

If they do this, then they need to do something along the lines of the "lock" system used in OS X (where the settings are unlocked/locked unless you explicitly click the lock and reverse the situation)

"So they are trying to tell us that it is our fault for introducing the malicious code unwittingly?" Um, that's the whole point with UAC. If you click "Continue" unwittingly, you only have yourself to blame if you don't understand the consequences. "Or are they blaming us for visiting questionable sites and/or acquiring software with risks?" Well, yes. The computer doesn't browse the internet by itself. Your antimalware software is what is supposed to notify you when malicious software is trying to take control of your machine though. "In order for malicious code to have gotten on to the box, something else has already been breached (or the user has explicitly consented)." That's the thing to remember. It is not UAC's job to monitor what is malicious or not. It's only there to address whether or not system-level settings are trying to be modified. BTW: You can blame all the reviewers that claimed that "Windows 7 is now less annoying" for this. Less annoying = less secure. That's the price you pay for trying to appease everyone. Be a good plumber, and just pull your pants up.

"especially since this probably won't take much effort to fix. Oh, well." That may be what the problem is. I know that sometimes things that seem simple are in fact not, and it may take some fundamental changes to implement. And it clearly is by design when you think about it, so they are technically right about that. However, it does seem to me to be a big potential problem that they should take care of.

Microsoft is still evil. They have not changed. http://www.robertnyman.com/2009/01/26/microsoft-force-installs-firefox-e...

"Absolutely not true. The more annoying something or someone is, the less likely people are to pay attention to what it/they are saying." So you're saying less annoying = more secure? Sorry, but you must be taking IT hints from Lindy on that one.... Look, the way that malware gets on the box is if the user actually allowed it. Since the software can't modify system settings by itself under the privilege level, the user would've purposefully launched it within the browser, or downloaded and executed it. At that point, the malware would've been able to drop the security settings because the app inherited admin privileges by the admin that ran it manually. To change this, Microsoft would have to code extra exclusions into UAC so that the UAC slider would need special exemptions to bypass UAC's policies. How do you code something to be exempt from it's own security policy? Create a safe list? That opens up a whole other can of worms. Look at what happens when a browser hijacker infects a system - it will add sites into IE's own safe list.

Lol Waethorn and your small time computer shop thinking/MS has the answer for everything. UAC is busted in 7. If I ever let Vista (never) or 7 touch my AD environment even Admins will be forced to use a password with UAC forced by a GPO. UAC is good, they just need to make it like OS X or Linux

I am willing to bet they make some changes so that this sort of breech does not happen.

@darkmax - the average user is supposed to use common sense and do his/her best not to get infected. I'm currently running Vista with UAC, however if I were to install something right now, click-through the little UAC prompt that told me I may be doing something retarded it could install itself as a driver, service or some other component requiring administrative access and change all the settings it likes. As for drive-by downloads: they were a major issue in pre-SP2 XP running IE6. They're not anymore. There's a reason there's an annoying little yellow bar that pops up at the top of your internet explorer when a file wants to download itself. MOREOVER: kindly recall that IE runs as a least privileged user and thus can't do jack to your system even if something does happen to compromise it. Finally, while I disagree with Microsoft's decision to change the default UAC level, do note that the option to change it to the strictest possible is still there. Long story short, I think the following quote still summarizes the situation perfectly: "Social engineering... because there is no patch for human stupidity."

You guys do know that UAC is not a security boundary right? Thus, why Microsoft stated what they have!

I don't understand this. First UAC was too annoying, now that everybody has complained about and Microsoft decided to change it, it's broken. Like it's says in the statement: "This is not a vulnerability. The intent of the default configuration of UAC is that users DON'T GET PROMPTED when MAKING CHANGES to Windows settings" So if you write a script to change windows settings and you have the UAC settings not to prompt when you make changes, what do you expect!! Everybody complained about UAC, now that it has been changed Microsoft isn't doing it's job. Come on people. You asked for this. Now who's fault is it?? And I do understand why Microsoft would say that something else would have been breach for malware to be on the system. Ask any IT how many people just install crap on there computer. And blame Microsoft for getting all sorts of malware. For me UAC was fine like it was in vista. It protected people who didn't have a clue on what is good and what is not. The only change they had to make, could have not to darken the whole screen, that's it.

It seems simple to fix. Require full admin rights to move the damn slider. Of course people will whine but they did the right thing with Vista and idiots either turned it off,(if they could) or complained. If MS doesn't fix this someone, like Norton with their UAC utility will. But companies are like everyone else, the pendulum swings toward secure and they get slammed for UAC, They try to "fix" UAC and the security geeks complain.

It's very clear that Microsoft's explanation is quite correct. Period. End of story. It was more than a bit alarmist to have presented the original "vulnerability" in the context of some kind of breach or flaw. Since UAC was originally announced its role and function within user space has been clear and this nonsense that it is a boundary has to stop. It is an alerting mechanism designed to inform the logged user of impending changes - and nothing more. Similarly, the idea that what appear to be similar functions in OS X and other *nix are somehow superior, seems silly - they are entirely different things. On the *nix privilege elevation takes place and persists opposite a simple read, write, execute model. Unlike on Windows where UAC may be exposed to policy objects and much more granular control, OS X and other *nix adhere to an archaic model that is not only less secure, it is far more difficult to manage centrally. I can imagine that more than one fist found its way to slamming more than one desk up in Redmond when this matter was presented here and elsewhere as it was. I was equally miffed - explaining things in a way small business customers understand well is hard enough and that kind of rubbish made 07 and 08 hard enough on partners in the channel with Vista. As an industry, we have to beg two things: "If you do not know what you're writing about, don't publish it" and "if you do not know what you are talking about, ask questions." - less clickety clickety and more journalism, please.

@subzerohitman I believe you can get the Norton UAC tool stand alone .http://www.nortonlabs.com/inthelab/uac.php I have to say after being a Norton hater for years the 2009 version is quite good. I think it might use less resources than the new AVG with seemed to have gained a little bloat. If I pay for security software I like Eset NOD 32 been using it for years, and it has always done a good job.

"This is not a vulnerability. The intent of the default configuration of UAC is that users don’t get prompted when making changes to Windows settings. This includes changing the UAC prompting level." This is an example of if you say something with sufficient self-confidence and assertiveness it will cause others to suspend common sense and agree, but it's still wrong. In fact it's offensively stupid.