stuart test blog

Looks like Vista’s UAC is getting another grilling on several security blogs at the moment. Security researcher, Joanna Rutkowska wrote a post going into detail about UAC and pointed out an obvious flaw that she discovered.

Seems that Vista detects setup executables when they are launched through a heuristics mechanism which checks for an installer manifest, as well as checking the executable name for strings such as “installer”, “setup”, “update”, etc. If UAC detects that a setup program has just been launched, it will provide a UAC prompt to elevate privileges to run the program. It does this for ALL installers, regardless of whether they need elevated privileges or not.

The flaw with this, if it’s not obvious yet, is that if you download a seemingly harmless setup program from the internet (Joanna uses a freeware version of Tetris as an example) then that setup program will run under full administrator privileges. This gives it God-like powers and even allows it to install kernel-mode drivers.

In my experience, most of the nasties that I have seen running on users’ computers – Trojans, spyware, keyloggers, dialers, etc – have mostly been installed surreptitiously through seemingly harmless applications like card games, screensavers, file sharing apps, and other common freeware programs. You would hope that the built-in spyware protection program, Windows Defender, would pick up the obvious nasties, but the fact that all of these apps will be installed under full administrator rights seems to defeat the purpose of UAC in the first place.

Mark Russinovich, who recently became a Microsoft employee, writes on his blog: “Because elevations and ILs don’t define a security boundary, potential avenues of attack , regardless of ease or scope, are not security bugs.” I have great respect for Mark’s opinion, but this seems like a copout to me – he’s saying that this method of getting around UAC can’t be called a security bug because it’s by design.

I’m not a fan of the way that Microsoft have implemented UAC, but I am a fan of the principles it tries to achieve. If Vista’s UAC can be defeated as easily as now it now seems, was it worth it all? Is a false sense of security better than no security at all?