UAC flaws pshaw: disable admin rights to make Windows and IE safe

Fuggeddaboud Microsoft's crazy User Account Control. One security researcher has discovered that just by disabling admin rights, 92% of Microsoft vulnerabilities are cured, or at least the damage a hacker could do by exploiting them is severely limited, according to an article in Computerworld. Enterprise security company BeyondTrust says so -- of course, let's factor into its analysis that the company offers a product called Privilege Manager. Even still, BeyondTrust came to its numbers by looking at the individual vulnerabilities that Microsoft disclosed in 2008 and counting the number of times Redmond said that attacks could be thwarted (or the effects lessoned) on computers with fewer rights.

If that's the case, the simplest thing to do to make Windows desktops safe -- or at least safer -- is to configure computers so that users login as an ordinary user, not an administrator, and can't change that setting.

This news comes as a dose of reality during a week when Microsoft's technological attempts to solve the user rights issue has gotten a lot of bad press. Earlier this week, blogger Long Zheng wrote that he discovered a security flaw with UAC that allows an attacker to override Windows 7 UAC without the knowledge of the user. He also noted that the fix is to set Windows 7 to "always notify" -- which will only drive the user so crazy that the "always notify" setting will no doubt be quickly turned off. Microsoft fired back that the UAC override issue Zheng found is not a flaw but a part of UAC's intentional design. Reports VNUnet.com:

"The intent of the default configuration of UAC is that users do not get prompted when making changes to Windows settings," a company representative told vnunet.com. "This includes changing the UAC prompting level."

Zheng was not to be undone ... he wrote that he found a second problem with UAC in Windows 7.

"In summary, a second UAC security flaw in the Windows 7 beta’s default security configuration allows a malicious application to autonomously elevate themselves to full administrative privileges without UAC prompts or turning UAC off. A result I'm sure cannot be classified as 'by design'."

Perhaps a public boot in the backside by bloggers like Zheng will have Microsoft change the UAC. Perhaps not. Until then, enterprises may be able to save themselves a lot of agony by limiting user rights themselves.

Visit the Microsoft Subnet web site for more news, blogs, podcasts. Subscribe to all Microsoft Subnet bloggers.
Sign up for the bi-weekly Microsoft newsletter. (Click on News/Microsoft News Alert.)

Shareholder activist targets Microsoft
U.S. government may explore standardizing on open source
Microsoft layoff: Is excessive R&D spending to blame?
Windows 7: the untold story of how the enterprise gets snubbed
EU slaps Microsoft (again) for antitrust over IE bundled with Windows

• Microsoft
• UAC
• user access control
• Windows 7 security
• Windows 7 UAC flaw
• Windows UAC