White hat hacker Joanna Rutkowska claims to have
discovered a gaping hole in the User Account Control (UAC) security
functionality of Windows Vista.
Microsoft admitted that many users ran Windows XP constantly using
the admin account, which provides unfettered access to all parts of
the system.
To help mitigate the security risks, Vista runs in a normal user
account by default and provides pop-up confirmation dialogues when
it needs to perform admin functions, such as modifying system
files.
Rutkowska discovered that when Vista detects that the user is
running an installation file it kicks into full admin mode.
If a user wishes to install a new program they are presented with
the option either to allow the installer complete system privileges
or not to run the program at all.
Rutkowska wrote on her
Invisible Things blog: "That means that if you downloaded some
freeware Tetris game, you will have to run its installer as
administrator, giving it full access to all your file system and
registry, and allowing it to load kernel drivers! Why should a
Tetris installer be allowed to load kernel drivers?
"I would like to be offered a choice whether to fully trust a given
installer executable (and run it as full administrator) or just
allow it to add a folder in C:\Program Files and some keys under
HKLM\Software and do nothing more.
"I could do that under Windows XP, but apparently I can't under
Vista, which is a bit disturbing."
A few days after her posting there was a lengthy and detailed
response from Mark Russinovich, a Technical Fellow at Microsoft.
Russinovich essentially admitted that, while the problem exists, it
was a design choice that stemmed from the balance between security
and usability.
"Because elevations and integrity levels do not define a security
boundary, potential avenues of attack, regardless of ease or scope,
are not security bugs, " he said.
In light of the huge security campaign surrounding Windows Vista in
2006, Rutkowska said in a follow up posting that this explanation
simply is not good enough and that Microsoft should attempt to
solve the problem rather than try and dismiss the issue.