Windows 7: Release Candidate 1 Preview

Reworking UAC

Predictably, one of the most common complaints about Vista was the User Access Control (UAC) feature, which firmly established a real degree of security in Vista by blocking applications from attaining administrator-level privileges by default. It was something that was long overdue for Windows given how easy it is to compromise a machine when everything runs with admin privileges, but that doesn’t mean it was taken well.

Half of the problem going into Vista’s release was that few applications were coded following best security practices, even though Microsoft had been recommending such a thing for years, and such practices were necessary for applications to work correctly under limited user accounts. With so many poorly coded applications misbehaving under Vista until they were brought up to spec by their developers, it left a bad taste in the mouths of many. Compounding the problem was that Vista’s UAC implementation was not streamlined very well, resulting in redundant notices. Microsoft resolved some of the streamlining issues in Vista SP1, but this never completely satisfied users who were expecting a more XP-like (and insecure) experience.

With Windows 7 we have an attempt at a compromise, which is a noble intention by Microsoft, but leaves us concerned about the security implications. Previously UAC could only be turned on or off (Group Policy settings not withstanding), which would sometimes result in unhappy users shutting it off and giving up most of Vista’s security abilities in the process. With Windows 7, UAC has now been divided up into four levels: Off, followed by three levels of increasingly strong security. Level 3 is the equivalent of Vista’s UAC mode, meanwhile Level 2 is the default setting for Windows 7. With Level 2, certain signed Microsoft applications (basically most of the Control Panel apps) are allowed to elevate to administrator privileges without needing user confirmation. The working belief here is that most people are encountering most of their UAC prompts when initially configuring Windows, and if they didn’t encounter those early prompts they would have no great reason to turn UAC off entirely, particularly since 3^rd party applications are so much better behaved these days.

The UAC Control Panel With Level Slider

Hence the compromise is that UAC prompts are disabled, but only for the Control Panel apps, meanwhile all other regular apps are still controlled by UAC as normal. The concern we have with this compromise is that with applications allowed to auto-elevate from user to administrator, it creates a potential local privilege escalation exploit. For Beta 1, a proof of concept exploit was put together that used rundll32 to disable UAC entirely without informing the user or requiring their intervention. In return Microsoft removed the UAC control panel from the auto-elevating list so that any direct attempts to manipulate it still require user intervention. This blocked the proof of concept exploit while maintaining all the other benefits of Level 2 UAC. It should be noted however that similar exploits could still work with Level 1, as it’s Level 2 without the secure desktop screen (thereby allowing apps to fake pressing the Allow button).

At this point it remains to be seen if Level 2 could be exploited in a similar manner, such as by breaking out of another auto-elevated application and attacking UAC from there. The fact that it leaves an obvious potential attack vector open leaves us leery of Level 2. Microsoft had the security situation right in the first place with Level 3/Vista, and it may have been better if it stayed that way.

With that said, Level 2 does what it’s advertised to do. Compared to Level 3/Vista, you’re going to get far fewer UAC prompts when messing with Windows’ settings. Undoubtedly it won’t satisfy those who absolutely abhor UAC, but at some point Microsoft has done everything they can.

Quickly, the other security element that was reworked for Windows 7 is the Security Center, which has been expanded and renamed the Action Center. Besides being a one-stop-shop for various Windows security features, now it is also home to an overview of system maintenance tasks and troubleshooting help. This doesn’t significantly change the functionality of the Action Center, and the biggest change that most people will notice is the GUI.

The Windows 7 Action Center