News Windows zero-day flaw bypasses UAC

http://www.bit-tech.net/news/bits/2010/11/26/windows-zero-day-flaw-bypasses-uac/1

 

So all vista users have been bugged by UAC for absolutely no reason? I loled

 

Bahahaha...since i first saw UAC i knew it was useless, if they just discovered it only God knows how long coders have been using it >.>

 

it was only time i guess, looks like MS needs to get a patch out quick smart.

 

The first thing I do with a new install of VIsta/W7 is turn that UAC crap completely off.

It's quite possibly more annoying than the viruses and adware.

 

I turned UAC off the same day I first installed Windows 7. I'd be pretty surprised if most people didn't.

 

I have yet to be bothered by UAC on Windows 7 apart from the installation. It s much better than it was in Vista. I don't see why people turn it off in 7.
And I am sure Microsoft will patch it soon. People have been using UAC for no reason? Nope, it works, and this is the first one to bypass it in how many years?

 

This is very serious indeed. It could bring total control to attacker and lock all other users from using anything.

Only remedy is to shutdown the PC now and never start it again or unplug Ethernet/wifi until patch is made available now...

All joking aside, this could produce mall-ware that even surpasses the incredibly hard to remove "fake anti virus" mall-ware.

 

Well so long as your Anti-Virus recognises the trojan and blocks it you should be safe.

Might be worth checking which AV softwares recognises it and which don't.

 

LOL at Jamie's post!

I agree though - UAC is annoying as heck and I also turn it straight off once (re)installing Windows.

I'd imagine it'll be fixed by Microsoft fairly quickly, anywhoo.

 

Sry double post accident.

 

Same here.

 

Well they can't leave people sitting around until 14th December to sort this one out. Doesn't mean they won't, MS tends to take its own merry time over things. Always used to turn UAC off but because of reinstalling so often recently, left it on - if it's pointless at the moment, may get back to leaving it off.

 

windows 7 uac is the most anoying piece of cr@p i have ever had the misfortune to have installed on my pc

viruses included

a decent firewall that asks your permision to allow programs to accses certain programs and files will definatly block this easily

becaue in order to use this it will have to run and when that happen programs like comodo will be all over it


i pitty any fool who thinks uac and an antivirus is enough (most antivirus programs are signiture bassed so they are useless agasint the worst ones)

 

What, you mean there's a way to get around UAC?

Please, infect me with this virus!

 

Standard practice I think!

 

I'm not really sure what people have against UAC. I keep it on its default setting and it hardly ever bothers me. Sure, it won't stop this particular exploit, but I'm sure it offers some degree of protection (if you don't blindly accept everything)

 

It breaks a lot of scripts, or at least makes it impossible to run them without just OKing a huge number of requesters, thus defeating the object of scripting. You can make the argument that "scripts shouldn't need admin rights" but unfortunately back in the real world, outside a computer science exam, the reality is that they often do. UAC in this scenario seems like Windows adopting absolutely the worst characteristics of Linux, which insists on behaving like everyone's desktop computer is a VAX mainframe from the early 80s and is an absolute disaster.

And on Windows you can't even fix it by typing "sudo bash" when you open a new command window.

 

i'm glad i'm a linux user, where it protects you better than UAC would without actually running anything. remember everyone - windows' popularity is a FACTOR why it gets so much malware, but it isn't the only reason. UAC does what unix based OSes do but its more intrusive (in a bad way) and its an actual program, and a good OS will run as few processes as possible to do whatever the user wants. uac has proved to make windows extremely safe to use, but relatively its still just not good enough, even before this incident.

 

Is PowerShell affected by that?