Microsoft tweaks security after Windows 7 feedback

gallery

Windows 7 engineers have listened to user feedback and will deliver changes to the Release Candidate which involves the UAC (User Access Control) system.

According to senior vice presidents Jon DeVaan and Steven Sinofsky, writing in the Windows 7 engineering blog, Microsoft will deliver two changes to UAC.

The first is that the UAC control panel will run in a 'high integrity' process which requires elevation, preventing certain security attacks from working. However, the vice presidents said that this was already in the works and is a bug fix.

The second will now mean in the Release Candidate that changing the level of the UAC will lead to a prompt for confirmation. This is directly due to user feedback after the ‘vulnerability’ was revealed.

The main problem was that testers thought the UAC could be changed without the user knowing about it, which could leave the platform open to malware.

DeVaan and Sinofsky added: “We also don’t want to create a sense or expectation of security that is not there – you should still not download code and run it unless you trust the source.”

They added: “HTML, EXE, VBS, BAT, CMD and more are all code and all have the potential to alter the environment (user settings, user files) running as a standard user or administrator.”

Email to a friend

Print this page