Microsoft under spotlight for Windows 7 security 'flaw'

A blogger warns of a possible security hole in the Windows 7 beta.

A security researcher has claimed that there is a major flaw in the Windows 7 beta which he alleges Microsoft is planning on leaving as is in the full version.

Long Zheng, security researcher and blogger for istartedsomething.com, says that there is a problem with the UAC (User Access Control), designed to monitor a computer and notify a user when a programme attempts to alter the system.

On the Windows Vista platform it was meant to protect against malware, but caused problems due to the barrage of pop-up dialogue boxes it created. Some users turned it off, effectively negating its existence.

On the Windows 7 Beta, UAC was changed so it could distinguish between third-party software and system applications by checking for security certificates. If the process or application has the right certificate it will not cause a prompt to appear.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

However, Zheng said the problem with the Windows 7 beta is that UAC can now be controlled through system settings and completely disabled without user interaction. He even posted 'proof' of his claims.

He said there was a simple fix to the problem, but claimed Microsoft had replied saying "it is not a vulnerability".

He said on the blog: "The whole reason why I had made the "issue" public was because private Windows 7 beta-testers were frustrated at how Microsoft treated their concerns, but it seems like it hasn't changed."

Zheng later updated his post, clarifying how the vulnerability can occur, adding that users must be in the "Administrative" user group, not just the "Standard" user group to be able to affect things.

At the time of writing, Microsoft had not responded to our request for comment on the issue.

Featured Resources

Digitally perfecting the supply chain

How new technologies are being leveraged to transform the manufacturing supply chain

Download now

Three keys to maximise application migration and modernisation success

Harness the benefits that modernised applications can offer

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

The 3 approaches of Breach and Attack Simulation technologies

A guide to the nuances of BAS, helping you stay one step ahead of cyber criminals

Download now
Advertisement

Recommended

Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/operating-systems/25802/17-windows-10-problems-and-how-to-fix-them
operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
Visit/microsoft-windows/32066/what-to-do-if-youre-still-running-windows-7
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
Visit/web-browser/30394/what-is-http-error-503-and-how-do-you-fix-it
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020
Visit/policy-legislation/general-data-protection-regulation-gdpr/354577/data-protection-fines-hit-ps100m
General Data Protection Regulation (GDPR)

Data protection fines hit £100m during first 18 months of GDPR

20 Jan 2020