Hacker highlights gaping Vista security hole

Windows Vista

White hat hacker Joanna Rutkowska claims to have discovered a gaping hole in the User Account Control (UAC) security functionality of Windows Vista.

Microsoft admitted that many users ran Windows XP constantly using the admin account, which provides unfettered access to all parts of the system.

To help mitigate the security risks, Vista runs in a normal user account by default and provides pop-up confirmation dialogues when it needs to perform admin functions, such as modifying system files.

Rutkowska discovered that when Vista detects that the user is running an installation file it kicks into full admin mode.

If a user wishes to install a new program they are presented with the option either to allow the installer complete system privileges or not to run the program at all.

Rutkowska wrote on her Invisible Things blog: "That means that if you downloaded some freeware Tetris game, you will have to run its installer as administrator, giving it full access to all your file system and registry, and allowing it to load kernel drivers! Why should a Tetris installer be allowed to load kernel drivers?

"I would like to be offered a choice whether to fully trust a given installer executable (and run it as full administrator) or just allow it to add a folder in C:\Program Files and some keys under HKLM\Software and do nothing more.

"I could do that under Windows XP, but apparently I can't under Vista, which is a bit disturbing."

A few days after her posting there was a lengthy and detailed response from Mark Russinovich, a Technical Fellow at Microsoft.

Russinovich essentially admitted that, while the problem exists, it was a design choice that stemmed from the balance between security and usability.

"Because elevations and integrity levels do not define a security boundary, potential avenues of attack, regardless of ease or scope, are not security bugs, " he said.

In light of the huge security campaign surrounding Windows Vista in 2006, Rutkowska said in a follow up posting that this explanation simply is not good enough and that Microsoft should attempt to solve the problem rather than try and dismiss the issue.