Windows 7: Release Candidate 1 Preview
by Ryan Smith and Gary Key on May 5, 2009 11:00 PM EST- Posted in
- Systems
Reworking UAC
Predictably, one of the most common complaints about Vista was the User Access Control (UAC) feature, which firmly established a real degree of security in Vista by blocking applications from attaining administrator-level privileges by default. It was something that was long overdue for Windows given how easy it is to compromise a machine when everything runs with admin privileges, but that doesn’t mean it was taken well.
Half of the problem going into Vista’s release was that few applications were coded following best security practices, even though Microsoft had been recommending such a thing for years, and such practices were necessary for applications to work correctly under limited user accounts. With so many poorly coded applications misbehaving under Vista until they were brought up to spec by their developers, it left a bad taste in the mouths of many. Compounding the problem was that Vista’s UAC implementation was not streamlined very well, resulting in redundant notices. Microsoft resolved some of the streamlining issues in Vista SP1, but this never completely satisfied users who were expecting a more XP-like (and insecure) experience.
With Windows 7 we have an attempt at a compromise, which is a noble intention by Microsoft, but leaves us concerned about the security implications. Previously UAC could only be turned on or off (Group Policy settings not withstanding), which would sometimes result in unhappy users shutting it off and giving up most of Vista’s security abilities in the process. With Windows 7, UAC has now been divided up into four levels: Off, followed by three levels of increasingly strong security. Level 3 is the equivalent of Vista’s UAC mode, meanwhile Level 2 is the default setting for Windows 7. With Level 2, certain signed Microsoft applications (basically most of the Control Panel apps) are allowed to elevate to administrator privileges without needing user confirmation. The working belief here is that most people are encountering most of their UAC prompts when initially configuring Windows, and if they didn’t encounter those early prompts they would have no great reason to turn UAC off entirely, particularly since 3rd party applications are so much better behaved these days.
The UAC Control Panel With Level Slider
Hence the compromise is that UAC prompts are disabled, but only for the Control Panel apps, meanwhile all other regular apps are still controlled by UAC as normal. The concern we have with this compromise is that with applications allowed to auto-elevate from user to administrator, it creates a potential local privilege escalation exploit. For Beta 1, a proof of concept exploit was put together that used rundll32 to disable UAC entirely without informing the user or requiring their intervention. In return Microsoft removed the UAC control panel from the auto-elevating list so that any direct attempts to manipulate it still require user intervention. This blocked the proof of concept exploit while maintaining all the other benefits of Level 2 UAC. It should be noted however that similar exploits could still work with Level 1, as it’s Level 2 without the secure desktop screen (thereby allowing apps to fake pressing the Allow button).
At this point it remains to be seen if Level 2 could be exploited in a similar manner, such as by breaking out of another auto-elevated application and attacking UAC from there. The fact that it leaves an obvious potential attack vector open leaves us leery of Level 2. Microsoft had the security situation right in the first place with Level 3/Vista, and it may have been better if it stayed that way.
With that said, Level 2 does what it’s advertised to do. Compared to Level 3/Vista, you’re going to get far fewer UAC prompts when messing with Windows’ settings. Undoubtedly it won’t satisfy those who absolutely abhor UAC, but at some point Microsoft has done everything they can.
Quickly, the other security element that was reworked for Windows 7 is the Security Center, which has been expanded and renamed the Action Center. Besides being a one-stop-shop for various Windows security features, now it is also home to an overview of system maintenance tasks and troubleshooting help. This doesn’t significantly change the functionality of the Action Center, and the biggest change that most people will notice is the GUI.
The Windows 7 Action Center
Facebook
Twitter
RSS
121 Comments
View All Comments
izal169 - Thursday, July 2, 2009 - link
development of the technology is quite rapid. My computer specifications are not strong for Windows 7 that high quality. specification of my computer, intel core 2 duo, 1 Gb RAM, VGA Nvidia 7300 GS. microsoft is very cool. can make the OS with a relatively quick time.http://duitol.com/stop-dreaming-start-action/">http://duitol.com/stop-dreaming-start-action/
deteugma - Friday, June 5, 2009 - link
I was an XP diehard until I installed Windows 7. Now I'm a convert and a proselytizer. I love Windows 7. It will be the first version Windows that I actually buy for myself, rather than accept for free from a family member's employer (university license). MS won't have trouble winning converts from the diehard crowd.Biomorphic - Wednesday, May 27, 2009 - link
Windows 7 has software based audio processing just like Windows Vista and my question is, will VXP enable hardware based audio processing or will it remain software based?PC Reviewer - Monday, May 18, 2009 - link
it looks alright as long as its performance is as good as, if not better than xp's. Im looking to do a review about Windows 7 on my blog soon aswell. http://www.pcreviewer.org">http://www.pcreviewer.orgalon - Sunday, May 17, 2009 - link
First, I did not read all the comments, so if this has already been stated, I do apologize. For that matter, after the "Standard Test Bed" page I stopped reading the article. So .. maybe these issues have already been discussed.1) OK, so Vista x64 SP2 was released around May 11th (at least for my MSDN subscription, possibly earlier for others?) And it appears that the Windows 2008 SP2 bits were released around May
14th. I still don't see an SP2 installer, but I can do a clean install with SP2 already slipstreamed. So ... I've looked and looked, but I can not find an XP Pro x64 SP3 anywhere. And according to Microsoft around last September, there was not going to be an WinXP Pro x64 SP3. So ... if you do have this SP3 around ... please let me know what MSDN/TechNet or whatever subscription you have so I can upgrade mine ... or point me to the release page.
2) Concerning corporate IT ... one of the issues mentioned at the beginning of the article is the computing resources needed to run Vista ... which to me alludes to the fact that many companies chose not to upgrade to Vista based on HW requirements (of course Vista without Aero can run on many "lower" configurations, but of course the average company employee does not know this). I digress ... your test bed platform is not really anything that CorporateIT depts will be deploying. Core i7 ... released 7 months ago ... 6GB RAM. Please ... if you are going to try and "proove" that performance is decent with Windows 7 ... at least run some test systems that are not the toys we dream of, but the systems that are installed in the office. Until Microsoft and folks like you understand that companies can not afford to always buy new HW, the new OSs have to run on the last generation technology (actually more like HW from 2 years ago) ... your comparisons and results are useless ... and my 18month old Lenovo T61 does exactly what I need it to do. So, there would be no reason to upgrade to Win7 until MS End-of-lifes WinXP.
Razer2911 - Wednesday, May 13, 2009 - link
Moving on from Vista 32, I have to say i'm impressed. There are very subtle changes and tweaks which actually make the experience better. A simple example would be the new taskbar, Jump lists and Aero peek feature. I for one dont like a million windows open on my desktop, somehow i always found it cumbersome and cluttered but within a couple of hours of using Windows 7 i found myself using 10-15 windows without getting bothered by the clutter. Never used a Mac but these new features actually have both form and function.One thing that i have not been able to figure out as yet is that all my videos (divx) and movies look very grainy and slightly pixelated on WMP 12 and VLC.
tomb18 - Tuesday, May 12, 2009 - link
Support for canadian television in canada has always been limited in Media Center. Since HD digital over the air broadcasts (atsc)became available in the US, this has been supported in Media Center but not if you lived in Canada. Digital tuners are DISABLED by media center in all versions including Windows 7. This is in spite of the fact that canada uses the same ATSC system as the US. Many hacks have appeared but they always seem to be disabled by updates. This continues in Windows 7. As soon as the software determines that you reside in Canada, it disables the ATSC tuner.But get this. South Korea uses the same ATSC standard and it IS supported in that country.
There are a lot of forums (such as the green button, run by the media center developers)that discuss this to no avail. No amount of questions, emails, or anything will get a comment from Microsoft. Even when MSVP's try to take up the battle nothing gives.
There has been a lot of hope for Windows 7, that it would finally be supported, but alas, it is the status quo. My question is will Microsoft give a warning about the version of Windows 7 that contain media center for the canadian market telling canadians that their digital tuners will not work?
I really wish that some website with industry influence (hint...hint) would expose this pointing out to the canadian market that they should not buy Windows 7 if they want to use the media center.
AnnihilatorX - Tuesday, May 12, 2009 - link
Replace the function of minimising other windows with one that makes the window being shaked always on top. Now this is a useful function.Nevertheless I have been using AutoHotkey (automation programming platform) to assign Alt+z hotkey to make windows always on top in other windows. This is a feature I can't live without, along with Windows key + Scroll wheel on mouse to change transparency. These had help me multitask with different windows very efficiently.
rasmasyean - Sunday, May 10, 2009 - link
I think people might have over-estimated Vista as the OS that will sweep across the world and change computers as we know it over-night. It didn't exactly turn out as expected, but I don't think it doesn't seem it did too bad.Gartner research report predicted that Vista business adoption in 2008 will actually beat that of XP during the same time frame (21.3% vs. 16.9%)[80] while IDC had indicated that the launch of Windows Server 2008 served as a catalyst for the stronger adoption rates.[81][82] As of January 2009, Forrester Research had indicated that almost one third of North American and European corporations have started deploying Vista.[83]
http://en.wikipedia.org/wiki/Windows_Vista">http://en.wikipedia.org/wiki/Windows_Vista
compuser2010 - Sunday, May 10, 2009 - link
"Never underestimate the power of marketing – many people can tell you they don’t like Vista, few can tell you why."I don't like Vista primarily because of built-in Digital Rights Management (DRM). Any time I need to capture, edit and/or transcode audio and/or video, I need to go back to XP.
I have confirmed this with the following programs:
Audacity 1.2.6
Canopus EDIUS Broadcast 4.61
Creative Labs Smart Recorder 2.40.23
Moyea FLV to Video Converter Pro 2
Ulead DVD Workshop 2