Is There an Even Bigger Security Hole in Windows 7's UAC?

Earlier this week, our own Josh Kamperschmidt told us how scripts could be used to disable Windows 7's UAC. Well, that's just the prelude to a potentially even bigger security issue: according to Long Zhen of the I Started Something blog, Windows 7's "improved" UAC can be disabled by malicious software that is coded for auto-elevation. Auto-elevation is a feature that enables software being run by Administrators to skip the annoying "do you want to run this program" prompt that has made Windows Vista's version of UAC one of its most controversial features, not to mention one of the "I'm a Mac" commercials' favorite targets. Unlike the proof-of-concept exploit reported earlier, this one doesn't prompt you to reboot the system: it works silently.

So, what is it about Windows 7's UAC that makes it vulnerable? As Zhen puts it:

Windows is a platform that welcomes third-party code with open arms. A handful of these Microsoft-signed applications can also execute third-party code for various legitimate purposes. Since there is an inherent trust on everything Microsoft-signed, by design, the chain of trust inadvertently flows onto other third-party code as well. A phenomenon I’ve started calling “piggybacking”.

To demonstrate, one of the many Microsoft-signed applications that can be taken advantage of is “RUNDLL32.exe”. With a simple “proxy” executable that does nothing more than launch an elevated instance of "RUNDLL32 pointing to a malicious payload DLL, the code inside that DLL now inherits the administrative privileges from its parent process "RUNDLL32" without ever prompting for UAC or turning it off.

Zhen recommends that you set Windows 7's UAC slider control to "Always Notify" as a workaround until Microsoft changes how UAC works in Windows 7. Unfortunately, making this change would make Windows 7's UAC just as annoying as Vista's.

Will Microsoft fix this apparent flaw in UAC? Or is it a flaw? The Engineering Windows 7 blog points out that Windows 7 is designed to stop malware from getting on the system in the first place [fixed bad link 2-5-09]. Before you decide what to do with UAC, take a look at both sides of the issue.