Win7 User Account Control (UAC) Ineffective: Sophos

One of the most visible changes in Windows 7 is that the User Account Control (UAC) system has been made less irritating than with Vista. However, a security firm says that less hassle comes with a price.

The UAC system, which debuted in Vista, means that once installed, software is not automatically able to run without restraint. Instead, when it wants to perform an action which will change Windows itself, a pop-up box asks the user for permission. The user must be logged in under an administrator account to give this permission.

Vista Users: UAC Most Annoying

The idea was to put a block on software which had been installed without the user's knowledge (for example, by a virus or 'drive-by download') and prevent it doing serious damage. However, many users found they encountered the pop-up boxes so often that it caused deep frustration and in some cases left them simply clicking 'yes' to every question without checking first.

Windows 7 was tweaked so that fewer pop-up boxes would appear, an improvement that has factored into the operating system's thus far glowing reviews. However, Chester Wisniewski of security firm Sophos PLC believes that the changes mean the system is no longer effective.

Sophos: Win 7 UAC Finds only 12% Malware

He tested the revised UAC by attempting to run 10 pieces of malicious software which are currently circulating online. Two of these failed to run at all, apparently because they were designed solely for XP and Vista (making it a rare example of a welcome incompatibility issue). Of the remaining eight, only one triggered a UAC prompt. The rest were able to run without further question. (Source: computerworld.com)

Test Scenarios are Possible but Unlikely

Of course, this wasn't a scientific study. And it's worth remembering that the computer used in the test was intentionally stripped of any security software beforehand so that the UAC effect could be isolated. A decent antivirus or security package would have likely blocked the malware from running, and a combination of an effective firewall and sensible browsing behavior would have reduced the chances of it getting on the computer in the first place. (Source: yahoo.com)

But it is a demonstration that the UAC system is a balancing act between protecting the computer and not annoying the user. Wisniewski's view is that Windows 7 goes too far towards convenience. He suggests users change the UAC settings to their highest security levels and says the increased annoyance from pop-up boxes is simply the price of safety.