Microsoft: Vista Security No Magic Bullet After All

Much has been made of Microsoft's claims that Windows Vista is substantially better than prior generations of Windows at securing the PC and the data residing on it. But for the most part, those claims have not really been challenged, and Microsoft has skated by on the promise that security is better with Vista without really showing why. Well, says one executive, the reality may not quite live up to the promise.

The upshot is that Vista's security hopes are pinned on the "standard user environment" (which requires an elevated security setting to install software) and User Account Control (UAC), which any Vista user knows is that maddening pop-up that attacks you with an Are you sure you want to do this!?!? message every time you push a button on your keyboard or move the mouse. But seriously, the idea is that doing anything of substance on your computer (allowing access to that standard user environment) should require extra approval, and UAC ought to catch malware when it trys to do the same thing underhandedly.

The problem, it turns out, is that UAC can, in all likelihood, be bypassed by malware creators. From the linked story, Microsoft's Mark Russinovich notes, "[UAC is] a best effort to raise the bar and stop malware from making changes to the operating system but it's not a security boundary."

In other words, we're safe for now... until the hackers figure out a way to bypass it. Which is, frankly, inevitable. 

UAC has other problems, too. At its simplest, hackers could simply trick you into clicking "allow" when malware strikes. And then there's the more obvious fact that nearly every Vista user turns UAC off within a day of installing the OS because it's such a nuisance. (If you're still using UAC, please chime in here.)

The days of Vista malware (try searching the web for "vista hacked") are only a matter of time... best prepare for it now. 

LINK: Russinovich: Malware will thrive, even with Vista's UAC