News

Windows 7's UAC Slammed by Sophos

How useful is user account control feature?

• By Jabulani Leffall
• 11/13/2009

Microsoft and software security firm Sophos are at it again, this time arguing about the effectiveness of Windows 7's user account control (UAC) feature.

UAC is an administrative access control that provides security warnings to end users each time a system change is about to be made. It first showed up in Vista and Windows Server 2008, enabling better administrative control of user network privileges. Microsoft refined the UAC in Windows 7 after users complained about seeing annoying pop-ups.

However, the issue for Chester Wisniewski, a Sophos security staffer, was purely about the security protection afforded by UAC in Windows 7. "UAC's default configuration is not effective at protecting a PC from modern malware," Wisniewski wrote in a Sophos blog post last week.

Sophos came to that conclusion based its testing of UAC. Those tests involved a clean install of Windows 7, running it without antivirus protection. Next, the Sophos team added "10 unique samples" of malware to the PC. The UAC failed to block eight of the 10 viruses from running, according to the blog.

Paul Cooke, Microsoft's director of Windows enterprise client security, responded to Sophos' claims in a blog post this week.  Cooke pointed out that malware usually gets onto a workstation via Web browsers. Had the malware been encountered via Internet Explorer 7 or IE 8, those browsers would have notified the users of the threat via Microsoft's SmartScreen filter prior to download. Cooke claimed that Sophos' test results are skewed because the samples were apparently just added to the computer and run.

However, Cooke did suggest a common ground for agreement, saying that Windows 7 shouldn't be run without antivirus software. He accused Sophos of grandstanding to sell its software, and inserted a plug for Microsoft Security Essentials, a free consumer antimalware solution that was rolled out in late September.

"While, I'm not a fan of companies sensationalizing findings about Windows 7 in order to sell more of their own software, I nevertheless agree with them that you still need to run anti-virus software on Windows 7," Cooke wrote. "This is why we've made our Security offering available for free to customers."

Sophos makes security solutions for small businesses and the enterprise, so the consumer-oriented Microsoft Security Essentials isn't supposed to be a direct competitor to Sophos' products.

The UAC spat is just the latest disagreement between Sophos and Microsoft. In September, a Sophos official complained about the security of XP Mode, a virtualized Windows XP desktop that runs on Windows 7. In that discussion, the Sophos official called XP Mode "a potential security disaster."