Windows 7's UAC Slammed by Sophos

Microsoft and software security firm Sophos are at it again, this time arguing about the effectiveness of Windows 7's user account control (UAC) feature.

UAC is an administrative access control that provides security warnings to end users each time a system change is about to be made. It first showed up in Vista and Windows Server 2008, enabling better administrative control of user network privileges. Microsoft refined the UAC in Windows 7 after users complained about seeing annoying pop-ups.

However, the issue for Chester Wisniewski, a Sophos security staffer, was purely about the security protection afforded by UAC in Windows 7.

"UAC's default configuration is not effective at protecting a PC from modern malware," Wisniewski wrote in a Sophos blog post last week.

Sophos came to that conclusion based its testing of UAC. Those tests involved a clean install of Windows 7, running it without antivirus protection. Next, the Sophos team added "10 unique samples" of malware to the PC. The UAC failed to block eight of the ten viruses from running, according to the blog.

Paul Cooke, Microsoft's director of Windows enterprise client security, responded to Sophos' claims in a blog post this week.

Cooke pointed out that malware usually gets onto a workstation via Web browsers. Had the malware been encountered via Internet Explorer 7 or IE 8, those browsers would have notified the users of the threat via Microsoft's SmartScreen filter prior to download. Cooke claimed that Sophos' test results are skewed because the samples were apparently just added to the computer and run.

However, Cooke did suggest a common ground for agreement, saying that Windows 7 shouldn't be run without antivirus software. He accused Sophos of grandstanding to sell its software, and inserted a plug for Microsoft Security Essentials, a free consumer antimalware solution that was rolled out in late September.

"While, I'm not a fan of companies sensationalizing findings about Windows 7 in order to sell more of their own software, I nevertheless agree with them that you still need to run anti-virus software on Windows 7," Cooke wrote. "This is why we've made our Security offering available for free to customers."

Sophos makes security solutions for small businesses and the enterprise, so the consumer-oriented Microsoft Security Essentials isn't supposed to be a direct competitor to Sophos' products.

The UAC spat is just the latest disagreement between Sophos and Microsoft. In September, a Sophos official complained about the security of XP Mode, a virtualized Windows XP desktop that runs on Windows 7. In that discussion, the Sophos official called XP Mode "a potential security disaster."

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

comments powered by Disqus


  • Telerik UI for Blazor Updated

    Progress announced an update to its Telerik UI for Blazor components, targeting Microsoft's open source Blazor framework that lets C# coders create web apps without having to rely upon JavaScript.

  • Infragistics Unveils UI Components for Blazor

    Infragistics, specializing in third-party UI/UX controls and tools, unveiled a new offering targeting Blazor, Microsoft's red-hot open source framework that allows for C#-based web development instead of traditional mainstay JavaScript.

  • AWS Open Sources Tool for Porting .NET Framework Apps to .NET Core

    Leading cloud computing platform Amazon Web Services open sourced the it announced in July for helping users port old .NET Framework applications to the new .NET Core framework.

  • Uno Platform Ports Windows Calculator to Linux

    Uno Platform has ported the famed Windows Calculator, open sourced last year, to Linux as part of a continuing "proof point" effort to demonstrate the reach of what it describes as the sole UI offering available to target Windows, WebAssembly, iOS, macOS, Android and Linux with single-codebase applications coded in C# and XAML.

  • ASP.NET Core OData 8 Preview Supports .NET 5, but with Breaking Changes

    ASP.NET Core OData, which debuted in July 2018, is out in a v8.0 preview that for the first time supports the upcoming .NET 5 milestone release.

Upcoming Events