Windows 7's UAC Slammed by Sophos

Microsoft and software security firm Sophos are at it again, this time arguing about the effectiveness of Windows 7's user account control (UAC) feature.

UAC is an administrative access control that provides security warnings to end users each time a system change is about to be made. It first showed up in Vista and Windows Server 2008, enabling better administrative control of user network privileges. Microsoft refined the UAC in Windows 7 after users complained about seeing annoying pop-ups.

However, the issue for Chester Wisniewski, a Sophos security staffer, was purely about the security protection afforded by UAC in Windows 7.

"UAC's default configuration is not effective at protecting a PC from modern malware," Wisniewski wrote in a Sophos blog post last week.

Sophos came to that conclusion based its testing of UAC. Those tests involved a clean install of Windows 7, running it without antivirus protection. Next, the Sophos team added "10 unique samples" of malware to the PC. The UAC failed to block eight of the ten viruses from running, according to the blog.

Paul Cooke, Microsoft's director of Windows enterprise client security, responded to Sophos' claims in a blog post this week.

Cooke pointed out that malware usually gets onto a workstation via Web browsers. Had the malware been encountered via Internet Explorer 7 or IE 8, those browsers would have notified the users of the threat via Microsoft's SmartScreen filter prior to download. Cooke claimed that Sophos' test results are skewed because the samples were apparently just added to the computer and run.

However, Cooke did suggest a common ground for agreement, saying that Windows 7 shouldn't be run without antivirus software. He accused Sophos of grandstanding to sell its software, and inserted a plug for Microsoft Security Essentials, a free consumer antimalware solution that was rolled out in late September.

"While, I'm not a fan of companies sensationalizing findings about Windows 7 in order to sell more of their own software, I nevertheless agree with them that you still need to run anti-virus software on Windows 7," Cooke wrote. "This is why we've made our Security offering available for free to customers."

Sophos makes security solutions for small businesses and the enterprise, so the consumer-oriented Microsoft Security Essentials isn't supposed to be a direct competitor to Sophos' products.

The UAC spat is just the latest disagreement between Sophos and Microsoft. In September, a Sophos official complained about the security of XP Mode, a virtualized Windows XP desktop that runs on Windows 7. In that discussion, the Sophos official called XP Mode "a potential security disaster."

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

comments powered by Disqus


  • Entity Framework Core 6: What Developers Want

    Microsoft outlined its plan for Entity Framework Core 6, which in November will take its place as the data access component of the landmark .NET 6, a long-term support (LTS) release that will mark Microsoft's transition from the Windows-only .NET Framework to an open source, cross-platform umbrella offering of all things .NET.

  • AWS Open Sources .NET Porting Assistant GUI

    After previously open sourcing components of its Porting Assistant for .NET, Amazon Web Services open sourced the tool's GUI.

  • .NET Core Ranks High Among Frameworks in New Dev Survey

    .NET Core placed high in a web-dominated ranking of development frameworks published by CodinGame, which provides a tech hiring platform.

  • Here's a One-Stop Shop for .NET 5 Improvements

    Culled from reams of Microsoft documentation, here's a high-level summary of what's new for performance, networking, diagnostics and more, along with links to the nitty-gritty details for those wanting to dig in more.

Upcoming Events