Does anyone know, why MS does not consider UAC to be a security boundary? And what are the trade-offs involved with making it one? Is it not possible to make it a security boundary? It seems kinda anti-customer to say "if we find a security exploit in our code (in UAC) we won't fix it," doesn't it? I wish this would be fixed in Windows 7, but I admit I don't understand all the issues involved, so any help would be nice.
http://www.microsoft.com/technet/technetmag/issues/2007/06/UAC/default.aspx Right near the bottom. "James R. Gentile" wrote in message news:bK2dnfIw_fEv_k3VnZ2dnUVZ_judnZ2d@comcast.com... > Does anyone know, why MS does not consider UAC to be a security boundary? > And what are the trade-offs involved with making it one? Is it not > possible to make it a security boundary? It seems kinda anti-customer to > say "if we find a security exploit in our code (in UAC) we won't fix it," > doesn't it? I wish this would be fixed in Windows 7, but I admit I don't > understand all the issues involved, so any help would be nice.
Hi, Mark Russinovich explains it best in his presentation "Windows Security Boundaries". You can view it on technet spotlight here: http://www.microsoft.com/emea/spotlight/sessionh.aspx?videoid=993 -- Victor Constantinescu aka YounGun Security MVP http://victor-youngun.blogspot.com/ "James R. Gentile" wrote in message news:bK2dnfIw_fEv_k3VnZ2dnUVZ_judnZ2d@comcast.com... > Does anyone know, why MS does not consider UAC to be a security boundary? > And what are the trade-offs involved with making it one? Is it not > possible to make it a security boundary? It seems kinda anti-customer to > say "if we find a security exploit in our code (in UAC) we won't fix it," > doesn't it? I wish this would be fixed in Windows 7, but I admit I don't > understand all the issues involved, so any help would be nice.
Good article, and good video, thanks to both of you. "James R. Gentile" wrote in message news:bK2dnfIw_fEv_k3VnZ2dnUVZ_judnZ2d@comcast.com... > Does anyone know, why MS does not consider UAC to be a security boundary? > And what are the trade-offs involved with making it one? Is it not > possible to make it a security boundary? It seems kinda anti-customer to > say "if we find a security exploit in our code (in UAC) we won't fix it," > doesn't it? I wish this would be fixed in Windows 7, but I admit I don't > understand all the issues involved, so any help would be nice.
