Windows 7 UAC Vulnerability [Updated]

Blogger Long Zheng has found and notified Microsoft about a flaw in the design of the UAC in Windows 7. His post states that...

"By default, Windows 7's UAC setting is set to "Notify me only when programs try to make changes to my computer" and "Don't notify me when I make changes to Windows settings". The Achilles' heel of this system is that changing UAC is also considered a "change to Windows settings", coupled with the new default UAC security level, would not prompt you if changed. Even to disable UAC entirely."

Microsoft has responded, and the response is a little shocking...

"This is not a vulnerability. The intent of the default configuration of UAC is that users don't get prompted when making changes to Windows settings. This includes changing the UAC prompting level."

Seems like it wouldn't be very hard to include a checkbox in the UAC settings to specify if we would like to be notified if changes are made to the UAC regardless of what level we have our UAC notifications set to. I wouldn't mind turning my UAC notifications to the highest level of security (and therefore protecting myself from unwanted UAC setting changes), but unfortunately I have a separate issue that prevents me from being able to use the "notify me when programs make changes to Windows settings" setting. The highest level of UAC security setting uses your video card to dim the screen, which, depending on your video card (my laptop video card isn't that great), can take a while to dim and undim the screen.

Perhaps if enough of us use the Send Feedback feature and bitch about it, MS might change their minds. Come on, Microsoft. Do the right thing here!

Update: Microsoft continues to see this as by design, since the malware has already made it onto the system, per their Windows 7 engineering blog post. They are honoring the line between Usability and Security. Too many people complained about the UAC prompt appearing too often in Vista, and so Microsoft's decision has now upset people who care about security. The issue of Usability and too many prompts being displayed, is caused by the fact that a majority of developers of apps for Windows have had the misconception of developing for a single user, the administrator. So now that Microsoft has introduced the UAC, naturally we are seeing more UAC prompts than we'd like. Over time, developers will program apps to run as standard users, and this problem will mitigate. So, perhaps those worried about Security will eventually get a more secure version of the UAC at some point in the future. For now, I'll continue to follow the bottom line, which is, "don't install/run something you don't trust".

Update: Microsoft admits they were wrong to deny security vulnerability in the UAC and will be fixing it. It's fantastic they are listening to us! THANK YOU MICROSOFT!

Update: Unfortunately there are still a couple vulnerabilities that haven't been publicly addressed by Microsoft. Hopefully they take care of these outstanding issues at some point, otherwise the UAC is pretty pointless. Sure it will protect you from older malware, but the fact is three people have already found backdoors to elevate privileges, and the Windows 7 beta has only officially been out for one month.