UAC not a "security boundary."

[Guest James R. Gentile]

Does anyone know, why MS does not consider UAC to be a security boundary?

And what are the trade-offs involved with making it one? Is it not possible

to make it a security boundary? It seems kinda anti-customer to say "if we

find a security exploit in our code (in UAC) we won't fix it," doesn't it?

I wish this would be fixed in Windows 7, but I admit I don't understand all

the issues involved, so any help would be nice.

[Guest FromTheRafters]

http://www.microsoft.com/technet/technetma...AC/default.aspx

 

Right near the bottom.

 

"James R. Gentile" <no1@nowhere.net> wrote in message

news:bK2dnfIw_fEv_k3VnZ2dnUVZ_judnZ2d@comcast.com...<span style="color:blue">

> Does anyone know, why MS does not consider UAC to be a security boundary?

> And what are the trade-offs involved with making it one? Is it not

> possible to make it a security boundary? It seems kinda anti-customer to

> say "if we find a security exploit in our code (in UAC) we won't fix it,"

> doesn't it? I wish this would be fixed in Windows 7, but I admit I don't

> understand all the issues involved, so any help would be nice. </span>

[Guest Victor Constantinescu]

Hi,

Mark Russinovich explains it best in his presentation "Windows Security

Boundaries". You can view it on technet spotlight here:

http://www.microsoft.com/emea/spotlight/se...spx?videoid=993

 

--

Victor Constantinescu aka YounGun

Security MVP

http://victor-youngun.blogspot.com/

 

 

"James R. Gentile" <no1@nowhere.net> wrote in message

news:bK2dnfIw_fEv_k3VnZ2dnUVZ_judnZ2d@comcast.com...<span style="color:blue">

> Does anyone know, why MS does not consider UAC to be a security boundary?

> And what are the trade-offs involved with making it one? Is it not

> possible to make it a security boundary? It seems kinda anti-customer to

> say "if we find a security exploit in our code (in UAC) we won't fix it,"

> doesn't it? I wish this would be fixed in Windows 7, but I admit I don't

> understand all the issues involved, so any help would be nice. </span>

[Guest James R. Gentile]

Good article, and good video, thanks to both of you.

 

"James R. Gentile" <no1@nowhere.net> wrote in message

news:bK2dnfIw_fEv_k3VnZ2dnUVZ_judnZ2d@comcast.com...<span style="color:blue">

> Does anyone know, why MS does not consider UAC to be a security boundary?

> And what are the trade-offs involved with making it one? Is it not

> possible to make it a security boundary? It seems kinda anti-customer to

> say "if we find a security exploit in our code (in UAC) we won't fix it,"

> doesn't it? I wish this would be fixed in Windows 7, but I admit I don't

> understand all the issues involved, so any help would be nice. </span>