Russinovich in retreat over Windows Vista security claims

Despite the fact we were told that Windows Vista would be much more secure than Windows XP, Microsoft technical fellow Mark Russinovich is lowering the security expectations built into Vista, particularly User Account Control (UAC).

Russinovich, in a talk at last week’s CanSecWest security conference, made predictions for the future of malware and anti-malware developments. He said that in time hackers will become familiar with Vista, and will develop new exploits, so that viruses, password-stealing Trojans, and rootkits will continue to thrive and be a menace to Windows users.

Russinovich’s talk was intended to give professionals an idea on the implementation of UAC in Windows Vista and made it clear that the feature will stop malware from making changes to the operating system but it’s not a security boundary.

However, there is no guarantee that malware can’t hijack the elevation process or compromise an elevated application.

He predicted that malware would find ways of elevating its privileges, through social engineering or by compromising applications that run with higher privileges.

With the above disclosure, I believe it is only a matter of time before malware authors gain access to administrators’ data.

It seems all this is some kind of a joke. We all remember Microsoft’s statements about how serious Microsoft is about Vista security and how all those new cool security features like UAC would improve security.

Just learn to forget all the sugar coated statements about Vista security because Microsoft is in retreat over Windows Vista security claims.

• The truth about Windows Vista security
• Microsoft security claims on Vista can lull users into false sense of security
• Researcher reveals 2-step Microsoft Vista UAC hack
• Windows Vista poor security means business to a security researcher
• Windows Vista security programs fail detection tests