Researchers Release Windows 10 Uac Malware Information

Windows 10 is an operating system that offers increased security among other cool things. However, the improved security features are not perfect as a new vulnerability has been found, and it could open the operating system to malware attacks.

Ironically, the issue has to do with the Windows User Account Controls (UAC), something designed to help Windows block unwanted software and malware.

Security researchers, Matt Nelson and Matt Graeber, were the ones to discover the flaw, and ultimately made it known via the website, Enigmaox3. It details how Windows 10’s SilentCleanup processed can be used by attackers to allow malware to slip through the UAC gate and enter your computer.

Security researchers tend to recommend that computer owners never use their administrator account for daily computer use since it opens them to the possibility of more attacks, but it doesn’t matter in this regard. You see, UAC and Windows 10’s SilentCleanup process, runs with the highest level of power, so it wouldn’t matter which account you’re using.

Matt Graeber (@mattifestation) and I recently dug into Windows 10, and discovered a rather interesting method of bypassing User Account Control (if you aren’t familiar with UAC you can read more about it here). Currently, there are a couple of public UAC bypass techniques, most of which require a privileged file copy using the IFileOperation COM object or WUSA extraction to take advantage of a DLL hijack. You can dig into some of the public bypasses here ([email protected]). The technique covered in this post differs from the other methods and provides a useful alternative as it does not rely on a privileged file copy or any code injection.

Graeber and Nelson said they reported the issue to Microsoft, but the company responded by saying it is not a security problem. Apparently, UAC, to Microsoft, is not security measure hence why the company does not view the problem as a security measure.

Microsoft is either bluffing or the researchers are wrong. However, what is certain right now is that the company has no choice but to release a fix for UAC because it is now out in the open for the entire public to see.