UAC Bypassable or not?

[ifacedown]

Ok folks...

UAC "front Door of house with a Guard".... Unpatched windows, "Hole in a wall of the back of the house" behind the guard.....

Make sense yet?

Even if you have the best internet security there is, and you do not keep your windows patched, you will become eventually infected.

Hello,

Do you mean that not updating Windows would also mean making the UAC not effective as Microsoft meant it to be?

Do you mean to say that an outdated Windows would make UAC less effective against newly-written malware, thus making those malware capable of bypassing UAC?

Do you mean to say that Windows and UAC are dependent of each other:

Updating Windows would mean maximizing UAC's protection/abilities;
Updating Windows would mean also updating UAC?

Please I need answers. I am not knowledgeable about UAC.

Thanks in advance.

 

[illumination]

Hello,

Do you mean that not updating Windows would also mean making the UAC not effective as Microsoft meant it to be?

Do you mean to say that an outdated Windows would make UAC less effective against newly-written malware, thus making those malware capable of bypassing UAC?

Do you mean to say that Windows and UAC are dependent of each other:

Updating Windows would mean maximizing UAC's protection/abilities;
Updating Windows would mean also updating UAC?

Please I need answers. I am not knowledgeable about UAC.

Thanks in advance.

A couple of years ago, there was a bug dubbed the "nightmare" bug. It was a unpatched vulnerability in the windows kernel that could be used by attackers to sidestep the UAC.

So to answer your question, yes it is possible to be exploited with a unpatched system, and have the UAC bypassed.

 

[ifacedown]

A couple of years ago, there was a bug dubbed the "nightmare" bug. It was a unpatched vulnerability in the windows kernel that could be used by attackers to sidestep the UAC.

So to answer your question, yes it is possible to be exploited with a unpatched system, and have the UAC bypassed.

Okay, thank you.

 

[nissimezra]

I'm a landed immigrant and when we first came here i did use pentium 4 pc's now I have win 7 with duel core and core 2 duo, my oss are good enough to run updates but I don't see the point of getting bothered with updates and why

I'm fully backed up
getting infection no big deal for me at all (I even enjoy playing with it)
I am not using online banking.
And it takes only 20 minute to recover my OS

To run auto update and getting bothered with UAC doesn't worth it, assuming I'll get infected once a year, anyway it's a good idea to restore image once a year.

Telling me to update the system coz i may get infected with bios virus is the same as i will tell not to leave home you might get infected with deadly virus.

 

[cruelsister]

It's actually shocking to me that some will decide to go with unpatched systems; don't know what else to say on that topic. However please don't relate any given Windows patch with the efficacy of UAC- one really has nothing to do with the other.

UAC is pretty much just a way to dissuade users from running Windows as Administrators. If any given application (malware or not) requests admin privileges you will get an alert; so for such as various installers. uninstallers, anything trying to screw with system files, and anything that "needs a list" of files in order to operate (things like Taskmanager, Killswitch, malwarebytes- basically anything that can be termed a System Utility) will result in an alert.

That being said, understand that malware can also work very well in Standard mode. Something simple that can, when run, create a Startup link to itself will operate quite effectively as UAC will be blind to it. For example the below Winlock sample will create such a link to itself that will actually preferentially start the malware over Windows (as well as Safe Mode) and connect to some ransom site in Ukraine. Although easily removed via Safe Mode with Command Prompt, I hope all will agree that this constitutes an infection.

www.adrive.com/public/cyUdnz/Winlock.7z

(password: infected)

But although UAC in itself won't defend against a wide variety of malware, it will protect the system from some things that (some/most) AV's are oblivious to. For an example here, I posted a nasty scriptor (Cruelsister's Rootkit Analyzer) in Virus exchange a few months ago. The purpose of the malware was to delude a user into thinking a rootkit scan was being done when actually Windows system files were being deleted. It was shown that UAC in Win7 at default, and UAC in Win8 even at the Never Notify level would protect the computer from being trashed, whereas junk like FortiClient would not.

To make a long post even longer:

1). Don't expect more from UAC than it was created to do.
2). By all means use it.
3). Use a decent product to protect the system from malware that UAC ignores.
4). And for God's sake please keep the system patched!

 

[nissimezra]

It's actually shocking to me that some will decide to go with unpatched systems; don't know what else to say on that topic. However please don't relate any given Windows patch with the efficacy of UAC- one really has nothing to do with the other.

UAC is pretty much just a way to dissuade users from running Windows as Administrators. If any given application (malware or not) requests admin privileges you will get an alert; so for such as various installers. uninstallers, anything trying to screw with system files, and anything that "needs a list" of files in order to operate (things like Taskmanager, Killswitch, malwarebytes- basically anything that can be termed a System Utility) will result in an alert.

That being said, understand that malware can also work very well in Standard mode. Something simple that can, when run, create a Startup link to itself will operate quite effectively as UAC will be blind to it. For example the below Winlock sample will create such a link to itself that will actually preferentially start the malware over Windows (as well as Safe Mode) and connect to some ransom site in Ukraine. Although easily removed via Safe Mode with Command Prompt, I hope all will agree that this constitutes an infection.

www.adrive.com/public/cyUdnz/Winlock.7z

(password: infected)

But although UAC in itself won't defend against a wide variety of malware, it will protect the system from some things that (some/most) AV's are oblivious to. For an example here, I posted a nasty scriptor (Cruelsister's Rootkit Analyzer) in Virus exchange a few months ago. The purpose of the malware was to delude a user into thinking a rootkit scan was being done when actually Windows system files were being deleted. It was shown that UAC in Win7 at default, and UAC in Win8 even at the Never Notify level would protect the computer from being trashed, whereas junk like FortiClient would not.

To make a long post even longer:

1). Don't expect more from UAC than it was created to do.
2). By all means use it.
3). Use a decent product to protect the system from malware that UAC ignores.
4). And for God's sake please keep the system patched!

Thanks for the sample bro, I will play with.

I never said UAC is useless but i did say that it's possible for viruses to bypass it.
I'm not telling basic users not to use uac and auto update
But for someone who has solid knowledge and backup it is just doesn't worth the headache of running this.
and I'm not the only one my boss told me first of all make sure to,
Disable, UAC, firewall,
Enable remote desktop, and remote registry.
fully update the system.

Now I'm asking someone who work in this field not someone that play in forums this.

how many infected pc's with up to date os did you and how many that are not up to date?

The real answer should be almost the same.

 

[nissimezra]

OK. I see no point in trying to convince you to update your OS, but I have another (partial) solution.

Have you looked at Malwarebytes Anti-Exploit?

It's still in beta testing, so I recommend waiting for the final release, because I don't want you to run the risk of using the beta version for the next 5 years.
https://www.malwarebytes.org/antiexploit/

thanks bro
but no thanks.
I tried mabm pro, it sure has a good detection but man way to much false positive.
Hi my wife wanted to divorce me if I won't remove it from her pc.
It blocked all her russian sites.

 

[Ink]

MBAE isn't the same as MBAM, it doesn't block sites.

 

[nissimezra]

MBAE isn't the same as MBAM, it doesn't block sites.

thanks

for me mse was more then enough. It might be a good idea to use MABM but as i said i had no problem.

the problem is that mse detection rate not as good as it was, maybe I'll move to something else

 

[Nico@FMA]

I'm a landed immigrant and when we first came here i did use pentium 4 pc's now I have win 7 with duel core and core 2 duo, my oss are good enough to run updates but I don't see the point of getting bothered with updates and why

I'm fully backed up
getting infection no big deal for me at all (I even enjoy playing with it)
I am not using online banking.
And it takes only 20 minute to recover my OS

To run auto update and getting bothered with UAC doesn't worth it, assuming I'll get infected once a year, anyway it's a good idea to restore image once a year.

Telling me to update the system coz i may get infected with bios virus is the same as i will tell not to leave home you might get infected with deadly virus.

Hold on mister, let me put you back on your spot right away !!!!!!
Let me adress some of the things that i have said and what others have said, but more importantly the total lack of understanding from your side, Now before you consider this reply a personal attack please hear me out first ok?

No One is forcing you to update or use certain standards, but we strongly advise you to pay attention to what we say as we are here to help.
And if you make certain comments in the way you did well then you can expect a reply like this one:

It is totally true that backing up your OS can indeed restore your pc within 20 minutes, however the odds that you are going to lose data are reasonable considering you are wiping your HDD everytime you get infected.
Obviously because you are not using a AV program you have NO means of knowing that something is wrong unless your PC starts to act funny, or because you suddenly notice weird processes in your process list.
So which means that a virus on the background will totally slip your visual inspection, while the same virus can use your PC to conduct attacks upon, Routers, Networks, Other computers and webpages. (Yes even simple trojans can conduct such attacks) In the mean time a virus might use some of your computing power to assemble new virusses and malicous codes and spread them over the net, using a simple exploit check example: A simple trojan is running on your PC and is spamming Generic Trojans using specific exploit criteria then these little nifty relative harmless trojans scan each connection your pc is going to make and if a targets comes by that is just as BAD configured like your computer then these trojans will hop over and make a call back to the original creator or bot network which will send a nice data package with a payload and then the fun really starts.

This is just a small example where YOU as ignorant user take part in a online crime. Let me say this ones: Currently there is no HARD law that will force a user to maintain his or her PC, however your contract with your ISP DOES mention that you are responisble for your end of the connection and that damages due to YOUR actions (Or lack of actions) might and probably will get you in harms way with your provider and eventually with the law.
As i mentioned before there are a few laws within the US and EU that are being accepted which will force you as end user to maintain a certain standard regarding your computer notable: Legit & Updated OS, Internet Security (FW+AV+AS) and Parental Controls (If you got kids)

These laws are NOT being made because the government want to censor your actions, but these kind of laws are being made because of people like you. Banks, Online Shops and general webpages suffer millions and millions of damages worldwide due to people like yourself.
Did you know that over 80% of all the online attacks are being done by infected home computers? And did you know that if your PC participates in such attack that by law you can end up in jail? You might say: Well ill just claim i did not know, wel its your responsibility to secure your PC and you failed to do so and thus you are just as guilty as the original attacker.
Look it up on the net, you might be suprised in how much trouble you can get.

So that being said let me point out you joined a active community which focusses in stopping online dangers and helping people who do not know how to secure their pc's there is loads of knowledge here so you might wanna pay a bit of attention to what people have to say here.

Telling me to update the system coz i may get infected with bios virus is the same as i will tell not to leave home you might get infected with deadly virus.

I sort of already replied to this, but let me say something directly here to these words you put down.
Yes i mentioned a BIOS virus as ONE of the hundereds if not thousands of examples how you might get infected, i assumed that you would have figured that out yet.
Anyway i find it shocking that you claim to have a pretty good understanding of your PC, yet we have to explain you everything TWICE and still you do not get it.
And to tell you the truth iam kinda annoyed when i come across people like you, because people like you are always the first to scream fire and murder if a Government, Instituut, Organisation or some other internet policy making company comes up with a new rule or protocol to secure the internet.
Then people scream murder and fire because their privacy and internet freedom is being limited, while those same people do not realize that for a huge part due to their own actions as a individual and as a group of internet users they are directly responsible for more then 60% of all the online damages in terms of dollars.
And thats the RAW truth hence why i know for a fact (Inside news) that for windows 8.1 there will be a update in the near future that will make disabling critical updates IMPOSSIBLE. So yes you still can sort of check and uncheck which updates you do want and which you do not want, however critical security and core updates will get installed regardless if you like it or not, also a system that will force you to use security software (Either supplied by MS or a thirt party) is being developed for windows 8+.
I personally do not know when the laws wil be put into place but in France, Germany and the Netherlands these laws have been accepted and i know for a fact that the EU and the US both working on a much bigger law.

Now if you read back everything i said then you might understand why we all make such a fuzz about the fact you are running your pc in the way you do.
Against the excuse by you that you do not know of any malware that can achieve a bios infection in the way i mentioned or a virus that can survive a low level format does not mean that there is no such virus.
Keep in mind your BIOS has its own memory outside your harddrive, so is your videocard and your CPU cache and firmW memory not to mention that your Harddrive itself has at least 4MB of memory that contain critical firmware and that is not subject to lowlevel format.
Also one of the survival tricks that some virusses have (Even the the less advanced ones) is a injection into your backup system without actually infecting it and a router injection with call back function. So you could get infected litterally before you even type your name into a brand new windows installation.

So you tell me if your actions are as sound as you think they are.

Do not think you will recieve much help in the future here on MT if you carry on with a system like that and with the comments you made.
Anyway if this is not clear to you then i am sure that one of the other members can explain you the things i tried to explain .
Cheers

 

[illumination]

Spoiler: Nicely Put

Hold on mister, let me put you back on your spot right away !!!!!!
Let me adress some of the things that i have said and what others have said, but more importantly the total lack of understanding from your side, Now before you consider this reply a personal attack please hear me out first ok?

No One is forcing you to update or use certain standards, but we strongly advise you to pay attention to what we say as we are here to help.
And if you make certain comments in the way you did well then you can expect a reply like this one:

It is totally true that backing up your OS can indeed restore your pc within 20 minutes, however the odds that you are going to lose data are reasonable considering you are wiping your HDD everytime you get infected.
Obviously because you are not using a AV program you have NO means of knowing that something is wrong unless your PC starts to act funny, or because you suddenly notice weird processes in your process list.
So which means that a virus on the background will totally slip your visual inspection, while the same virus can use your PC to conduct attacks upon, Routers, Networks, Other computers and webpages. (Yes even simple trojans can conduct such attacks) In the mean time a virus might use some of your computing power to assemble new virusses and malicous codes and spread them over the net, using a simple exploit check example: A simple trojan is running on your PC and is spamming Generic Trojans using specific exploit criteria then these little nifty relative harmless trojans scan each connection your pc is going to make and if a targets comes by that is just as BAD configured like your computer then these trojans will hop over and make a call back to the original creator or bot network which will send a nice data package with a payload and then the fun really starts.

This is just a small example where YOU as ignorant user take part in a online crime. Let me say this ones: Currently there is no HARD law that will force a user to maintain his or her PC, however your contract with your ISP DOES mention that you are responisble for your end of the connection and that damages due to YOUR actions (Or lack of actions) might and probably will get you in harms way with your provider and eventually with the law.
As i mentioned before there are a few laws within the US and EU that are being accepted which will force you as end user to maintain a certain standard regarding your computer notable: Legit & Updated OS, Internet Security (FW+AV+AS) and Parental Controls (If you got kids)

These laws are NOT being made because the government want to censor your actions, but these kind of laws are being made because of people like you. Banks, Online Shops and general webpages suffer millions and millions of damages worldwide due to people like yourself.
Did you know that over 80% of all the online attacks are being done by infected home computers? And did you know that if your PC participates in such attack that by law you can end up in jail? You might say: Well ill just claim i did not know, wel its your responsibility to secure your PC and you failed to do so and thus you are just as guilty as the original attacker.
Look it up on the net, you might be suprised in how much trouble you can get.

So that being said let me point out you joined a active community which focusses in stopping online dangers and helping people who do not know how to secure their pc's there is loads of knowledge here so you might wanna pay a bit of attention to what people have to say here.



I sort of already replied to this, but let me say something directly here to these words you put down.
Yes i mentioned a BIOS virus as ONE of the hundereds if not thousands of examples how you might get infected, i assumed that you would have figured that out yet.
Anyway i find it shocking that you claim to have a pretty good understanding of your PC, yet we have to explain you everything TWICE and still you do not get it.
And to tell you the truth iam kinda annoyed when i come across people like you, because people like you are always the first to scream fire and murder if a Government, Instituut, Organisation or some other internet policy making company comes up with a new rule or protocol to secure the internet.
Then people scream murder and fire because their privacy and internet freedom is being limited, while those same people do not realize that for a huge part due to their own actions as a individual and as a group of internet users they are directly responsible for more then 60% of all the online damages in terms of dollars.
And thats the RAW truth hence why i know for a fact (Inside news) that for windows 8.1 there will be a update in the near future that will make disabling critical updates IMPOSSIBLE. So yes you still can sort of check and uncheck which updates you do want and which you do not want, however critical security and core updates will get installed regardless if you like it or not, also a system that will force you to use security software (Either supplied by MS or a thirt party) is being developed for windows 8+.
I personally do not know when the laws wil be put into place but in France, Germany and the Netherlands these laws have been accepted and i know for a fact that the EU and the US both working on a much bigger law.

Now if you read back everything i said then you might understand why we all make such a fuzz about the fact you are running your pc in the way you do.
Against the excuse by you that you do not know of any malware that can achieve a bios infection in the way i mentioned or a virus that can survive a low level format does not mean that there is no such virus.
Keep in mind your BIOS has its own memory outside your harddrive, so is your videocard and your CPU cache and firmW memory not to mention that your Harddrive itself has at least 4MB of memory that contain critical firmware and that is not subject to lowlevel format.
Also one of the survival tricks that some virusses have (Even the the less advanced ones) is a injection into your backup system without actually infecting it and a router injection with call back function. So you could get infected litterally before you even type your name into a brand new windows installation.

So you tell me if your actions are as sound as you think they are.

Do not think you will recieve much help in the future here on MT if you carry on with a system like that and with the comments you made.
Anyway if this is not clear to you then i am sure that one of the other members can explain you the things i tried to explain .
Cheers

Absolutely beautiful! ^^^

 

[nissimezra]

Hold on mister, let me put you back on your spot right away !!!!!!
Let me adress some of the things that i have said and what others have said, but more importantly the total lack of understanding from your side, Now before you consider this reply a personal attack please hear me out first ok?

I'm not considering this reply as a personal attack. we are here to learn from
each other

No One is forcing you to update or use certain standards, but we strongly advise you to pay attention to what we say as we are here to help.
And if you make certain comments in the way you did well then you can expect a reply like this one:

It is totally true that backing up your OS can indeed restore your pc within 20 minutes, however the odds that you are going to lose data are reasonable considering you are wiping your HDD everytime you get infected.

Wrong! my personal data backed up regularly to another 2 pc's on my network, it is not likely at all that i lose data.
at least 2 more cloud backup's

Obviously because you are not using a AV program you have NO means of knowing that something is wrong unless your PC starts to act funny, or because you suddenly notice weird processes in your process list.

Wrong again! I am using AV software up to date.

So which means that a virus on the background will totally slip your visual inspection,

no! it is unlikly that a virus slip from my eyes. my friend you don't know what I know!

while the same virus can use your PC to conduct attacks upon, Routers, Networks, Other computers and webpages. (Yes even simple trojans can conduct such attacks) In the mean time a virus might use some of your computing power to assemble new virusses and malicous codes and spread them over the net, using a simple exploit check example: A simple trojan is running on your PC and is spamming Generic Trojans using specific exploit criteria then these little nifty relative harmless trojans scan each connection your pc is going to make and if a targets comes by that is just as BAD configured like your computer then these trojans will hop over and make a call back to the original creator or bot network which will send a nice data package with a payload and then the fun really starts.

search google for DNS rebinding attacks

This is just a small example where YOU as ignorant user take part in a online crime. Let me say this ones: Currently there is no HARD law that will force a user to maintain his or her PC, however your contract with your ISP DOES mention that you are responisble for your end of the connection and that damages due to YOUR actions (Or lack of actions) might and probably will get you in harms way with your provider and eventually with the law.
As i mentioned before there are a few laws within the US and EU that are being accepted which will force you as end user to maintain a certain standard regarding your computer notable: Legit & Updated OS, Internet Security (FW+AV+AS) and Parental Controls (If you got kids)

These laws are NOT being made because the government want to censor your actions, but these kind of laws are being made because of people like you. Banks, Online Shops and general webpages suffer millions and millions of damages worldwide due to people like yourself.
Did you know that over 80% of all the online attacks are being done by infected home computers? And did you know that if your PC participates in such attack that by law you can end up in jail? You might say: Well ill just claim i did not know, wel its your responsibility to secure your PC and you failed to do so and thus you are just as guilty as the original attacker.
Look it up on the net, you might be suprised in how much trouble you can get.

Man you are living on star wore dream. or on the 25th century

So that being said let me point out you joined a active community which focusses in stopping online dangers and helping people who do not know how to secure their pc's there is loads of knowledge here so you might wanna pay a bit of attention to what people have to say here.



I sort of already replied to this, but let me say something directly here to these words you put down.
Yes i mentioned a BIOS virus as ONE of the hundereds if not thousands of examples how you might get infected, i assumed that you would have figured that out yet.
Anyway i find it shocking that you claim to have a pretty good understanding of your PC, yet we have to explain you everything TWICE and still you do not get it.
And to tell you the truth iam kinda annoyed when i come across people like you, because people like you are always the first to scream fire and murder if a Government, Instituut, Organisation or some other internet policy making company comes up with a new rule or protocol to secure the internet.
Then people scream murder and fire because their privacy and internet freedom is being limited, while those same people do not realize that for a huge part due to their own actions as a individual and as a group of internet users they are directly responsible for more then 60% of all the online damages in terms of dollars.
And thats the RAW truth hence why i know for a fact (Inside news) that for windows 8.1 there will be a update in the near future that will make disabling critical updates IMPOSSIBLE.

maybe you don't know
it is already here, in windows 7 even if you disable auto update u still receive critical updates (not from services.msc) so even that I'm not turning on the updates i still receive critical.

So yes you still can sort of check and uncheck which updates you do want and which you do not want, however critical security and core updates will get installed regardless if you like it or not, also a system that will force you to use security software (Either supplied by MS or a thirt party) is being developed for windows 8+.
I personally do not know when the laws wil be put into place but in France, Germany and the Netherlands these laws have been accepted and i know for a fact that the EU and the US both working on a much bigger law.

Now if you read back everything i said then you might understand why we all make such a fuzz about the fact you are running your pc in the way you do.
Against the excuse by you that you do not know of any malware that can achieve a bios infection in the way i mentioned or a virus that can survive a low level format does not mean that there is no such virus.
Keep in mind your BIOS has its own memory outside your harddrive, so is your videocard and your CPU cache and firmW memory not to mention that your Harddrive itself has at least 4MB of memory that contain critical firmware and that is not subject to lowlevel format.
Also one of the survival tricks that some virusses have (Even the the less advanced ones) is a injection into your backup system without actually infecting it and a router injection with call back function. So you could get infected litterally before you even type your name into a brand new windows installation.

25th century

So you tell me if your actions are as sound as you think they are.

Do not think you will recieve much help in the future here on MT if you carry on with a system like that and with the comments you made.

I'm not here to get help my friend I'm here to give help yes to GIVE. search my user name on Israeli sites even microsoft itself you might learn one or tow things, u can use google translate

Anyway if this is not clear to you then i am sure that one of the other members can explain you the things i tried to explain .
Cheers

wow to long don't know where to start.

 

[ifacedown]

Okay, okay... so to make the questions on my mind short, the UAC, (with Windows updated or not), could be bypassed, right?

Many are saying UAC could be bypassed.

While some on this forum says it could never be.

 

[Nico@FMA]

Okay, okay... so to make the questions on my mind short, the UAC, (with Windows updated or not), could be bypassed, right?

Many are saying UAC could be bypassed.

While some on this forum says it could never be.

No UAC itself cannot directly be bypassed without your explicit authorization so right now there is NO malware known to the industry that can directly infect UAC.
However indirectly UAC can be turned down, by malware, for example UAC needs a few system files to work, most of them are considered critical by windows OS so they will be protected so a exploit (or other malware) cannot inject them, BUT as i said "most" as some of them can be injected directly and they can execute a harmfull code forcing your pc to reboot, and by forcing it it automaticly changes the base policy and security parameters within windows itself (Windows core is at its weakest & unprotected during shutdown and boot)
And this will be totally hidden from you, infact UAC will still show up as working it will even ask you in the same way as it did before infection if a program can run, however it does not have the stopping power and 90% of its ability to secure your system is totally gone.
Giving you the idea UAC is still working but in reality its just a cosmetic thing.

So the correct reply is that NO UAC cannot be turned of DIRECTLY but indirectly it certainly can.

Inregards to the UAC being updated or not, it is public knowledge that there where a few rootkits and specific exploits that could exploit some bugs in windows OS which would give them the ability to turn of UAC using bugs within the policy register.
MS released various patches to adress these critical bugs and thus UAC should be save from exploits. But that only applies to a updated windows.

If you are running stone age windows (aka vanilla or unpatched) then UAC and any other feature that windows did bring from your windows dvd should be VERY vulnerable to exploits and direct injections.

Thats being said on a updated windows UAC cannot be bypassed directly and it should be VERY rare that a malware can indirectly inject it. But that is more thanks to running windows update and proper security software.

On a unpatched windows is like a open briefcase in the middle of wallstreet with a 100 million dollar in it.
And in this scenario your UAC can be directly switched off using one of the 2000 known bugs in windows 7.
* Windows 7 shipped with 2000 known bugs. However offical MS figures indicate that after shipping another 11k bugs and exploits where patched (This means 1 out of 8 files in windows OS was open to exploits)
* Windows 2000 did have over 20000 known bugs during shipping.

So let me ask you a question: Do you think UAC can be bypassed?

Kind Regards Nico

 

[Nico@FMA]

Uhhhm after searching the net i actually found a SANS blog and SANS is a big name when it comes to testing and such.
And it seems that UAC can be bypassed using a exploit even on a patched windows however truth to be said it does require human intervention so its still not a standalone code that can infect UAC. Which means that my previous comment is still valid.
But in the near future it might not be valid anymore so i suggest you read the link i post.

However its still worth a read

Cheers

 

[Littlebits]

If you are one of those ignorant users that thinks everything can be fixed by reformatting you are wrong.
Reformatting just repairs your system but in this modern world with all of the personal data stored on a system there are many things that can not be fixed. If you use the web to pay bills, online shopping, social networking, share personal files, etc. all of this is exposed to any experienced hacker who wants your data if you fail to keep Windows Updated and don't have proper security and privacy features enabled.

Keeping Windows updated is just not about protecting your system, it is about protecting your personal property, your financial assets, your own personal security. If you love your family and want to keep them safe applying system updates, having security and privacy features enabled is a good start. Does anyone remember the story about the crazy professional hacker who murdered his victims chosen from using unpatched Windows? or about how many times users get their identity stolen and their bank accounts drained? some users get blackmailed because of pictures stolen from their systems or child porn planted on their system by a hacker which causes you to go to jail.

Unpatched Windows is a hacker's paradise, they can get whoever info that want very easy without you even knowing that they did.

There is only one acceptable excuse of not keeping Windows updated = Ignorance.

And yes if you don't keep Windows Updated then don't expect UAC to work with new exploits.
Microsoft patches bypasses with Windows Updates just like Sandboxie, Comodo, Online Armor and others release updates when bypasses are discovered.

Thanks.

 

[Littlebits]

Okay, okay... so to make the questions on my mind short, the UAC, (with Windows updated or not), could be bypassed, right?

Many are saying UAC could be bypassed.

While some on this forum says it could never be.

There is not anything that can not be hacked, the most common form of bypassing involves hacking using hack tools.
But there still is no known malware that uses this hacking method that target home users, only large companies, military and government agencies.

Thanks.

 

[Nico@FMA]

If you are one of those ignorant users that thinks everything can be fixed by reformatting you are wrong.
Reformatting just repairs your system but in this modern world with all of the personal data stored on a system there are many things that can not be fixed. If you use the web to pay bills, online shopping, social networking, share personal files, etc. all of this is exposed to any experienced hacker who wants your data if you fail to keep Windows Updated and don't have proper security and privacy features enabled.

Keeping Windows updated is just not about protecting your system, it is about protecting your personal property, your financial assets, your own personal security. If you love your family and want to keep them safe applying system updates, having security and privacy features enabled is a good start. Does anyone remember the story about the crazy professional hacker who murdered his victims chosen from using unpatched Windows? or about how many times users get their identity stolen and their bank accounts drained? some users get blackmailed because of pictures stolen from their systems or child porn planted on their system by a hacker which causes you to go to jail.

Unpatched Windows is a hacker's paradise, they can get whoever info that want very easy without you even knowing that they did.

There is only one acceptable excuse of not keeping Windows updated = Ignorance.

And yes if you don't keep Windows Updated then don't expect UAC to work with new exploits.
Microsoft patches bypasses with Windows Updates just like Sandboxie, Comodo, Online Armor and others release updates when bypasses are discovered.

Thanks.

Omg i was thinking that i did write a proper reply fitting the situation. But holy jeepers....
I could not have said it better.

 

[Cats-4_Owners-2]

Nico, Lb, both of you post so directly, ..and your very sharp & keenly influential minds got through to me. I, for one, double checked that I am, in fact, updated for all important updates on both our Windows systems 7 & 8, and suddenly have very little desire (anymore) to boot up the old XP.. sandboxed or not! Thank you both!

 

[Nico@FMA]

Nico, Lb, both of you post so directly, ..and your very sharp & keenly influential minds got through to me. I, for one, double checked that I am, in fact, updated for all important updates on both our Windows systems 7 & 8, and suddenly have very little desire (anymore) to boot up the old XP.. sandboxed or not! Thank you both!

Well if you are planning to create some groupies then make sure LB and me know in advance so we can hide under a rock.

Omg fanboys.... help...run...woman and childer first...lmao.

Just kidding, you know what buddy, none here on the forum wants to force anything, its just that its always the same people registering with problems, and when push comes to shove then it turns out they pretty much "invited" a whole zoo of virusses.

In regards to you, you are alright and i have full confident that you will do the right thing.
But thanks for the compliment and i am more then happy that at least one person did take the trouble to read what LB and me said.

Mission accomplished.

Cheers