Here’s a great article from ZDNet that relates how 8 out of 10 malware exploits bypass Windows 7’s UAC. That shouldn’t come as a surprise to anyone who read my previous blog post on the UAC. I offered that only two settings in the UAC had any meaning: Never notify and Always notify. Anything in between, like the default setting, only provide a false sense of security. Only “Always notify” offers any significant security. I wrote that about the beta version, but it appears to remain true in the final release, even though Microsoft claimed that they would fix the issues as I noted in this post. And don’t forget that you’re paying dearly for the privilege of testing these vulnerabilities in the real world.

Ubuntu anyone?