Windows 7 UAC code-injection vulnerability 'screencast, source code' Released

All of this only affects the default account type and UAC level of Windows 7 (builds 7000 & 7022, but probably also the retail given Microsoft's stance so far). If you go against the defaults and run as a non-admin user or turn UAC up to the Always Prompt level, so it behaves like it […]

All of this only affects the default account type and UAC level of Windows 7 (builds 7000 & 7022, but probably also the retail given Microsoft's stance so far). If you go against the defaults and run as a non-admin user or turn UAC up to the Always Prompt level, so it behaves like it did in Vista, then it is no longer possible for code-injection from unelevated processes to bypass UAC prompts. So the advice remains as before: If you are using Windows 7 and want to be protected against silent elevation then turn UAC up to the highest level. Long Zheng has posted a video to demonstrate Windows 7 UAC code-injection vulnerability, and Leo Davidson released the proof-of-concept source code and test application into the wild for public scrutiny.