9

I have certain applications that keep asking for UAC permissions in Windows OS when launching them.

I have doubts whether to give them access, but I still keep giving them access, thinking that it won't be a big deal. The applications have verified tags in the UAC window, so that way I feel that it is safe to give them UAC permissions and access.

So, I wish to ask that if I allow permissions to an application using UAC in Windows OS, then is there any chance that the application may "steal" or hack my personal files and data without my knowledge or authorization? Will my anti virus or total security software be able to detect such activities?

What may happen in the worst-case scenario?

If an application has verified tags, then is it safe to trust that application when giving it UAC permissions?

8
  • 7
    The usual scenario is that any program you run has full access to your personal files. Example: you edit a file in Word, so Word needs to be able to read and modify your files. UAC controls if a program has access to system files. Some older applications won't run properly if they don't have such access: usually it is if they have some "compatibility mode" set. Can you tell us which application this is? Maybe, read some explanation on UAC
    – 1NN
    Jul 27, 2023 at 5:51
  • If the application is signed by a trusted publisher, what exactly are you worried about, the application already has access to the same files the user can access? By default any process ran by a user, can read the same files, the user can access. By elevating the permissions of the application, you are allowing the process, to access any file an Administrator can access. I have no idea what you mean by "verified tags" by the way.
    – Ramhound
    Jul 27, 2023 at 20:44
  • 8
    Obligatory xkcd: xkcd.com/1200
    – Heinzi
    Jul 27, 2023 at 21:15
  • 3
    @Shiva - Even if you don’t authorize the elevated permissions of the process, the process could “hack your personal data”, since the process has the same unelevated permissions as your user. It’s not a publisher tag, what is being displayed, is telling you the file is digitally signed by the publisher. Daniel’s answer is the better answer, as it correctly points out, the application could “hack your data” even without having elevated permissions.Windows Security will quarantine detectable threats even without a UAC prompt.Honestly the UAC explanation of the accepted answer isn’t even accurate.
    – Ramhound
    Jul 28, 2023 at 8:01
  • 1
    You've accepted an answer that while it may contain some correct facts, completely fails to address your question, which was about personal files and data.
    – Ben Voigt
    Jul 28, 2023 at 16:04

2 Answers 2

9

The UAC (User Account Control) dialog typically pops up when a process requests a change that requires Administrator rights. Its primary purpose is to prevent unwanted changes without the user's knowledge.

When you click Allow in the UAC dialog, you are allowing the change to take place. This is typically not a problem, especially with a verified application, when you are expecting the computer to respond to some action you've taken. Installing a new application, for example.

Standard operations, like opening a Word document, typically should not generate a UAC prompt. If you have reason to believe what you are doing should not require elevated privileges, and are getting a UAC prompt, deny the request until you can verify what the request is for. This is especially important when downloading and installing untrusted and new applications off the internet.

To answer your questions directly:

Any chance that the application may "steal" or hack my personal files and data without my knowledge or authorization?

Yes. When you click Allow in the UAC, you are giving that application/process/whatever access to your system to perform any changes. Only use software from trusted sources and do not click Allow if in doubt.

Will my anti virus or total security software be able to detect such activities?

Depends. If after clicking Allow on UAC, an application attempts to install a known malicious package, Windows Security will attempt to identify and quarantine known malicious content. However, a malicious application can take many forms and do many things, and not all of them are within the detection capabilities of standard antivirus.

What may happen in the worst-case scenario?

Honestly, anything. Clicking 'Allow' on the UAC prompt grants the requesting application administrative rights, enabling it to make system-wide changes.

User Account Control (UAC) is a critical security feature in Windows designed to protect your system from unauthorized changes. While it offers a layer of protection, it is not infallible. Therefore, always exercise caution when granting UAC permissions, especially for unfamiliar software or unexpected prompts. Trust only verified sources, and ensure your security software is updated regularly.

5
  • 1
    Thank you for such a detailed explanation. Is there any way I can verify a request to know why exactly is the application asking for UAC permissions?
    – Shiva
    Jul 27, 2023 at 6:05
  • That is a great question. The UAC dialog might give you a clue or two, which you can Google for more information. I'll try to give an analogy. The UAC prompt is like an Amazon delivery box. When you order something from Amazon (trusted provider), and the box shows up (UAC dialog), you can be reasonably certain that you can open the box (click allow) without concern. However, if you placed an order at Wal-Mart (or didn't place any order), and a random Amazon box (unexpected UAC dialog) shows up at your door, you might not open the box (deny UAC) until you verify who sent it. Jul 27, 2023 at 6:15
  • 5
    The goal of my analogy is to point out that it is far more important to ensure you are running things on your computer that come from sources that you trust, than it is to try and understand why something requested a UAC escalation. A malicious app could masquerade its intentions as perfectly reasonable instructions that any person would mistake as legitimate. The only real protection is to protect yourself by ensuring you stick to trustworthy sources for information, content and software. Jul 27, 2023 at 6:29
  • 1
    @Shiva I'm not using Windows regularly (or often) so things may have changed but what you see with the UAC prompt is the request to run a process with the elevated admin token. This is accomplished through the runas verb of ShellExecute and AFAIK there is no field to record the intent of such elevation. I believe you are thinking too much in terms of a mobile OS. The UAC does absolutely nothing to prevent software from stealing your data, it just doesn't give it permission to change or access system components. Nowadays, for a desktop user, this is pretty irrelevant. ... Jul 27, 2023 at 15:34
  • 1
    ... All your data is in the browser and in the Document/Desktop folders. Both are easily accessible with your unelevated token. Jul 27, 2023 at 15:34
31

On the contrary. The application can steal/delete/encrypt your stuff even without asking for elevated permissions (using an UAC prompt).

One MUST NOT run untrusted software, ever.

When you launch a program, it runs with the same permissions you use to do your day-to-day work on the computer. It can access all your documents and settings and whatnot.

You must decide whether to trust a software. Code signing (what you call “verified tag”) does not mean software is safe. Also, a lack of code signing does not imply that software is unsafe.


Theoretically, applications could come with sandboxing and minimal permissions. In practice however, they usually don’t.

9
  • 3
    Your advice amounts to "One MUST NOT run software, ever" and is therefore useless. (What I want to say is that there is never perfect trust but only different levels of mistrust, so that we are, in the end, thrown back to a mixture of our gut feeling, defender and luck. And offline backups.) Jul 27, 2023 at 15:58
  • 7
    I disagree: the OP is basically asking if a UAC prompt abrogates their personal responsibility. A naive enough question that Daniel B rightly addresses.
    – Yorik
    Jul 27, 2023 at 17:16
  • 5
    @Peter-ReinstateMonica I appreciate your concern. However, considering how the question is written, I get the impression that OP is mistaken about the extent of stuff software has access to—even without elevation. Or what the information that appears on the UAC prompt signifies. I would like to stress, once again: Once hostile software is running on your PC, you have lost. Your assessment is entirely correct. That’s just how it is.
    – Daniel B
    Jul 27, 2023 at 17:52
  • 4
    When in doubt, run it in a VM or Sandbox that doesn't have shared access to your PC. Jul 27, 2023 at 18:43
  • 1
    "Theoretically, applications could come with sandboxing and minimal permissions." That's what the operating systems/app stores on mobile devices (Android, iPhone/iPad) do, and that's one of the reasons why a tablet is often a better choice for a non-technical user than a "classic" PC.
    – Heinzi
    Jul 27, 2023 at 21:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .