Feeds

Vista kernel fix 'worse than useless'

MS irks security researcher (part 411)

Remote control for virtualized desktops

Microsoft has modified Windows Vista to prevent a high-profile exploit demonstrated at security conferences this summer but the fix creates as many problems as it solves, according to the security researcher who identified the original problem.

The bug, demonstrated by Joanna Rutkowska of security firm Coseinc, created a possible mechanism for hackers to bypass security protection built into 64-bit versions of Vista in order to inject potentially hostile code into the kernel of prototype versions of Windows. This so-called "pagefile attack" defeated a feature called Vista kernel protection.

Windows Vista Release Candidate 2 frustrates this attack by blocking write-access to raw disk sectors for user mode applications, even if they are executed with elevated administrative rights. Rutkowska writes that Microsoft's fix is fraught with difficulties because it prevents legitimate applications, such as disk editors and recovery tools, from functioning without their own signed kernel-level driver. Hackers might be able to hijack such legitimate drivers so all Microsoft has done has created extra work for developers in displacing - but not resolving - the problem.

During a presentation at the Black Hat conference in August, Rutkowska explained two other approaches Microsoft might take in defeating the page-file attack as well as highlighting the problems with simply blocking write-access to raw disk sectors for user mode applications. "Microsoft actually decided to ignore those suggestions and implemented the easiest solution, ignoring the fact that it really doesn’t solve the problem," she writes. ®

Beginner's guide to SSL certificates

More from The Register

next story
Nexus 7 fandroids tell of salty taste after sucking on Google's Lollipop
Web giant looking into why version 5.0 of Android is crippling older slabs
Be real, Apple: In-app goodie grab games AREN'T FREE – EU
Cupertino stands down after Euro legal threats
Download alert: Nearly ALL top 100 Android, iOS paid apps hacked
Attack of the Clones? Yeah, but much, much scarier – report
Microsoft: Your Linux Docker containers are now OURS to command
New tool lets admins wrangle Linux apps from Windows
Bada-Bing! Mozilla flips Firefox to YAHOO! for search
Microsoft system will be the default for browser in US until 2020
Facebook, working on Facebook at Work, works on Facebook. At Work
You don't want your cat or drunk pics at the office
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Internet Security Threat Report 2014
An overview and analysis of the year in global threat activity: identify, analyze, and provide commentary on emerging trends in the dynamic threat landscape.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.