Feeds

Vista raises the bar for flaw finders

But the battle's not over yet

3 Big data security analytics techniques

That's not surprising, because PatchGuard is not really about stopping malicious software from subverting the kernel, but preventing any software from destabilizing the system, said Ken Johnson, a software developer at remote-access provider Positive Networks.

"As far as I can tell, (PatchGuard) is a mechanism to force third-party driver (developers) to clean up their act and stop releasing poorly written drivers that destabilize customer computers and introduce security holes," Johnson said.

In a recent article in the technical publication Uninformed, Johnson - writing under the pseudonym "Skywing" - described several deficiencies in the latest version of PatchGuard, version 2. Microsoft programmers are currently studying the claims, said the software giant's Toulouse.

Other security technologies included in Microsoft's Windows Vista are not as controversial.

Address Space Layout Randomisation (ASLR), which makes it harder for an attacker to reliably run code that exploits remote memory flaws, has garnered the approval of many security researchers. Microsoft's implementation of the technique has some weaknesses, but overall the company has added a good foil to attacks that have plagued Microsoft's software in the past, said Positive Network's Johnson.

"Vista's ASLR is, on a whole, still a significant 'speed bump' that makes exploiting many vulnerabilities on Windows much more difficult to do reliably, especially in a 'fire and forget' fashion as typically used by worms," he said.

However, at least one other researcher has said the speed bump will not slow down the pace of exploits, because it can be circumvented.

"The ASLR implementation in Vista is not very resilient - it only randomizes the bases of certain system DLLs (dynamic link libraries) and not the rest of the loaded modules," Matthew Murphy, an application security engineer at Hypermedia Systems, stated in comments to a previous SecurityFocus article. "This means that today's attackers will still succeed tomorrow, because all they'll have to do is slightly tweak the jump points in their exploits."

Data Execution Prevention (DEP), a technology included in Windows XP Service Pack 2, monitors for attacks - or software bugs - that attempt to run code from a non-executable part of memory. While included in Windows XP SP2, the service is only activated by default on systems with 64-bit processors. With Windows Vista, Microsoft has set the technology to automatically monitor all essential Windows services.

Microsoft's Toulouse emphasised that Windows Vista is not the end of the software giant's fight to protect its customer from online threats.

"There are certain classes of attacks that we might see, after widespread deployment of Windows Vista, starting to go away, but none of this is to say that we can be complacent," Toulouse said. "We will still try to provide our users with tools that help them know what's going on their PC. And, we still urge customers that criminals are still out there, and you need to be cautious."

Windows Vista went on sale yesterday.

This article originally appeared in Security Focus.

Copyright © 2007, SecurityFocus

SANS - Survey on application security programs

More from The Register

next story
OpenBSD founder wants to bin buggy OpenSSL library, launches fork
One Heartbleed vuln was too many for Theo de Raadt
Got Windows 8.1 Update yet? Get ready for YET ANOTHER ONE – rumor
Leaker claims big release due this fall as Microsoft herds us into the CLOUD
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Ubuntu 14.04 LTS: Great changes, but sssh don't mention the...
Why HELLO Amazon! You weren't here last time
Patch iOS, OS X now: PDFs, JPEGs, URLs, web pages can pwn your kit
Plus: iThings and desktops at risk of NEW SSL attack flaw
Next Windows obsolescence panic is 450 days from … NOW!
The clock is ticking louder for Windows Server 2003 R2 users
Batten down the hatches, Ubuntu 14.04 LTS due in TWO DAYS
Admins dab straining server brows in advance of Trusty Tahr's long-term support landing
Red Hat to ship RHEL 7 release candidate with a taste of container tech
Grab 'near-final' version of next Enterprise Linux next week
Apple inaugurates free OS X beta program for world+dog
Prerelease software now open to anyone, not just developers – as long as you keep quiet
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.