Feeds

Microsoft deploys protocol defense for IE

'We can't do it on our own!'

Protecting against web application threats using SSL

RSA Internet Explorer is the next battleground for Microsoft in its goal of securing the Windows stack against an anticipated avalanche of script-based attacks.

And the company appears to be putting out the feelers to the community in order to get there.

David Cross, Microsoft product unit manager, told RSA generic application-level protocol analyzers are a key tool in the company's fight against an anticipated surge in script-based attacks on users of its browser as the internet goes Web 2.0.

The company reckoned it's facing 1,000 threats per day versus 500 a month in the good-old days of the CodeRed and Nimda worms.

Attacks are also becoming more advanced: key loggers and worms are dropping off in number while downloads - trojans and adware - and root kits remain high. Areas for attack are the hypervisor and BIOS down in the guts of the stack and at a higher level in specific applications.

Cross, in his session Life after Vista: what is next for Windows security?, said: "As we harden the OS - driver interfaces, hooks into the OS - the applications become the richest points of attack. The number of attacks - not necessarily the sophistication, the sheer volume of attacks coming at us - require innovation on our part."

Analyzers would help detect an "infinite amount of signatures in virtually an infinite number of languages" as users engage in day-to-day activities like uploading photos to the web that exposes their personal information, such as passwords and identities.

According to Cross, the operating system has been hardened. "The key aspect of the platform looking forward is how we can use things like GAPA to add the script-based vulnerabilities in a browser. This is something where we see a lot more attacks coming from at Microsoft and how we can provide innovation in this area."

Cross advocated an "open" approach on GAPA in IE. "We've been doing a lot of work on GAPA," Cross told RSA. "GAPA shouldn't be a closed system that Microsoft only develops... the true value in something like GAPA is through the community model. People can plug in and provide new protocols."

Cross also identified a number of areas where he "predicted" continued investment by Microsoft, although it was clear these were his "predictions" and there were no specific commitment to features in IE 8 or Windows 7. Time to read between the lines.

These include continued investment in hardening the operating system, the creation of extension points that act like gateways and channel third-parties' software, code signing to support new features such as User Account Controls and application whitelisting, and even some form of digital rights management.

Separately, Cross claimed users both accept and understand Windows Vista's UACs, which turn-off Windows Vista users' administrative privileges and reduce users' ability to easily download or install malicious code.

Cross, previously UAC group program manager, called the system a "very heavy hammer" to solve the installation problem, something that was intended to annoy users and thereby force a change in the ecosystem.

Quoting statistics from Windows Watson dumps, the Malicious Software Removal Tool and opt-in programs run in conjunction with consumers and enterprises, Cross said 80 per cent of UAC interruptions were caused by just 10 actions in Windows and other software from Microsoft and third parties. UAC is on 88 per cent of all consumer sessions and 66 per cent of sessions have no prompts at all.®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.