 |
 |
| ActiveWin | Anonymous | Create a User | Reviews | News | Forums | Advertise | VBA in Excel | Users Online: 0 |
|
|
|
|
|
User Controls |
|
New User |
|
Login |
|
Edit/View My Profile |
|
|
|
|
|
|
|
Active Network |
|
ActiveMac |
|
ActiveWin |
|
ActiveXbox |
|
DirectX |
|
Downloads |
|
FAQs |
|
Interviews |
|
MS Games & Hardware |
|
Reviews |
|
Rocky Bytes |
|
Support Center |
|
TopTechTips |
|
Windows 2000 |
|
Windows Me |
|
Windows Server 2003 |
|
Windows Vista |
|
Windows XP |
|
|
|
|
|
|
|
News Centers |
|
Windows/Microsoft |
|
Apple/Mac |
|
Xbox/Xbox 360 |
|
News Search |
|
XML/RSS Newsfeeds |
|
Pocket PC Site |
|
|
|
|
|
|
|
FAQ's |
|
Windows Vista |
|
Windows 98/98 SE |
|
Windows 2000 |
|
Windows Me |
|
Windows Server 2003 |
|
Windows XP |
|
Windows 7 |
|
Windows 8 |
|
Internet Explorer 6 |
|
Internet Explorer 5 |
|
Xbox 360 |
|
Xbox |
|
DirectX |
|
DVD's |
|
|
|
|
|
|
|
Latest Reviews |
|
Xbox/Games |
|
Fable 2 |
|
|
|
Applications |
|
Windows Server 2008 R2 |
|
Windows 7 |
|
Adobe CS5 Master Collection |
|
|
|
Hardware |
|
Microsoft Express Mouse |
|
|
|
|
|
|
|
Latest Interviews |
|
Mike Swanson |
|
|
|
|
|
|
|
Site News/Info |
|
About This Site |
|
Advertise |
|
Affiliates |
|
Contact Us |
|
Default Home Page |
|
Link To Us |
 |
The sky isn't falling: a look at a new Vista security bypass | |
|
||
| Time: 21:37 EST/02:37 GMT | News Source: Ars Technica | Posted By: John Quigley | ||
|
One of the papers presented at the Black Hat USA 2008 security conference was an analysis a number of the protection mechanisms built into Windows Vista and Windows Server 2008 that are designed to make it harder to convert software bugs into security flaws. How to Impress Girls with Browser Memory Protection Bypasses, authored by security researchers Mark Dowd at IBM and Alexander Sotirov at VMware, presented a number of attacks against Vista's various security features in isolation, and then attacks that could disable multiple protections all together. Put together, the result is that Vista's mitigation mechanisms are circumvented, making buggy software exploitable. |
||
|
Read Only Comments Return to News |
Displaying Comments 1 through 5 of 5 |
This is an archived static copy of ActiveWin.com. |
| #1 By 143 (74.129.194.180) at Tuesday, August 12, 2008 03:25:09 AM |
|
Very interesting. This post was edited by donpacman on Tuesday, August 12, 2008 at 03:27. |
| #2 By 28801 (65.90.202.10) at Tuesday, August 12, 2008 06:46:48 AM |
|
"Furthermore, these attacks are specifically on the buffer overflow protections; they do not circumvent the IE Protected Mode sandbox, nor Vista's (in)famous UAC restrictions. "
even more interesting This post was edited by rxcall on Tuesday, August 12, 2008 at 06:48. |
| #3 By 23275 (68.186.182.236) at Tuesday, August 12, 2008 07:46:31 AM |
|
Stress also: A vulnerability also had to exist
and... ASLR by itself = not enough NX/DEP by itself = not enough ASLR + NX/DEP = Good ASLR + NX/DEP for all program, not just system files = very good As good as Protected Mode is, FLASH runs outside it. So if you're going to surf sites you do not know or trust, run IE 7 x64 (no FLASH support). As popular as the use of it is, Adobe needs to step up right away and re-write FLASH so it runs in the right (highly Restricted) context and within PM. |
| #4 By 81201 (79.43.48.173) at Tuesday, August 12, 2008 08:38:06 AM |
| upcoming Flash 10 will support DEP and ASLR |
| #5 By 1896 (68.153.171.248) at Tuesday, August 12, 2008 06:40:56 PM |
|
I have not missed any sleep since I read the first articles about the "bypass" for two reasons:
A: Sensationalism is always a great sales tool. B: I have no doubt that Vista, as well as everything conceived and built by a human being can be disassembled, cracked etc. etc. by another human being. Since the moment we are born there is only one certain thing in life: one day we will all go. This post was edited by Fritzly on Wednesday, August 13, 2008 at 04:57. |
