PDA

View Full Version : Vista security rendered useless by researchers


sidney
August 8th, 2008, 05:52 PM
Some interesting articles are coming out of the Black Hat conference in Las Vegas. Here is one on Windows Vista security 'rendered useless' by researchers (http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1324395,00.html). An excerpt:

Researchers who have read the paper that Dowd and Sotirov wrote on the techniques say their work is a major breakthrough and there is little that Microsoft can do to address the problems. The attacks themselves are not based on any new vulnerabilities in IE or Vista, but instead take advantage of Vista's fundamental architecture and the ways in which Microsoft chose to protect it.

Update: Here is a link to the actual paper: Bypassing Browser Memory Protections - Setting back browser security by 10 years [PDF 678KB] (http://taossa.com/archive/bh08sotirovdowd.pdf)

Peter Creasey
August 8th, 2008, 07:55 PM
Sidney, I read a similar article today that totally slammed the new 3G iPhone security. Really a terribly devastating report in (I believe) "Information Week".

I'm glad that my strategy is to lay low and not push any envelopes.

davidh
August 8th, 2008, 11:43 PM
Some interesting articles are coming out of the Black Hat conference in Las Vegas. Here is one on Windows Vista security 'rendered useless' by researchers (http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1324395,00.html). An excerpt:



Update: Here is a link to the actual paper: Bypassing Browser Memory Protections - Setting back browser security by 10 years [PDF 678KB] (http://taossa.com/archive/bh08sotirovdowd.pdf)
I did not have the patience to attempt to read the papers.

But I assume that even if true, the weaknesses pointed out do NOT nullify ALL OTHER SECURITY MEASURES that a user might take.

For example, one such measure which I have not yet seriously considered is SANDBOXING. Although, on a somewhat related note, on the recommendation of Nick, I do use "drop my rights" with my browser, Firefox.

I'll admit , tho', that after watching Flash videos (e.g. Yahoo news), I do often forget to tell NoScript add-on of FF to disable plug-ins on whitelisted sites. BTW, I try to keep my list of whitelisted sites very short.

DH

sidney
August 9th, 2008, 03:45 AM
I assume that even if true, the weaknesses pointed out do NOT nullify ALL OTHER SECURITY MEASURES that a user might take

That's true, especially the security measures of not running IE and if possible not installing .NET. The weaknesses of the paper are not exclusive to IE and .NET, but are made much easier to exploit by them.

What kind of sandbox are you talking about? Running your bowser in a virtual machine like VMWare, or a sandbox program like Sandboxie or GeSWall?

I think that any sandboxing could help contain the vulnerability.

Mike
August 9th, 2008, 03:49 AM
Windows Vista security 'rendered useless' by researchers

<snicker>

<snicker>

Oh, ROFL!

davidh
August 9th, 2008, 09:34 AM
What kind of sandbox are you talking about? Running your bowser in a virtual machine like VMWare, or a sandbox program like Sandboxie or GeSWall?

I think that any sandboxing could help contain the vulnerability.I had very fleetingly considered SandboxIE. But never actually looked into it. I'm guessing it's free. That's what I like is free stuff.

However, since I have NoScript, Finjan Secure Browsing, Firekeeper, McAfee SiteAdvisor, and AVG Firefox security extensions loaded and running in Firefox, in addition to AVG anti virus/anti spy and Zone Alarm Firewall, I'm fairly confident that I have a relatively high level of security for a home user.

If I get really really paranoid I may go back to MS-DOS TCP/IP only. Problem is no free LD phone software in MS-DOS :( or UNICODE for Asian languages.

DH

sidney
August 9th, 2008, 03:08 PM
However, since I have NoScript, Finjan Secure Browsing, Firekeeper, McAfee SiteAdvisor, and AVG Firefox security extensions loaded and running in Firefox, in addition to AVG anti virus/anti spy and Zone Alarm Firewall, I'm fairly confident that I have a relatively high level of security for a home user.

I wonder how having all that compares to installing Ubuntu and running VirtualBox (Sun's new free virtualization program, compare to VMWare but free) to run Windows for those few programs that yo uhave to run under Windows. Browsing with Firefox, email with Thunderbird, and even word processing with OpenOffice would not involve a learning curve to move from Windows to Linux. With VirtualBox you would have access to anything that has to be done under Windows.

davidh
August 9th, 2008, 06:26 PM
I wonder how having all that compares to installing Ubuntu and running VirtualBox (Sun's new free virtualization program, compare to VMWare but free) to run Windows for those few programs that yo uhave to run under Windows. Browsing with Firefox, email with Thunderbird, and even word processing with OpenOffice would not involve a learning curve to move from Windows to Linux. With VirtualBox you would have access to anything that has to be done under Windows. That sounds like it might be a good plan for somebody not as lazy as me.

There might be some overlap among Finjan, Firekeeper, and AVG extensions. However, I have never had two warnings from different security extensions at the same time. Lately, I think I've seen more warnings from Firefox 3 itself, apparently based on its consultation of a Google database of suspicious sites. At least I think it was Firefox itself giving the warnings, because no other name was given.

I have not tried the free Firefox security extension included with Zone Alarm. I figure I may have hit the point of diminishing returns already.

DH