Slashdot Mirror

← Back to Stories (view on slashdot.org)

Defeating XP SP2 Heap Protection

Posted by michael on from the secure-by-design dept.

hobo2k writes "XP SP2 included canary values and hardware-implemented execution protection in order to avoid exploitable buffer overruns. Now Positive Technologies has released an article describing one way that protection could be bypassed. To solve the problem, they provide a program which disables the small allocation heap as described here. CNET reports that SP2 has been foiled."

6 of 242 comments (clear)

  1. bugs by Respawner · · Score: 0, Offtopic

    should bugs or exploits in windows still be frontpagenews ?

  2. Re:foiled? by gardyloo · · Score: 0, Offtopic

    Sorry, all. I must've been thoroughly drunk when I wrote that crap about standards on here.

  3. Don't forget... by bonch · · Score: 0, Offtopic

    www.apple.com/switch :)

  4. Service Pack 2 kills my Celphone "Modem". by Forge · · Score: 0, Offtopic

    Windows XP Service Pack 2 has only 1 problem (for me) beyond those of regular XP.

    My celphone can no longer be used as a cerial divice, aka; Dialup modem.

    Yes, The same hardware works on Linux (Dell Inspiron 8200, Sony Erricson T220 on a USB cable) and removing the pack got it working in Windows again.

    --
    --= Isn't it surprising how badly I spell ?
  5. An agrarian view on alternatives for XP SP2 by Anonymous Coward · · Score: -1, Offtopic

    Plowing for several large companies, I'd always done my work on Windows. Recently however, a top online investment firm asked us to do some work using FreedBSD. The concept of having access to source code was very appealing to us, as we'd be able to modify the kernel to meet our exacting standards which we're unable to do with Microsoft's products.

    Although we met several fertilization challenges along the way (specifically, FreedBSD's lack of Token Ring support and the fact that we were unable to defrag its ext2 file system), all in all the process went smoothly. Everyone was very pleased with FreedBSD, and we were considering using it for a great deal of future internal projects.

    So you can imagine our suprise when we were informed by a labourer that we would be required to publish our source code for others to use. It was brought to our attention that FreedBSD is copyrighted under something called the GPL, or the GNU Preventive License. Part of this license states that any changes to the seed are to be made freely available. Unfortunately for us, this meant that the great deal of time and money we spent "touching up" FreedBSD to work for this investment firm would now be available at no cost to our competitors.

    Furthermore, after reviewing this GPL our labourers advised us that any products compiled with GPL'ed tools - such as gcc - would also have to its source code released. This was simply unacceptable.

    Although we had planned for no one outside of this company to ever use, let alone see the source code, we were now put in a difficult position. We could either give away our hard work, or come up with another solution. Although it was tought to do, there really was no option: We had to rewrite the code, from scratch, for Windows 2000.

    I think the biggest thing keeping FreedBSD from being truly competitive with Microsoft is this GPL. Its mercurial requirements virtually guarentee that no business will ever be able to use it. After my experience with FreedBSD, I won't be recommending it to any of my associates. I may reconsider if FreedBSD switches its license to something a little more fair, such as Microsoft's "Shared Source". Until then its attempts to socialize the software market will insure it remains only a bit player.

    I welcome you for your time.

  6. OK, I checked that out! Here is what I think... by rbarreira · · Score: 1, Offtopic
    I checked out the "Top 10 reasons" to change to a Mac, because I was really curious. After I read it I just thought "Was this the best they could do?".

    Let's see:
    "1. The Mac...It Just Works"

    Thanks, my computer works too.
    "2. It Doesn't Crash"

    This might have been an argument against PC's with Windows a few years ago, but not so much now. I won't even mention Linux, of course.
    "3. It's a Digital Jukebox"

    Wou grate!!!11!!!
    "4. Delivers The Promise Of Digital Photography"

    This one really turns me on too...
    "5. Best Solution, In Fact, For All Things Digital"

    Maybe they could stop repeating themselves... BTW, the best programs to produce music and multimedia content exist for PC too, and the quantity of plugins is much greater on the PC.
    "6. Built To Go Everywhere -- Because That's Where You'll Want It"

    On this section they say:
    Consider this: Can your PC laptop go coast to coast with just one battery? Can you put the system to sleep just by closing the lid? Does it wake up instantly? Can your PC laptop automatically switch between Ethernet, dial-up and wireless connections on the fly? Without a restart? Ours can.

    Yep, my PC can do all that too...
    "7. The Internet Is Integrated"

    Fact is, most of our customers are up-and-surfing within 15 minutes.

    I can do that easily too. So maybe this would only be valid for people who know nothing about computers. Even then, I doubt it's much easier to configure an internet connection than in a PC in most cases. Prove me wrong.
    "8. Office is Office and then Some"

    OK, so this section tells me that some of the programs I use on the PC are also available for the MAC. This is hardly a reason for me to switch.
    "9. It Works Effortlessly With PCs"

    See previous answer.
    "10. It's Beautiful"

    11- Fuck That.
    --

    The AACS key is NOT 0xF606EEFD628B1CA427BEA93A9CA9773F