MS Mulling Changes to Thwart .ANI-type Attacks

Scada Moosh writes "ZDNet has a story about the lessons Microsoft learned from the recent animated cursor (.ani) attacks and some of the broad changes being made to flag this type of vulnerability ahead of time. The changes include a possible addition to the list of banned API function calls, more aggressive checks for buffer overruns and enhancements to existing fuzz testing tools. '[Michael] Howard said Microsoft will "rethink the heuristics" used by the /GS compiler to flag certain issues. "Changing the compiler is a long-term task. In the short-term, we have a new compiler pragma that forces the compiler to be much more aggressive, and we will start using this pragma on new code," he added. Two other Windows Vista security mechanisms -- ASLR and SafeSEH -- were also in place to catch code failures but, in the case of the .ani bug, Howard said the attackers were able to wrap vulnerable code in an exception handler to find ways around those mitigations.'"

Comments

Ha ha, just in time for Vbootkit.

[twitter]

Nothing is new with the Vista security model. Check out boot kits and how they are able to do things like elevate command.com to system, open telnet servers and other goodies from 1500 bytes in the boot sector. Forever Pwned.

Re:Ha ha, just in time for Vbootkit.

[twitter]

I can't see anything in that article that would stop that exact same attack working on Linux.

Go ahead and make one then. I'm sure Mr. Gates would promise to pay you well and then stab you in the back, but you would have proved your point.

Re:All you ever wanted to know

[twitter]

Thanks, I'm not half as organized with my Slashdoting as you are!

Channel stuffing. 2007 is the year of Linux.

[twitter]

An AC pest taunts,

By the way twitter, how do you feel about how "M$" enjoyed a 60% jump in revenue on Vista and new office sales in the last quarter? Looks like Vista is doing well!

They stuffed their channels and I don't expect the next quarter to look very good. Studies that show that only one in ten people are planning to use Vista better and that a large percentage of businesses never plan to move to Vista are more in tune with reality. The fact that M$ has not and will not fix their security model makes me think those numbers will go south. Give the channels another quarter of crappy sales and all hell will break lose for M$ as they are forced to admit they overbought Vista. The partners have been starved for six years, this is supposed to be their best year ever. Their investors will demand better and 2007 will be the year of Linux.

Taunts like that are fun. Keep it up, M$ marketdroids!

You will never know.

[twitter]

so what you are telling me here is that if I allow my operating system to be compromised, it will be compromised?

Yes, but there will be no trace of it on your hard drive, anti-virus writers don't check BIOS, so you will never know people are logging into your system and taking what they want. Ha ha.

But no, what your AC sock puppets have claimed is not true - this won't work on gnu/linux. It only works for Vista by exploiting M$ specific flaws. Those flaws were originally designed to lock you out of your kernel and it looks like they have done exactly that. Show me the gnu/linux demonstration and I might believe you. Right now, all claims of such are the usual FUD. "... but, but M$ is the best, every thing else must suck as badly," all the M$ turds always cry but it never comes to pass. It sucks to be you, dedazo.

No, it's a M$ thing.

[twitter]

It's the PC heritage, going back to the days when no-one in the non-Unix PC world gave the slightest thought to security, because you could get away with it back then.

They did not get away with it. Macro viruses blew out computer labs and people's systems and caused all manner of havoc.

Worse, M$ knew better and everyone told them so. They had Xenix, they helped make OS/2, they knew what they were doing, they just decided to hold on their DOS legacy. It was then and still is a matter of negligence. Other people did not and still don't have the same kinds of problems. Xenix, Minux, Linux, BSD, even Apple and Palm did better. People are still telling them so.

The only reason there's a perception that these are "computer" or "PC" problems is that M$ runs a billion dollar a month marketing program. That billion bucks includes astroturf, public corruption, bribes and everything they can think of to get people to tell you that M$ is the best, it has all the features everything else does and everything else has all their problems. This is a tremendous disservice to the public.

When have they stopped saying that kind of thing?

[twitter]

When did Microsoft ever claim to have rewritten Windows from scratch?

They used to do it regularly. NT stood for "New Technology." I can't tell you how many times they declared the "death of DOS" even while they were using the same old 16 bit functions. ME, W2K and XP were all billed as radically new but were all more of the same rehashes.

Vista is more of the same. The wikipedia entry, which they pay people to write, claims, "hundreds of new features; some of the most significant include an updated graphical user interface and visual style dubbed Windows Aero, improved searching features, new multimedia creation tools such as Windows DVD Maker, and completely redesigned networking, audio, print, and display sub-systems." In short new everything, which clearly is not true. They go on to boast about security improvements that, once again, do nothing real for the user.