Slashdot Mirror

← Back to Stories (view on slashdot.org)

Many Popular Windows Apps Ignore Security Options

Posted by Soulskill on from the who-uses-apps-anyway dept.

eldavojohn writes "The latest versions of Microsoft Windows have some good security options available — now if only they could get their most popular third-party applications to use them. A report from Secunia takes a look at two such options — DEP and ASLR — and Brian Krebs breaks down who is using them and who is not. A security specialist noted, 'If both DEP and ASLR are correctly deployed, the ease of exploit development decreases significantly. While most Microsoft applications take full advantage of DEP and ASLR, third-party applications have yet to fully adapt to the requirements of the two mechanisms (PDF). If we also consider the increasing number of vulnerabilities discovered in third-party applications, an attacker's choice for targeting a popular third-party application rather than a Microsoft product becomes very understandable.' Among those with neither DEP or ASLR: Apple Quicktime, Foxit Reader, Google Picasa, Java, OpenOffice.org, RealPlayer, and AOL's Winamp. While Flash player can't implement DEP, it does have ASLR. Google Chrome is the only popular third-party application listed with stars across the board." It's worth noting that several apps highlighted in the Secunia research paper have added support for those security options in recent patches, or are in the process of doing so. Examples include Firefox, VLC, and Foxit Reader.

5 of 202 comments (clear)

  1. Adobe's problem by ILuvRamen · · Score: 4, Insightful

    Somehow I think that adding both of those options to anything Adobe makes wouldn't make an ounce of difference. They first need to patch that whole "putting features and pretty design before security" thing.

    --
    Google's Super Secret Search Algorithm: SELECT @search_results FROM internet WHERE @search_results = 'good'
  2. Re:Wait a minute by Anonymous Coward · · Score: 3, Insightful

    Why doesn't Windows enforce it's security?

    Because they write the OS and do not dictate what you can run on your box?

    Or do you want your windows apps to only come from Windows Application Store?

  3. "app" by Anonymous Coward · · Score: 3, Insightful

    Can we please stop calling everything "apps" and go back to programs. App is getting to be as annoying as blog.

  4. Authenticode for free software? by tepples · · Score: 3, Insightful

    [Programs not signed by a commercial code review agency] wind up in a virtual machine, completely isolated from the main OS and the app windows they put up are clearly marked as coming from an untrusted application, similar to untrusted applets in Java's sandbox.

    Then any program that doesn't have a commercial entity behind it would have to run in the sandbox. For example, a lot of free software for Windows lacks Authenticode signatures because many individuals who maintain free software in their spare time don't want to incorporate ($100 or more depending on state) in order to become eligible for an Authenticode certificate and then keep the certificate up to date ($179.95/year).

  5. Apple doesn't just make Mac OS X by tepples · · Score: 3, Insightful

    Apple doesn't allow unsigned programs to run at all.

    Since when has Mac OS X Snow Leopard blocked the use of unsigned or self-signed software on the Mac?

    Popular open-source projects that would like a certificate can petition their users for donations

    If a program has to be signed to be useful, such as if it has to be signed just to be able to open the documents that the user chooses, then how can the program become popular in the first place?