Code Signing and UAC in Windows Vista havea relationship that should not be underestimated. Code Signing allowsUAC to provide a user with the details of an application's publisherand, thus, permits the user to ensure it is trusted before allowing itto elevate to full administrative privileges. Therefore, my recentobservation has left me dumbfounded.
The observation was this: if a signed binary is modified on diskand, thus, the code signing signature invalidated, you don’t get a bigklaxon going off with the computer screaming, “Danger Will Robinson!Danger!” Instead, the binary is simply treated as if it isn’t signed.Why is this an issue? The simple reason is that if, for example, youhave a world of poor file permissions (looking squarely at third-partysoftware here) and the user running as a restricted administrator canmodify a binary that is allowed to elevate, you could end up in asticky situation. That is, if a user is familiar with the fact that...
ASLR (Address Space Layout Randomization) is one of the cornerstones of Windows Vista and its enhanced security posture. ASLR workson the basis that it will move an application and its associated memoryaround, either each time it’s executed or when the host is rebooted,depending on the element concerned. The purpose of this is to hinder aclass of vulnerabilities commonly referred to as memory manipulation vulnerabilitiesby making it difficult for an attacker to know where an application isin memory. This would impede successful exploitation, which relies onfixed memory addresses.
Back in December, I decided to take a brief look at theimplementation of ASLR on Vista. I had seen some findings emerge duringits development, but these really didn’t show if the implementation wasgood, bad, or indifferent. Since my work load was winding down, as Ihad December off, and a tool I had written indicated there might besome problems, I decided to look at this in more detail. My...
When I started this project, I had one goal in mind – to understandwhich binaries in Windows Vista were not /GS compiled. While this mayseem rather simple on the surface, as I started to dig, it became alittle more complex. That said, my goal was achievable and today I’mhappy to present my findings.
The purpose of my paper "Analysis of GS Protection in Windows Vista"was to show which binaries under a default installation of WindowsVista 32bit RTM were not protected by the Visual Studio 2005 /GScompiler flag. This, in turn, was designed to help Symantec and ourclients understand any exposure, either direct or indirect, which mayresult from this lack of protection.
The abstract for my paper is as follows:
Visual Studio 2002 introduced the Buffer Security Check(GS) option to protect stack variables from overflows that resulted inarbitrary code...
People who have been following the notunexpected initial wave of security research with regards to WindowsVista will have seen a few informative blog posts recently. First, in ablog titled "Running Vista Every Day!"Joanna Rustkowska pointed out some issues with UAC, one of them being asimple implementation bug in UIPI. This, I believe in part, resulted inMark Russinovich writing his blog entry "PsExec, User Account Control and Security Boundaries." Joanna posted another blog, "Vista Security Model ? A Big Joke?" in response to Mark's blog post. And then followed it with "...
