Bypassing Microsoft Vista's Memory Protection

[mapes]

Windows Vista security 'rendered useless' by researchers


This is huge:

Two security researchers have developed a new technique that essentially bypasses all of the memory protection safeguards in the Windows Vista operating system, an advance that many in the security community say will have far-reaching implications not only for Microsoft, but also on how the entire technology industry thinks about attacks.

In a presentation at the Black Hat briefings, Mark Dowd of IBM Internet Security Systems (ISS) and Alexander Sotirov, of VMware Inc. will discuss the new methods they've found to get around Vista protections such as Address Space Layout Randomization(ASLR), Data Execution Prevention (DEP) and others by using Java, ActiveX controls and .NET objects to load arbitrary content into Web browsers.

By taking advantage of the way that browsers, specifically Internet Explorer, handle active scripting and .NET objects, the pair have been able to load essentially whatever content they want into a location of their choice on a user's machine.

[WalkinTarget]

A good read on the topic, which also points out that this is not as bad as they want you to think:

http://arstechnica.com/news.ars/post...ty-bypass.html

*snip*

Even with the attacks described in the paper, Vista has many worthwhile security improvements compared to XP. Internet Explorer on Vista runs in a highly restricted environment, so that even when it is running malicious code it cannot harm the system. Stories suggesting that Vista's security is now irredeemably broken are far off the mark; the truth is merely that some of its automatic security protection is less effective than it was before.

What Microsoft will do in response remains to be seen. Some of the specific featurs of the attacks can be resolved by Microsoft itself?preventing IE plugins from opting out of the protection schemes, by improving the way that .NET interacts with the protection, and by making Windows default to enabling all the protection schemes?and others can be minimized by third parties?by writing plugins that enable with all the security mechanisms, by being more careful with executable memory, and so on. Longer term, a switch to 64-bit programs might allow considerably more randomization to be applied; while making large allocations is enough to fill up a 32-bit program's memory (which allows attackers to defeat randomization) the same is not true of 64-bit processes?they're simply too big.

[mapes]

I would think that this is bad

he pair have been able to load essentially whatever content they want into a location of their choice on a user's machine.

[WalkinTarget]

I would think that this is bad

Based on their clear and concise methodology ? They haven't shown squat so far, other than IE7 turns off DEP. Its somewhat hard to believe that someone can load chosen content with chosen privileges. Chosen content, I would understand, but not chosen permissions.
It honestly comes down to third party plugin exploits that someone has found a buffer overflow 'hole' that allow the attack to commence. It really would be fixed by moving to a 64 bit OS/browser.

Hehe, IE8 enabled DEP by default