Computing.Net > Forums > Windows Vista > Vista security features are working

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Vista security features are working

Reply to Message Icon

Name: heropsycho2177
Date: April 25, 2007 at 17:18:06 Pacific
OS: Windows Vista Business
CPU/Ram: Opteron 165 @ 2.5GHz, 2GB
Product: meh
Comment:

The first major vulnerability for Vista, the Animated Cursor exploit, has been out long enough to judge how well the new security features of Vista protect Vista from even zero day vulnerabilities.

Reports are showing that new Vista security features are working. :-) In this case, Hardware DEP with ASLR prevented some attacks from being successful. While hardware DEP is supported by both XP and Vista, ASLR is exclusive to Vista.

"At least two exploits tried to take advantage of the vulnerability, by skirting Vista's Address Space Load Randomization (ASLR) security feature, which varies how the OS's memory map looks each time the computer is booted, Hypponen said. The feature can confound some malicious software programs, which need to run in a specific part of the computer's memory to function properly.

Both of the exploits attempted to circumvent the feature and insert themselves into memory. Neither worked and merely caused the computer to crash, Hypponen said.

A Microsoft security executive said he was unaware of specific animated cursor attacks against ASLR, but it shows that Vista's security is working as designed."

http://www.infoworld.com/article/07...

We'll always need patches. But at least zero day exploits seem to be having a harder time working on Vista.

"Enough, enough bowing down to disillusion!
Hats off & applause to rogues & evolution!
The ripple effect is too good not to mention.
If you’re not affected, you’re not paying attention!"



Sponsored Link
Ads by Google

Response Number 1
Name: Sabertooth
Date: April 25, 2007 at 22:47:33 Pacific
Reply:

Hoooraaa for stuff!

Now I can start letting my guards down......**tosses router out the window** - next stop firewall & AV........yeah baby ;-)



0

Response Number 2
Name: Bryco
Date: April 27, 2007 at 03:36:32 Pacific
Reply:

Since upgrading my WinXP machine with IE7 I now have an issue with DEP stopping qedit.dll from loading This M$ dll is a core file of DirectShow. This is causing an issue with MM2 and dxdiag. Love that DEP.

Beyan


0

Response Number 3
Name: heropsycho2177
Date: April 27, 2007 at 06:09:23 Pacific
Reply:

I'd be checking your dll version. DEP flat out denies exe's being loaded from areas in your buffer that aren't supposed to be there. DEP is doing you a favor.

TECH-NO-LOGICAL ROMANCE!

http://www.homestarrunner.com/tgs12.html


0

Response Number 4
Name: Bryco
Date: April 27, 2007 at 12:32:36 Pacific
Reply:

I had checked them and find they are the original qedit.dll/s. They are the same as found in I386 folders too.

The only ones that are a different version is found in the program folder (not system32 folder) for Intervideo.

I had unregistered and re-registered qedit.dll with same DEP complaints.

I cannot image why it would be loading into unauthorized memory. It didn't used to before IE7 install.
I even added MM2 to DEP exception list and it still denies it.

dxdiag shows an Unknown dll trying to load.
Re: http://computing.net/digitalphoto/w...

Bryan


0

Response Number 5
Name: heropsycho2177
Date: April 27, 2007 at 13:30:12 Pacific
Reply:

The dll could be being referenced and used in a manner that is triggering DEP by some other nefarious exe.

Bottom line is IE7 shouldn't be doing that, and it brings into question your OS install as possibly being compromised. :-(

"Enough, enough bowing down to disillusion!
Hats off & applause to rogues & evolution!
The ripple effect is too good not to mention.
If you’re not affected, you’re not paying attention!"


0

Related Posts

See More



Response Number 6
Name: Bryco
Date: April 27, 2007 at 15:26:26 Pacific
Reply:

I don't believe so as it is a common occurance amoung many whom installed IE7. See the link in my referenced link to PapaJohn's site.

Bryan


0

Response Number 7
Name: heropsycho2177
Date: April 27, 2007 at 16:14:26 Pacific
Reply:

Bryco, I don't see DEP referenced in that article...

"Enough, enough bowing down to disillusion!
Hats off & applause to rogues & evolution!
The ripple effect is too good not to mention.
If you’re not affected, you’re not paying attention!"


0

Response Number 8
Name: Bryco
Date: April 29, 2007 at 03:52:55 Pacific
Reply:

I admit it; DEP is not referenced in the article.
However, qedit.dll is and refers to IE7 causing or should I say uninstalling IE7 provides the cure to the issue.

dxdiag does prompt DEP due to DirectShow. One of the core files of it is qedit.dll. This is my correlation to qedit.dll and DEP.

So, I apologize for extending the DEP reference to MM2 and IE7.

Bryan


0

Sponsored Link
Ads by Google
Reply to Message Icon

File Sharing Vista and OpenGl ?



Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Windows Vista Forum Home


Sponsored links

Ads by Google


Results for: Vista security features are working

Vista counterfeits in the work? www.computing.net/answers/windows-vista/vista-counterfeits-in-the-work/230.html

Default Security Settings are? www.computing.net/answers/windows-vista/default-security-settings-are/292.html

http browsing doesn't work www.computing.net/answers/windows-vista/http-browsing-doesnt-work/1243.html