VISTA Security?

LAS VEGAS -- Two security researchers have developed a new technique that essentially bypasses all of the memory protection safeguards in the Windows Vista operating system, an advance that many in the security community say will have far-reaching implications not only for Microsoft, but also on how the entire technology industry thinks about attacks.
In a presentation at the Black Hat briefings, Mark Dowd of IBM Internet Security Systems (ISS) and Alexander Sotirov, of VMware Inc. will discuss the new methods they've found to get around Vista protections such as Address Space Layout Randomization(ASLR), Data Execution Prevention (DEP) and others by using Java, ActiveX controls and .NET objects to load arbitrary content into Web browsers.
By taking advantage of the way that browsers, specifically Internet Explorer, handle active scripting and .NET objects, the pair have been able to load essentially whatever content they want into a location of their choice on a user's machine.
Researchers who have read the paper that Dowd and Sotirov wrote on the techniques say their work is a major breakthrough and there is little that Microsoft can do to address the problems. The attacks themselves are not based on any new vulnerabilities in IE or Vista, but instead take advantage of Vista's fundamental architecture and the ways in which Microsoft chose to protect it.
"The genius of this is that it's completely reusable," said Dino Dai Zovi, a well-known security researcher and author. "They have attacks that let them load chosen content to a chosen location with chosen permissions. That's completely game over.
"What this means is that almost any vulnerability in the browser is trivially exploitable," Dai Zovi added. "A lot of exploit defenses are rendered useless by browsers. ASLR and hardware DEP are completely useless against these attacks."
Many of the defenses that Microsoft added to Vista and Windows Server 2008 are designed to stop host-based attacks. ASLR, for example, is meant to prevent attackers from predicting target memory addresses by randomly moving things such as a process's stack, heap and libraries. That technique is useful against memory-corruption attacks, but Dai Zovi said that against Dowd's and Sotirov's methods, it would be of no use.
"This stuff just takes a knife to a large part of the security mesh Microsoft built into Vista," Dai Zovi said. "If you think about the fact that .NET loads DLLs into the browser itself and then Microsoft assumes they're safe because they're .NET objects, you see that Microsoft didn't think about the idea that these could be used as stepping stones for other attacks. This is a real tour de force."
Microsoft officials have not responded to Dowd's and Sotirov's findings, but Mike Reavey, group manager of the Microsoft Security Response Center, said Wednesday that the company is aware of the research and is interested to see it once it becomes public.
Dai Zovi stressed that the techniques Dowd and Sotirov use do not rely on specific vulnerabilities. As a result, he said, there may soon be similar techniques applied to other platforms or environments.
"This is not insanely technical. These two guys are capable of the really low-level technical attacks, but this is simple and reusable," Dai Zovi said. "I definitely think this will get reused soon, sort of like heap spraying was."

Vista vs XP

Are vista sales really going as well as Microsoft reports say? I was curious so did a bit of research and found some useful polls and articles that blow their figures out of the water. It appears they are trying to convince themselves that they made the right move, or else they think the consumer is to stupid to know the difference.
Several vendors initiated a Vista to Xp crossgrade. Basically, if a customer ordered a computer and it came with Vista installed, the customer could get an Xp license instead.Microsoft does not count the crossgrade as a sale for Xp. Rather, they count it as a sale for Vista. Now, combine that data with public statements from vendors that Xp is outselling Vista on an average of 3 to 1. Now go take a look at Microsoft's sales statements for Vista and for Xp, and you'll note a startling difference. Microsoft's finance numbers do not add up if one accepts the numbers Microsoft has floated for sales. Care to guess how the numbers appear to be adding up? If you are thinking that Vista is selling worse than Windows ME, you'd probably be close to what appears to be reality. Now, Microsoft reported back in July,of 2007, that 60 million copies of Vista had been sold. Now start subtracting the crossgrades to Xp that are not counted as sales. Microsoft needs to take a hard look at the market and the feedback they’ve received and be honest with themselves. After a ton of time developing Vista, I can imagine that the last thing Microsoft wants to do is publicly admit that it’s not the product it was supposed to be and their sales figures seem to back them up. It’s important to note, though, that new PCs that are shipped with Vista and then downgraded to Windows XP, are counted as Vista sales. Westminster College, last year, purchased around 90 computers with Windows Vista. Every single one was upgraded to XP. Now, I know that 90 computers is a miniscule fraction of PC sales, but they are far from the only organization with a similar policy that purchased computers with Vista.
Change, for change's sake, is never a good idea. And while you can understand Microsoft's desire to refresh the Windows UI (all those Mac OS X screen shots look so much prettier than XP), Vista's designers seem to have cut off their nose to spite their face. Regardless, the usability "improvements" in Vista are unlikely to make IT's list of compelling reasons to move away from XP anytime soon. After all is said and done, I believe the number of people, and businesses running vista are far below the number of licenses sold. I think it accounts for a lot of MAC's moving up the ladder and the Linux uptake has to account for a few cases. I personally know of several individuals, and companies that switched and most went back to XP, some gave Linux a shot. The reasons I heard most often was, “our software won't run correctly on vista.” With windows seven due in 2009, or 2010, it appears Microsoft is starting to get a little concerned about vista. A lot of this information came from InfoWorld, Tech Republic, and various forums, and windows techies.

New laptop

I bought a new Toshiba laptop Friday, April 4,'08. It is an intel dual processor, 2gig ram, 200 gig SATA hard drive, 128 meg video memory. It came with VIRUS, I mean VISTA, but that was gone in 2 days. I downloaded PCLinuxOS 2008 Gnome and wiped windoze completely. It runs much faster with Linux, uses less resources, and has a better 3D desktop than the aero interface. It found all the exotic hardware, set it up, and is running happily along. I tried to get the salesman to remove VISTA and sell it without an OS, but he said he couldn't because they were locked in with Micro$oft, had a contract with the devil. It's a shame you are forced to pay for an OS you don't intend to use, and it also counts as a sale for windoze, even though it isn't running windoze now. News has come out that VISTA is less secure than XP, of course the company says the opposite. Vista also comes loaded with DRM, which controls how you can use it, and how you can't. I can use my Linux OS any way I want, I have the option of re-mastering the distro to personalize it, give it away to both my friends, install it on as many computers as I care,make as many copies as I want, and not have to worry that it is NOT reporting back to the company, or sending any info concerning my use of the system.

VISTA is not an option.

Being a Linux user for 6 years, I was curious about VISTA. I signed up as an official tester for RC1 and RC2. My hardware consisted of an Epyx motherboard, 512 meg of DDR memory, AMD Athlon XP 2000 processor, Linksys NIC card, Sound Blaster audio board, NVIDIA FX 5200, 256 meg video card, Iomega 100 ZIP drive, 1.44 floppy, and a 80gig Western Digital IDE hard drive. I ran the tester to see if I met all the requirements of the OS. It said I could run any version, which turned out to be false. RC1 and RC2 failed to detect my NIC card, sound board, ZIP drive and my USB ports. I ran my Linksys disk and installed the driver for XP, and it worked. Got on the internet and started looking for drivers on the manufacturer's web sites. No one had drivers ready yet and most were not sure when they would be ready. Not a very good start for what is supposed to be the latest and greatest. I tried out all the apps and programs that came with the download and was very displeased with the speed. Very sluggish and unresponsive. Boot up time was around 2 minutes. There was no way I was going to downgrade from Linux to VISTA.
It has been a year now and Microsoft says VISTA is being adopted faster than XP was. But, in the real world people are buying new computers, preloaded with VISTA( you have no choice on branded units), removing VISTA and loading XP. Companies are not upgrading as fast as Redmond thinks, with new hardware requirements, increased license fees, training costs, and memory upgrades. There is no way I am going to downgrade from Linux to VISTA.
My Linux distribution, PCLinuxOS, is faster, more secure, needs less memory, is easier to install, and does everything VISTA does except get viruses, adware, malware, and trojans. The 3D desktop makes VISTA's aero look lame and only requires 32meg of video memory. Plus I am not tied down to the whims of the vendor, nor can they access my machine at will. Last, but not least, did I mention that it is all free?