April 24, 2007

.ANI attacks took swipes at Vista's security

F-Secure: Vista is likely to come under increasing attacks as it's more widely adopted

Microsoft's Vista operating system took some of its first punches when a dangerous vulnerability was disclosed earlier this month, but the OS held strong, a security analyst said Tuesday.

At least two exploits were targeted at Vista, trying to circumvent a new security feature designed to thwart malicious software attacks, said Mikko Hypponen, chief research officer for F-Secure at the InfoSecurity Europe in London on Tuesday.

Microsoft issued an out-of-cycle patch for the vulnerability, which occurred in how Windows processed ".ani" or animated cursor files, which allow Web sites to replace the regular cursor with cartoonish alternatives.

At least two exploits tried to take advantage of the vulnerability, by skirting Vista's Address Space Load Randomization (ASLR) security feature, which varies how the OS's memory map looks each time the computer is booted, Hypponen said. The feature can confound some malicious software programs, which need to run in a specific part of the computer's memory to function properly.

Both of the exploits attempted to circumvent the feature and insert themselves into memory. Neither worked and merely caused the computer to crash, Hypponen said.

A Microsoft security executive said he was unaware of specific animated cursor attacks against ASLR, but it shows that Vista's security is working as designed.

"I'm happy they [F-Secure] showed that it works," said Roger Halbheer, Microsoft's newly appointed chief security advisor for Europe, the Middle East and Africa.

The animated cursor vulnerability is especially dangerous since a machine could become infected if a user just views a malicious Web site. It was the third zero-day vulnerability Microsoft had patched off schedule since January 2006.

Vista is likely to come under increasing attacks as it's more widely adopted, Hypponen said. About 3 percent of U.S. consumers are currently using Vista, with about 79 percent still running Windows XP, according to recent statistics cited by Hypponen from Harris Interactive Inc.

Vista's security improvements mean a machine can be connected to the Internet in its default configuration without any third-party security products and be fairly protected, Hypponen said. But just as security vendors had to revamp their software for Vista, so will the malicious software writers, Hypponen said.

"Unfortunately, it will change, and it will change for the worse on the Vista side," Hypponen said.

Close

On Twitter now

Security

Powered by Twitter

On Twitter now

White Paper

D2D Virtual Tape Library Replication Primer

This whitepaper explains the terminology and concepts behind Data Replication technologies and establishes some sizing rules through worked examples. Learn the new paradigm in disaster tolerance—protect data anywhere.

Download now »

Trial

Free 30-Day Desktop Virtualization Trial

Download a free 30–day trial and experience how XenDesktop delivers a pristine, on–demand desktop experience to users on whatever device they choose, while cutting IT complexity and costs.

Download now »

White Paper

Why Your Firewall, VPN, and IEEE 802.11i Aren't Enough to Protect Your Network

The emergence of WLANs has created a new breed of security threats to enterprise networks.

Included in HP ProCurve WLAN solutions is security technology that alleviates threats from WLANs through:
* Monitoring wireless activity inside and out of the enterprise
* Classifying WLAN transmissions into harmful and harmless
* Preventing transmissions that pose a security threat to the enterprise network
* Locating participating devices for physical remediation

Download now »

Sign up to receive Security Resource Alerts

Subscribe to the Security Central Newsletter

Stay informed of the latest security threats and fixes.

White paper

Comprehensive Data Protection for Storage Appliances

With the continuous expansion of data capacity, completing the full cycle of a scheduled scan can be a very time consuming process. Find out how to efficiently secure EMC Celerra with centralized virus scanning, virus pattern file updates, event reporting and antivirus configuration.

Download now! »

White paper

Secure Celerra Environments with Minimal Overhead

A single virus-infected file in a storage system can be responsible for infecting large amounts of data. This white paper details the architecture and product features of Trend Micro's data storage security solution, ServerProtect, and discusses how it has been designed to protect EMC Celerra file servers with minimal overhead.

Download now! »
White paper

Keep Linux Servers Free from Malware

The increase in Linux popularity has increased the frequency and sophistication of malware attacks. Learn how you can protect your Linux environment with real-time protection that is certified by all major Linux vendors.

Download now! »

White paper

Centrally Managed Virus Protection for Windows and NetWare

With the emergence of mixed threat attacks, a failure on a single server can quickly impact the entire network. Learn how a technology that is designed to remove and block infected files on application and file servers prevents the virus from reaching users and keeps your Windows network free from malware.

Download now! »
©1994-2009 Infoworld, Inc.