Text 12452, 113 rader
Skriven 2006-08-07 16:15:00 av Rich Gauszka (1:379/45)
Ärende: 'I just hit accept' Vista security a no show at Blackhat
================================================================
From: "Rich Gauszka" <gauszka@hotmail.com>

 When she was asked from the audience how did she bypassed the security
levels implemented in Vista, Rutkowska replied: "I just hit accept."


http://www.playfuls.com/news_03832_Windows_Vistas_Security_Privileges_Bypassed_
by_Blue_Pill.html

 No, it's not a joke. It's a real fact that happened at the Black Hat
conference. And, as always, a woman is involved.

Security in Windows OS has always been a painful thorn for the Redmond giant,
so they have been striving to improve in their next-generation OS Vista the
overall safety, by applying multiple stages in security privileges.

But a Polish expert working for a Singapore security company demonstrated at
the Balck Hat conference last week that it is possible to bypass these
privileges using.the famous Blue Pill! Well, this is how she called her
rootkit-like malicious software.

The Redmond giant thought it's best to go directly into the beast's lair,
instead of waiting for the beast to attack. So they released a limited and
exclusive version of their up-coming OS to 3,000 security professionals at the
Black Hat conference this week.

They have also indicated to the security gurus gathered there the steps made by
the Redmond-based company in improving the overall security levels in Vista.
The multi-leveled security architecture of Windows Vista should reduce to
minimum the impact of malicious software code, making sensitive data like
social numbers, bank accounts or passwords more secure.

Joanna Rutkowska showed to the attendees at Black Hat how it is possible to
avoid the security measures adopted in Windows Vista which are meant at
preventing or limiting malware's access to a computer.

Not only has the Polish security expert showed how to bypass security measures,
she also showed how to use virtualization technology in order to transform a
malicious code to make it "invisible" or undetectable.

"Microsoft is investigating solutions for the final release of Windows Vista to
help protect against the attacks demonstrated," a representative for the
Redmond giant said. "In addition, we are working with our hardware partners to
investigate ways to help prevent the virtualization attack used by the Blue
Pill."

The demonstration of how to trick Windows Vista's "locks" gathered a lot of
people in Caesar's Palace in Las Vegas, despite of the fact that it was the
last day of Black Hat conference and it was one of the last events there.
According to her declaration, Rutkowska used an early version of Vista to
achieve this "performance".

Since Vista is mainly destined for 64-bit systems, Microsoft added a mechanism
of protection against unsigned drivers, which should hinder them to run on the
64-bit version of Vista.

But the Polish technician also managed to make an unsigned driver to work on
beta versions of 64-bit Vista, which could pose serious threats to infected
machines. Security experts have warned about the fact that running at low
levels in the operating system, unsigned drivers could eventually remain
undetected.

"The fact that this mechanism was bypassed does not mean that Vista is
completely insecure. It's just not as secure as advertised," Rutkowska said.
"It's very difficult to implement a 100 percent-efficient kernel protection."

The good news for Microsoft is that in order to perform an attack Vista has to
run in administrator mode. That means her attack would be foiled by Microsoft's
User Account Control, a Vista feature that runs a PC with fewer user
privileges. UAC is a key Microsoft effort to prevent malicious code from being
able to do as much damage as on a PC running in administrator mode, a typical
setting on Windows XP.

When she was asked from the audience how did she bypassed the security levels
implemented in Vista, Rutkowska replied: "I just hit accept." That was a
reference at what most users will probably do at seeing the multitude of
security windows which pop-up in Vista, a reaction that might expose their PCs
to infection.

Throughout the company development of Vista, Microsoft has applied a new
process known as SDL (Security Development Lifecycle), which requires that all
of the operating system's code is scoured for potential problems before being
added into the product.

Through SDL and "fundamental architectural changes" that will help make
customers more secure from evolving threats, including worms, viruses and
malware, Microsoft says that it has effectively minimized Vista's "attack
surface area."

"Windows Vista has many layers of defense, including the firewall, running as a
standard user, Internet Explorer Protected Mode, /NX support, and ASLR, which
help prevent arbitrary code from running with administrative privileges," the
Microsoft representative noted.

Blue Pill, the malicious software code that bears the nick-name of the famous
Pfizer product, is a "silent" software, created using the Pacifica
Virtualization technology from AMD. This is why some voices speculated that
Rutkowska's work was secretly funded by AMD's rival, Intel. Rutkowska denied
these allegations.

"Some people suggested that my work is sponsored by Intel, as I focused on AMD
virtualization technology only; that is untrue."

If Vista does not meet the security standards imposed by the inside SDL
commission, it will be postponed again.This is what Bill Gates himself said to
a group of partners of Microsoft in Cape Town, South Africa.

"We got to get this absolutely right," Bill Gates said at the conference. "If
the feedback from the beta tests shows it is not ready for prime time, I'd be
glad to delay it."

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)