Text 32101, 94 rader
Skriven 2007-05-10 06:48:14 av Jeff Guerdat
Ärende: more on DEP
===================
 From the current Windows Secrets newsletter (I added the links to the 
various references):

Readers' revelations on DEP

By Scott Dunn

Windows' Data Execution Prevention (DEP) feature provides important 
protection against malicious code, as I described in my May 3 article 
(http://tinyurl.com/22otw3).

But additional free tools reported by our readers make the feature even 
more accessible to users of Windows XP.

Finding hardware DEP support in XP

Richard Wilcox has important information that will be of interest to XP 
users:

     * "Windows XP SP2 does indeed support hardware DEP, if you have an 
AMD or Intel processor with this feature, according to a Microsoft 
Knowledge Base article (http://tinyurl.com/4wlun)."

As Richard points out, this feature was first introduced with XP Service 
Pack 2 (SP2). Note, however, that the Data Execution Prevention tab in 
SP2's Performance Options dialog box does not report on your hardware's 
DEP capabilities, the way Vista's dialog box does.

Fortunately, other readers, including Stuartt Cuthill, point out that 
you can get this information by using a very simple freeware 
application, Securable, from Gibson Research Corporation 
(http://tinyurl.com/265w4b).

Detecting DEP settings in XP

A number of readers, including Jeff Kohut, pointed out that XP users can 
also detect whether DEP is enabled for a particular process by 
downloading the free Sysinternals utility Process Explorer from 
Microsoft (http://tinyurl.com/sjzno).

Process Explorer mimics most features of Task Manager and can be set up 
to display DEP status by choosing View, Select Columns. Check DEP Status 
on the Process Image tab and click OK.

Windows, not your browser, controls DEP

One reader, identified as "Molotov," also uses Process Explorer and has 
a number of useful points about DEP:

     * " 'Hacker programs' are not the only kinds of programs that can 
utilize the behavior DEP is designed to prevent. Indeed, the technique 
is so common that Microsoft decided to change the default setting for 
DEP in XP SP2 from OPTOUT (Enable DEP for all executables, except those 
specified) to OPTIN (Enable DEP for core Windows system images) because 
in service pack testing, so many programs were affected by DEP.

       "The discussion of browsers and their ability to ignore the DEP 
settings was interesting to me, as I am running XP SP2 (DEP setting of 
OPTOUT), and both IE 7 and Firefox run with DEP enabled (On, as reported 
by Process Explorer for firefox.exe and iexplore.exe) on my system.

       "This makes me question the statement, 'XP users apparently have 
no way to activate DEP for IE 7.' IE 7 (as well as IE 6) respect the 
operating system's DEP setting. Though I did not try other browsers in 
these VPC images, I suspect the results would be the same as my findings 
for IE 6/IE 7 and my experience on my 'real' system. Add-ons for the 
browsers could certainly have an impact on the experience one has with 
the DEP setting enabled for the browser process, which may lead one to 
add the process to the DEP exclusion list.

       "The statement, 'IE 7 is not the only program that ignores 
Windows global DEP settings. Even with DEP turned on globally, Task 
Manager shows that neither Mozilla Firefox nor Opera support DEP,' is 
misleading, in the sense that what Task Manager (or Process Explorer) is 
really showing is that DEP is or is not 'enabled' or 'turned on' for the 
particular process, not that the process does or doesn't support DEP."

As Molotov points out, it's the hardware and Windows operating system 
that controls DEP, not individual applications. It now appears that XP 
does enable DEP for browsers when you choose Turn on DEP for all 
programs and services except those I select.

However, this is not the case in Vista, which may be excluding browsers 
for compatibility's sake, despite the user's DEP setting. It remains the 
case that in Vista, IE7 is the only browser that can have DEP enabled. 
This requires a setting change in the Internet Properties Control Panel, 
as described in the May 3 article.
-- 
Jeff Guerdat

The two most abundant things in the universe are hydrogen and stupidity.
                                                          Harlan Ellison
--- Platinum Xpress/Win/WINServer v3.0pr5a
 * Origin: FidoTel & QWK on the Web! www.fidotel.com (1:275/311)