Assessment of Windows Vista KernelMode Security
Short summary:
enhancements in Windows Vista are quite substantial resulting in a dramatic reduction of its overall attack surface. However we ...
Long summary:
Assessment of Windows Vista KernelMode Security Page 1SYMANTEC ADVANCED THREAT RESEARCH 1Assessment of Windows Vista KernelMode Security Matthew Conover Principal Security Researcher Symantec CorporationAbstractWindows Vista introduces several additional barriers that aim to prevent malicious code from gaining access to the operating system kernel. This paper is intended to provide a technical review of their implementation. The kernel mode securityenhancements in Windows Vista are quite substantial resulting in a dramatic reduction of its overall attack surface. However we have identified certain weaknesses in the kernel enhancements that may be leveraged by malicious code to undermine these improvements. I.INTRODUCTIONindows Vista introduces a number of security enhancements over prior versions of Microsoft Windows (includingWindows XP SP2). The new kernelmode security features in Windows Vista include among them:W Driver signing 1]PatchGuard 2]Kernelmode code integrity checks 3] Optional support for Secure Bootup using a TPM hardware chip 4]Restricted usermode access to DevicePhysicalMemory 5] These changes may secure the kernel of Windows Vista 64bit Edition significantly; even when compared to that of Linux orMac OS X. The contributions of this paper are: (1) a thorough analysis of the kernelmode security components through reverse engineering and (2) an assessment of potential kernelmode attacks. A.Whats CoveredThis paper examines the new security features that have been incorporated to keep malicious code from compromising the kernel. Since most of these features are only available in the 64bit edition of Windows Vista this paper will focus on the 64bit edition.B.Whats Not Covered This paper does not review the implementation of PatchGuard. An analysis of PatchGuard was performed previously by Skape and Skywing 6] however it should be noted that its implementation has since changed. Only some attacks against PatchGuardwill be discussed. An assessment of ...
Source: www.symantec.com
Related
Windows Vista and Tenant Pro 7, Windows Vista has very strict security
features, even when ... Pro 7 on a
computer with Windows Vista, it is
important to initiate the ... 7 in Windows
Vista ...,
more
Windows Vista Business a Visual Experience, ... Windows Vista, make sure you run the
vista compatibility ... Windows Vista adds
several. new ... Windows Vista now allows
you to schedule. this. The ...,
more
Autodesk and Windows Vista, applications with Windows Vista and
Microsoft's adoption of the Autodesk DWF
... While Autodesk believes that Windows
Vista will become the industry-standard OS
...,
more
