NZ Researcher Uncovers Hacking Techniques Against Vista

Ben Hawkes, a Security Researcher from New Zealand, has conducted a research that uncovers techniques of hacking for invading the Vista software, a memory management component that each of the applications from Microsoft Word to Web programs uses.

According to Hawkes, a bug exists in these program applications known as the memory corruption bug. Historically, the bug has been causing severe security hazards because malicious users can use them to execute arbitrary code; thus, enabling attackers to create an unwanted backdoor component or to install a keylogger, as reported by ComputerWorld on August 25, 2008.

Furthermore, Hawkes said his research doesn't pose a danger to the Internet world, as it doesn't present a security flaw. Rather, a malicious user could utilize his study as a means to leverage security flaws. Also, it is expected that his discoveries would become a problem by the next six months when attackers and researchers might find security flaws that may allow them to apply the hacking techniques.

During the Black Hat conference held in Las Vegas, Hawkes explained the way for launching attacks against the Vista heap application. He indicated that there are several techniques of attack to execute malicious code in Vista. This essentially involves erasing anything saved on the processor using a specially designed payload and maneuvering execution of arbitrary code on the subsequent heap allocation. This process of joining heap sprays in a chain is repeated till the whole space is occupied with freshly created heaps.

Security experts said that the heap forms the main area of memory storage in Vista that is used by the operating software to allocate program-processing resources.

Moreover, Hawkes advised Microsoft that they need to attach guarded mappings and guard pages, taking out all the arrangements from the heap that lead to area of corruption. Also, the Vista checksum need to be always validated prior to using the header chunks. It defends the next chunk from being overwritten.

Furthermore, Hawkes also stated that his recommendations are quite easy to implement, as reported by searchsecurity on August 7, 2008.

Related article: NZ Banks could Change their IP Addresses to Prevent Phishing

» SPAMfighter News - 03-09-2008

All SPAMfighter products offer a free trial!

SPAMfighter is a free spam filter for Outlook, Outlook Express,Windows Mail, Windows Live Mail and Thunderbird.

Optimize your Slow PC for better performance. Try FREE scan now

Disk space recovery
and disk optimization. Try FULL-DISKfighter free

SPAMfighter Exchange Module is a Spam filter for Exchange server - Free 30 days trial.

Remove Spyware with SPYWAREfighter - Free 30 days trial

Antivirus software for your Windows PC - Free 30 days trial