Notícia interessante sobre uma nova forma de segurança no núcleo do sistema.
Uma forma de prevenção de ataques chamada de "Desligamento Seguro" ajuda a aumentar a segurança e a prevenir vulnerabilidades conhecidas como ataques de "pool overrun". Isto fará com que a experiência do Windows 7 seja mais rápida, mais confiável e acima de tudo, mais segura por tornar mais difícil para as pessoas lançarem esses ataques.
Fica residente na seção de alocação de memória do núcleo e realiza uma série de checagens para detectar corrupção de memória, e possíveis ataques de "pool overrun".
O que é um ataque de "overrun"?
A resposta é "Memória (na pilha) é alocada dinâmicamente pelo aplicativo no seu momento de execução e contém, tipicamente, dados do programa. O "abuso" é executado quando se corrompe esses dados de maneiras específicas para fazer com que o aplicativo sobregrave estruturas internas tais como os ponteiros ligados listados"
---x---
Windows 7 kernel new feature called Safe Unlinking, Security Issue
The Windows 7 kernel has a new feature called “Safe Unlinking”, to help increase security and prevent vulnerabilities known as pool overrun attacks. This will make the experience of using Windows 7 faster, more reliable and above all, safer by making it harder for people to launch these attacks.
It sits in the memory allocation section of the kernel and performs a series of checks to detect memory corruption, and potential pool overrun attacks. This is the latest in a succession of new security features that MS have been adding over the last few years including:
- Stack protection (/GS)
- Data Execution Prevention (DEP)
- Heap Protection
- Address Space Layout Randomization (ASLR)
- Structured Exception Handler Overwrite Protection (SEHOP)
Peter Beck, from Microsoft’s Security Research & Defense team says:
This simple check blocks the most common exploit technique for pool overruns. It doesn’t mean pool overruns are impossible to exploit, but it significantly increases the work for an attacker
What is an overrun attack?
The answer is "Memory (on the heap) is dynamically allocated by the application at run-time and typically contains program data. Exploitation is performed by corrupting this data in specific ways to cause the application to overwrite internal structures such as linked list pointers "
Safe Unlinking will also help improve the reliability of Windows 7 by performing a Bug Check as soon as an overrun is detected, which will prevent further memory corruption, crashes and errors.
(Read full article at source)
Source: Microsoft TechNET Security Research & Defense
---x---
Perdoem os erros de tradução. :thumbs_up