Windows Vista has an insecure programming vulnerability era approaching

Although Microsoft is trying to reduce the risks caused by Vista security vulnerabilities, this may mean that a new era of insecurity is approaching.
Microsoft is hailed as the safest new generation of Computer Operating System Windows Vista. It has a programming vulnerability that may allow hackers to completely control computers with vulnerabilities.
However, Microsoft and independent security researchers have tried their best to reduce the risks caused by this vulnerability. The vulnerability was first disclosed on a Russian website and is clearly the first vulnerability in the New Vista system released to large companies by the end of last November.
The software company claims that it is investigating the threat, but so far it has found that hackers must be able to access computers with vulnerabilities to launch attacks.
Vulnerability overcast cloud
The final conclusion of this vulnerability is that it cannot be exploited remotely to write malware or break the Vista system. Its only historical significance is that this is the first vulnerability reported that will also affect Vista, without any substantive significance. However, some experts said: "theoretically, if an attacker has low-level access permissions on a vulnerable machine, the vulnerability can be used to increase the permissions and ultimately control the entire system ."
This vulnerability also affects earlier versions of Windows. Hypponen said that vulnerabilities like this are common and can be solved using software patches-Microsoft regularly releases patches on the second Tuesday of every month (in the face of extremely serious threats, will be released temporarily ). However, the vulnerability remains at the conceptual level, and no actual cases of attacks are found.
Mike Reavey, Microsoft's senior security manager, claims that he still believes that "Windows Vista is the safest platform we have ever had ." However, most security researchers believe that a complex product such as Vista cannot have no errors at all, so it is only a matter of time that someone finds a security vulnerability.
Recently, the Vista operating system has even revealed its first major vulnerability. On October 30, March 29, Rising anti-virus experts discovered that the vulnerability had already been exploited by hackers. users using Windows Vista and XP were infected with viruses such as Weijin and Trojan horses when accessing websites with viruses. According to monitoring, nearly 10 websites in China have been attacked by hackers.
The arrival of the new insecure age?
For Vista, the problem is not just the discovered vulnerabilities. George Heron, chief scientist at McAfee, said a controversial Vista technology could bring about a new era of insecurity.
For decades, Microsoft has relied on third-party security software vendors in every Windows operating system before Vista to help protect user security. These products protect consumers and enterprise users from threats from viruses, spyware, Trojans, worms, and recent rootkit and other malware. These security products from independent software developers even help ensure that people's computers are not affected by Microsoft's serious Software defects.
Microsoft's "buffer overflow" and "Internet Explorer vulnerabilities" are common in the IT industry. However, users can also choose security products of companies such as McAfee, Symantec, and Check Point to ensure the security of the computing experience.
Over the years, users have always been able to choose the best security solution from many companies that provide mature and innovative security products. However, this collaborative and relatively secure computing experience is worse in Vista.
Microsoft has deployed PatchGuard to prevent other software from accessing the Vista kernel service. In all earlier versions of Windows, other software can access these kernel services.
In short, once a specific internal data structure is detected to be "Hooked"-a common way for malicious code to begin to corrupt, PatchGuard will crash the computer.
However, good advanced features of behavior detection and intrusion protection software also adopt this working principle. Therefore, while trying to block the bad guys, PatchGuard also makes some advanced security functions unable to run normally, and users' security will be greatly reduced.
A simple example of this severity is the sudden onset of a new batch mail worm. When security products scan files containing viruses and find the characteristics of malware, known viruses can be found during transmission. If the bit mode of the known virus is consistent with the inbound file mode, the file will be isolated or deleted according to the security policy.
However, the new virus has no features, because the virus research team has not studied it, so this Zero-day Attack will bypass the traditional anti-virus detection mechanism in the kernel. Then, when the infected file is run and the virus is eventually carried into the computer, it will be parasitic on the computer and immediately start to cause major damage.
If security software tries to stop a virus attack at this time, an interesting scene will appear. In addition to the basic feature file scanning technology mentioned above, all modern anti-virus software includes a technology called Heuristical Behavior Detection, it is designed to prevent zero attacks on batch mail worms like the one just introduced.
Anti-Virus Software hooks application interfaces (APIS) to study the behavior of worms calling the kernel. By analyzing specific API calls and the order/frequency of calls, you can determine that the worm is active in the system. Then, the anti-virus software sends an "Application termination" call to the kernel to kill the worm, so that the user is safe.
Of course, this simple example does not introduce other details. However, the main point is that the most advanced anti-virus software currently works like this: first detects virus features and then uses behavior detection technology to discover new zero-time attacks. The worst part of this example is that PatchGuard will block this zero-day attack based on behaviors that cannot be used normally.
The standard technology that security vendors have been using for a long time: the function of capturing APIs and terminating applications is actually disabled. In addition, Microsoft, which does not have a similar detection technology, prevents security vendors from using these advanced features in anti-virus software packages-even if Microsoft does not.
The result is that compared with the XP era, user security is significantly reduced. In the XP era, security vendors can also use advanced behavior detection functions.
Everyone may have to expect Microsoft to realize as soon as possible that it should pay attention to the calls for simple changes to Vista in the industry and pay attention to the practices.