Vista insecurity
Connecting state and local government leaders
Presenters at the Black Hat briefings highlight weaknesses in Microsoft's Vista OS.
The truism that there is no such thing as perfect security was demonstrated at the Black Hat Federal Briefings being held in Arlington, Va.
Give a hacker or a researcher a little time and he will find ways around or through most security features and tools. Presenters at the conference Thursday highlighted weaknesses in Microsoft's Vista operating system that could buffer overflow attacks and showed methods for bypassing most network access control tools.
'Vista has gone through a very aggressive security development lifecycle,' said Ollie Whitehouse, a security analyst with Symantec Corp. But it turns out that a tool used to randomize the addresses of data to hide it from hackers is not quite as random as it could be.
'It doesn't necessarily provide the level of security we would have expected,' Whitehouse said. 'It's not the end of the world. But it does increase the likelihood of successful exploitation.'
Vista is the first Windows operating system to natively support Address Space Layout Randomization. This technique puts programs and associated memory in random locations between reboots or executions, making them more difficult to attack.
'It makes exploitation of vulnerabilities more difficult simply because you don't know where anything you need is in memory,' Whitehouse said.
Whitehouse examined how information was distributed through the address space of Vista as part of a larger Symantec examination of the operating system. Over 11,500 executions, some significant biases were discovered in address allocation for some functions, reducing the effectiveness of ASLR.
'They are going to fix this' in the release of Service Pack 1 for Vista, he said. He also praised the company for its assistance in the research. 'Microsoft was extremely candid, and I didn't expect them to be quite so helpful.'
This is not likely to be the only problem the company will have to address.
'This was a relatively quick assessment by one guy,' Whitehouse said. He said he had talked to three people at the Black Hat conference who had suggested different avenues for examining ASLR. 'I don't think this will be the only issue discovered.'
In his presentation, Insightix chief technology officer Ofir Arkin looked at the entire range of network access control products and found that all offered weaknesses that could be used to bypass them.
This area of security is so new that 'nobody knows how to define it,' Arkin said. 'Nothing is standardized.'
Generally, network access control tools must be able to identify and understand devices on the networks they are protecting, authenticate connecting devices, perform configuration analysis to ensure that they conform to security policies, and allow access based on authorization policies.
But 'IT is a jungle,' and networks are so complex and dynamic that just fully understanding a network is a difficult challenge,' Arkin said.
Almost any implementation of access control, be it Cisco's NAC, Microsoft's Network Access Protection or the Trusted Computing Groups Trusted Network Connect, offers vulnerabilities. Just finding out where they are placed in the network can give a hacker an edge.
'In most cases, when you analyze the architecture you will find the holes you need to bypass the solution,' Arkin said.
Many access control systems quarantine devices that are trying to connect until they have passed a configuration examination. That sandbox can be a major opportunity for hackers, because it is likely to contain poorly secured devices that could be compromised.
'I'd like to be in the quarantine,' Arkin said. 'That's the happening place.'
Despite growing demand for better methods of access control, the sector remains immature at this point and no completely reliable solutions have emerged, he said.