Windows Vista - najsigurniji klijentelski OS današnjice
Citat:
Section Reordering lines up executable image sections so that a single data overflow can’t take out, say, the global offset table.
EXE randomization, a la PIE, randomizes the layout of text sections in position-independent code.
DLL randomization makes the base addresses of DLLs random so that shellcode won’t know the address to jump to to reach sensitive functions.
Frame Protection for the stack inserts unpredictable cookie values and runtime checks to make sure stack frames aren’t overwritten.
Exception Checks do the same thing for exception handlers, which are function pointers stored in reliable locations and a target for overflows.
Local Variable Protection creates checked guard values next to overflowable stack buffers.
Stack Randomization makes stack address offsets unpredictable.
Nonexecutable stacks use hardware page protection to prevent code from running on the stack at all, meaning shellcode needs to be stored somewhere else.
Heap Metadata Protection a la Win32 XOR’s key fields in the allocator tracking structures so that they don’t have predictable valid values.
Randomization in the heap works like randomization in the stack, and
The heap can also be made non-executable.
Ovo nisu neke crappy security featurez tipa "enkripcija direktorija" koje zahtijevaju korisničku interakciju, ovo su proaktivne zaštite koje automatski čine OS manje podložnim eksploataciji.
Netko rekao da su Windowsi nesigurni? ;)
