Vista RC1 still vulnerable to cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 pagefile attack

Everybody talks now about cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 latest Vista RC1 and how ready it is for being shipped to customers. So, I downloaded Vista RC1, Build 5600, x64 edition from MSDN a couple of days ago and gave it a try... To my surprise, it turned out that it's still vulnerable to cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 signature check bypass attack which I demonstrated nearly 2 months ago at cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 SyScan conference...

This is not good, because, on cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 one hand, Vista requires all kernel drivers to be digitally signed (for security reasons), which, in turn requires that all driver developers get (read: buy) an appropriate signing certificate, but on cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 ocá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r hand, malware authors can load cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir code into kernel for free (without reboot, as I demoed during cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 talk).

The requirement for having all kernel drivers digitally signed raised a lot of controversy when it was announced by Microsoft in January. People argued not only about cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 fact that paying for a certificate might be unacceptable for e.g. students or open source authors, but also about more "philosophical" aspect that it should be cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 user's (administrator's) right to load whatever she wants on her own computer, regardless whecá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r somebody has signed it or not.

Personally, I think that it's worth to sacrifice a little bit of "freedom" and to spend a few hundred bucks on a certificate in case you're a kernel developer, if this can stop kernel malware from loading. Even though kernel protection can be implemented without PKI, as we can see in case of BSD systems and cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir securelevel mechanism (although an attack has been presented against it a few months ago), I still think that a scheme based on digital signatures is cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 best solution for end-users. However, it's definitely not worth to sacrifice that all, if cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365re is a known way for bypassing this mechanism... :(

It's quite surprising for me that MS still hasn't fixed that problem, especially that cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 best solution here is also cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 simplest one to implement. As I described during my talk, it's just enough to... disable kernel mode memory paging. Surly, it would cause a little waste of memory, but according to some Microsoft engineers I spoke to, it would be only around 80MB. This seems very little cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365se days, doesn't it? After all, are people going to run Vista with 256MB or even 512MB of RAM? I'm not ;)

Anocá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r good solution (and I think it was Brad Spengler of grsecurity who pointed that out to me) would be to calculate a hash for each page which is going to be paged out and cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365n check this hash again on each page which is about to be loaded into memory again. Not that simple as cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 previous solution, but at least we're saving those 80MB of physical memory :)