Over at the Black Hat convention being held in Las Vegas two researches have hacked though the security features that Microsoft had put in place for Windows Vista. It is unfortunate that the Redmond giant is going to be embarrassed once again, but heh people, what did we really expect? Did anyone with half a brain really think that Vista was going to be more secure than Windows XP? Or am I being too negative? In this article it states:

 LAS VEGAS — Two security researchers have developed a new technique that essentially bypasses all of the memory protection safeguards in the Windows Vista operating system, an advance that many in the security community say will have far-reaching implications not only for Microsoft, but also on how the entire technology industry thinks about attacks.

In a presentation at the Black Hat briefings, Mark Dowd of IBM Internet Security Systems (ISS) and Alexander Sotirov, of VMware Inc. will discuss the new methods they’ve found to get around Vista protections such as Address Space Layout Randomization(ASLR), Data Execution Prevention (DEP) and others by using Java, ActiveX controls and .NET objects to load arbitrary content into Web browsers.

By taking advantage of the way that browsers, specifically Internet Explorer, handle active scripting and .NET objects, the pair have been able to load essentially whatever content they want into a location of their choice on a user’s machine.

Researchers who have read the paper that Dowd and Sotirov wrote on the techniques say their work is a major breakthrough and there is little that Microsoft can do to address the problems. The attacks themselves are not based on any new vulnerabilities in IE or Vista, but instead take advantage of Vista’s fundamental architecture and the ways in which Microsoft chose to protect it.

“The genius of this is that it’s completely reusable,” said Dino Dai Zovi, a well-known security researcher and author. “They have attacks that let them load chosen content to a chosen location with chosen permissions. That’s completely game over.

I think we Windows users just need to accept the fact that the word ‘security’ in Windows is a joke and Microsft will never be able to secure their operating system.  Microsoft is going to struggle getting businessess to take the bait and switch to Vista.

What do you think? Are you feeling all warm and fuzzy for having switched to Vista? Or are you glad you stayed with XP?

Comments welcome.

Source.