The memory protections in Windows Vista are largely ineffectiveat preventing browser exploitation. This was the position taken by tworesearchers presenting at the Black Hat conference in Las Vegas.
To prove the point, the researchers, Alexander Sotirovand Mark Dowd, showed an exploit that loaded from Internet Explorer despite allenabled memory protections built into the Vista operating system.
In explaining the problem, the researchers said that mostmemory protection mechanisms are based on two things: detecting corruption andstopping common exploit patterns, and attempts to reinforce these are integralto Vista. But in many cases, some of the built-in protection mechanisms inVista are not enabled by default for compatibility reasons.
“At the desktop level, compromises had to be made becauseof compatibility issues. Exploiters have a lot more control over browsers,”Sotirov said.
And in many cases, third-party applications are notcompiled to use the Vista memory protections. For example, Java and Flash are notcompiled using the critical protection called ASLR.
According to the researchers, part of the reason for thissituation is Microsoft's focus on Vista server processes, for which theprotections are relatively effective.
According to Sotirov, “This points up the need for morework on secure browser architecture.”