Vuln Dev
RE: Next generation malware: Windows Vista's gadget API Sep 14 2007 07:56PM
Roger A. Grimes (roger banneretcs com) (1 replies)
Yes, this is a "new" attack vector, but it is always game over anyway if
I can get you to run my untrusted program. In my testing, installing
any Vista sidebar gadget results in a minimum of 3 warnings, each saying
that the code being installed could be harmful, before it is installed.
5 warnings if the gadget is unsigned.

It's something to be aware of, because malicious hackers will exploit
them, and many end-users will ignore any warning, but not the most
worrisome problem on my plate. Secondly, I can completely control the
install of any gadgets in my environment using Active Directory group
policies to a granular level.

Roger

*******************************************************************
*Roger A. Grimes, Senior Security Consultant
*Microsoft Application Consulting and Engineering (ACE) Services
*http://blogs.msdn.com/ace_team/default.aspx
*CPA, CISSP, CISA MCSE: Security (2000/2003), CEH, yada...yada...
*email: roger (at) banneretcs (dot) com [email concealed] or rogrim (at) microsoft (dot) com [email concealed]
*Author of Windows Vista Security: Security Vista Against Malicious
Attacks (Wiley)
*http://www.amazon.com/Windows-Vista-Security-Securing-Malicious/dp/0470

101555
*******************************************************************

-----Original Message-----
From: Tim Brown [mailto:tmb (at) 65535 (dot) com [email concealed]]
Sent: Thursday, September 13, 2007 5:17 AM
To: vuln-dev (at) securityfocus (dot) com [email concealed]; webappsec (at) securityfocus (dot) com [email concealed];
full-disclosure (at) lists.grok.org (dot) uk [email concealed]; bugtraq (at) securityfocus (dot) com [email concealed];
news (at) securiteam (dot) com [email concealed]
Subject: Next generation malware: Windows Vista's gadget API

A paper has just been released on the Windows Vista's gadget API. The
abstract is as follows:

Windows has had the ability to embed HTML into it's user interface for
many years. Right back to and including Windows NT 4.0, it has been
possible to embed HTML into the task bar, but the OS has always
maintained a sandbox, from which the HTML has been unable to escape. All
this changes with Windows Vista. This paper seeks to inform system
administrators, users and the wider community on both potential attack
vectors using gadgets and the mitigations provided by Windows Vista.

The full paper can be found at
http://www.portcullis-security.com/165.php.

Cheers,
Tim
--
Tim Brown
<mailto:tmb (at) 65535 (dot) com [email concealed]>

[ reply ]
RE: Next generation malware: Windows Vista's gadget API Sep 15 2007 12:55PM
pgut001 cs auckland ac nz (Peter Gutmann) (1 replies)
Re[2]: [Full-disclosure] Next generation malware: Windows Vista's gadget API Sep 16 2007 12:34PM
Thierry Zoller (Thierry Zoller lu) (2 replies)
Re: Re[2]: [Full-disclosure] Next generation malware: Windows Vista's gadget API Sep 17 2007 06:47AM
pgut001 cs auckland ac nz (Peter Gutmann)


 

Privacy Statement
Copyright 2010, SecurityFocus