Microsoft (and/or vendors who aren't required not to flip a bit) could ship Outlook defaulted not to run scripts or run attachments, but they refuse to do so. This would be a nearly trivial change.

Instead they propose some platform that won't fix anything.

What happens if you DO have a buffer overflow in a signed module? It will probably run at the privilege level of the signature if you don't fix the fundamental problem with the exploit (it normally only verifies the signature once on loading). It might reverify, but unless there is a way of insuring the PC is within a range, or that you have something like separate code and data stacks, or any of a dozen other things that will solve the problem without requiring any signature, the signature will simply mean that the program is signed.

Drivers are now signed, but is there really any way to insure there is not backdoor? What about a DMA device - you could use a driver to tell it to overwrite a page or two as part of the normal programming. It would be signed, but so what? Does/Will Microsoft audit all the code it signs, or merely insure there is an entity to blame?


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/96/15738#15738