Microsoft Defence Against Security Measures Exploitation in Windows 7

Microsoft defended its security features present in Window 7 after their recent exploitation at the event of Pwn2Own hacking contest. Both hackers successfully bypassed DEP and ASLR just in two minutes but Microsoft product manager Pete Lepage tried to defend the position by saying that these features are not meant for preventing every attack. It means that even toady it is not possible for everyone to outwit these security mechanism, it could only happen in a couple of cases where someone have done a lot of work to find all flaws and loopholes in their full proof security system.

Moreover, Pete also discussed about ‘Protected Mode’ which is another security measure present in Windows 7 along with DEP and ASLR. Protected Mode is something like sandbox technology which makes IE run on restricted rights. Such restricted environment is specifically designed to restrict the activity of attacking code within browser because it dose not let it go to other parts of computer to disrupt normal functioning.

Robert Hensing who is an engineer at Microsoft Security Response Center acknowledged that DEP is not a robust mitigation itself but when used together with ASLR makes situation tricky for most of the hackers to bypass it.

It is also noteworthy that earlier this month, a Google engineer who has been serving at Microsoft previously posted proof of concept code to prove the vulnerability of DEP but at that time Microsoft dismissed the fact by saying that even DEP skirting can not compromise computer security at all. But they realized that such publication will enhance the chances of exploitation which was later revealed at Pwn2Own hacking contest.

On the other hand winning hacker Peter Vreugdenhil claimed that it took only 6 to 7 days to completely workout everything needed to make use of flaws for successful exploitation but he has not yet revealed the detail how he did it because it is against the contest rules to reveal everything before flaws are fixed.

Moreover Charlie Miller who has been winning the hacking contest continuously from 2008 to 2010 admitted the fact that things are becoming complicated and difficult with every passing year. Now you have to find a strong flaw to bypass the double edged sword of DEP and ASLR present in Windows7 operating system.