May 2006 - Posts

Address Space Layout Randomization in Windows Vista
26 May 06 01:24 PM

Windows Vista Beta 2 includes a new defense against buffer overrun exploits called address space layout randomization. Not only is it in Beta 2, it’s on by default too. Now before I continue, I want to level set ASLR. It is not a panacea, it is not a Read More...

Postedby michael_HOWARD | 72 Comments    

Filed under: Security, Vista

Windows Vista Security Enhancements
25 May 06 11:07 AM

A paper has just been made available that outlines some of the security improvements in Windows Vista Beta 2. Read More...

Postedby michael_HOWARD | 12 Comments    

Filed under: Security, Vista

PREfast, SAL and the Windows SDK
23 May 06 10:24 AM

In a prior article I wrote about the benefits of the Standard Annotation Language (SAL) available in various high-end versions of Visual Studio 2005. The good news is the Windows SDK released for Windows Vista Beta 2, also includes PREfast and can therefore Read More...

Postedby michael_HOWARD | 9 Comments    

Filed under: Security

Online Crypto Class Available
22 May 06 01:15 PM

Caveat: This is my first blog posting from within Office 2007 beta 2, so I hope it comes out ok! Lecture materials from the University of Washington’s cryptography class have been posted on-line . Recordings of the lectures are also available on-demand Read More...

Postedby michael_HOWARD | 3 Comments    

Filed under: Security

A Brief Introduction to the Standard Annotation Language (SAL)
19 May 06 12:22 PM

Introduction Even though a prior blog I wrote “ Code Scanning Tools Do Not make Software Secure ” may have left some thinking I don’t like static analysis tools, nothing could be farther from the truth. In fact, there is a code analysis technology designed Read More...

Postedby michael_HOWARD | 25 Comments    

Filed under: Security

Attachment(s):SAL.pdf

Privacy Breach Impact Calculator
07 May 06 10:17 PM

Cute! http://searchsecurity.techtarget.com/general/0,295582,sid14_gci1182844,00.html?track=NL-430&ad=551180 Read More...

Postedby michael_HOWARD | 1 Comments    

Filed under: Privacy

SetSAFER and .NET Framework 2.0
07 May 06 09:22 PM

Ages ago I wrote a surprisingly well read couple of articles about dumbing down an admin token and running an application with that reduced-privileged token. You can read the articles here and here if you have no clue what I'm talking about it. I wrote Read More...

Postedby michael_HOWARD | 4 Comments    

Filed under: Security

Attachment(s):SetSafer.zip

New hire into our group - James Whittaker
05 May 06 10:20 AM

I’m pleased to announce, actually I’m *thrilled* to announce, that James Whittaker has joined our group. James is a well-known author and speaker on software testing and security. He most recently worked as a professor of computer science at Florida Tech Read More...

Postedby michael_HOWARD | 7 Comments    

Filed under: Security