September 2006 - Posts

Silver Bullet Security Podcast Interview
29 September 06 09:41 AM

Gary McGraw (CTO of Cigital , and author or co-author of many security books, including Building Secure Software , Exploiting Software and Software Security ) interviewed me a few weeks ago as part of his Silver Bullet Security Podcast series. You can Read More...

Postedby michael_HOWARD | 1 Comments    

Whatever Happened to sprintf(..., “%n”,...)?
28 September 06 10:56 AM

You may have noticed that if your code calls functions in the sprintf family and the format template string uses the %n parameter, then it fails to run correctly after it is compiled with Visual Studio 2005. Why? Well, it's pretty simple, by default we Read More...

Postedby michael_HOWARD | 6 Comments    

Filed under: Security

Visual Studio 2005 SP1 Beta, Windows Vista and ASLR
26 September 06 04:39 PM

Today the Visual Studio 2005 team released Service Pack 1 Beta . Included in the beta is the new linker that supports Address Space Layout Randomization on Windows Vista. You can get the update from the Microsoft Connect Site . By default on Windows Vista Read More...

Postedby michael_HOWARD | 9 Comments    

Filed under: Security, Vista

A Chronology of Data Breaches
22 September 06 01:14 PM

A fascinating read http://www.privacyrights.org/ar/ChronDataBreaches.htm. Read More...

Postedby michael_HOWARD | 0 Comments    

Filed under: Privacy

Gamefest Presentations now available
14 September 06 12:12 PM

In August I gave a presentation at Gamefest 2006 about secure coding practices and design. You can find the slide deck (and all the other slide decks) here . My presentation is titled "Hardening the Box: The Xbox 360 and Windows Vista Security Models." Read More...

Postedby michael_HOWARD | 1 Comments    

Filed under: Security

“Hunting Security Bugs” now available from Microsoft Press
08 September 06 01:04 PM

This is a new security book from MSPress that focuses on security testing. I read some of the chapters a few weeks ago, and it's wonderful to add a testing perspective to the world of security. A great deal has been written about security and code quality, Read More...

Postedby michael_HOWARD | 4 Comments    

Filed under: Security