January 2008 - Posts

New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008
29 January 08 02:11 PM

In the interests of helping secure the platform, we want more people to opt-in to using Data Execution Prevention (aka DEP aka NX), and we have lowered the barrier to entry for application developers in Windows Vista SP1, Windows XP SP3 and Windows Server Read More...

Postedby michael_HOWARD | 23 Comments    

Filed under: Security, Vista

My Daughter will never be a Spy
20 January 08 07:43 PM

My kids are desperate for pets; my six-year old son wants a dog (note, a dog, not a puppy!) and my 4-year old daughter wants a cat. The worse part is my wife keeps egging the kids on, and says she'll get the a pet when I'm next out of town. Tonite I told Read More...

Postedby michael_HOWARD | 2 Comments    

Filed under: Personal

Windows Vista Crypto Modules now FIPS 140-2 Certified
18 January 08 01:01 PM

The standard crypto providers such as DSSENH and RSAENH are now certified FIPS 140-2 on Windows Vista. http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401val2008.htm has all the info. Read More...

Postedby michael_HOWARD | 2 Comments    

Filed under: Security, Vista

Crispin Cowan joins the Windows Security Team!
17 January 08 08:11 PM

I am delighted to announce that Crispin Cowan has joined the core Windows Security Team! For those of you who don’t know Crispin, Crispin is responsible for a number of very well respected Linux-based security technologies such as StackGuard, the Immunix Read More...

Postedby michael_HOWARD | 17 Comments    

Filed under: Security

Timely Microsoft Office 2003 SP3 Advice from David LeBlanc
16 January 08 01:43 PM

http://blogs.msdn.com/david_leblanc/archive/2008/01/16/a-good-reason-to-install-sp3.aspx Read More...

Postedby michael_HOWARD | 1 Comments    

Filed under: Security

Cry or Smile? You Decide...
11 January 08 11:59 AM

On Wednesday Mark Curphey emailed me about a conversation his team had with a customer. I see he has now blogged about the conversation. Here's an excerpt. When a customers [sic, you need to learn some simple grammar, Curphey!] development team was recently Read More...

Postedby michael_HOWARD | 9 Comments    

Filed under: Security

"Open-source projects certified as secure" – huh?
10 January 08 05:35 PM

I really got a chuckle out of this news item , especially this line: “Coverity, which creates automated source-code analysis tools, announced late Monday its first list of open-source projects that have been certified as free of security defects.” So Read More...

Postedby michael_HOWARD | 13 Comments    

Filed under: Security, Rant

VBootkit vs. Bitlocker in TPM mode
08 January 08 08:05 PM

One of the guys in our group, Robert Hensing has an interesting post about VBootkit and whether BitLocker in TPM offers any defense. Short answer: yes, it does. Slightly longer answer: The BitLocker guys anticiated this attack and the really long answer Read More...

Postedby michael_HOWARD | 2 Comments    

Filed under: Security, Vista

Recent Symantec and IBM vulnerabilities, giblets, banned APIs and the SDL
04 January 08 03:47 PM

I just posted some commentary on the SDL blog about some recent Symantec and IBM vulnerabilities, and how the SDL *may* have found them. Read More...

Postedby michael_HOWARD | 1 Comments    

Filed under: Security