Welcome to MSDN Blogs Sign in | Join | Help

Michael Howard's Web Log

A Simple Software Security Guy at Microsoft!

January 2008 - Posts

New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008
In the interests of helping secure the platform, we want more people to opt-in to using Data Execution Prevention (aka DEP aka NX), and we have lowered the barrier to entry for application developers in Windows Vista SP1, Windows XP SP3 and Windows Server Read More...
My Daughter will never be a Spy
My kids are desperate for pets; my six-year old son wants a dog (note, a dog, not a puppy!) and my 4-year old daughter wants a cat. The worse part is my wife keeps egging the kids on, and says she'll get the a pet when I'm next out of town. Tonite I told Read More...
Windows Vista Crypto Modules now FIPS 140-2 Certified
The standard crypto providers such as DSSENH and RSAENH are now certified FIPS 140-2 on Windows Vista. http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401val2008.htm has all the info. Read More...
Crispin Cowan joins the Windows Security Team!
I am delighted to announce that Crispin Cowan has joined the core Windows Security Team! For those of you who don’t know Crispin, Crispin is responsible for a number of very well respected Linux-based security technologies such as StackGuard, the Immunix Read More...
Timely Microsoft Office 2003 SP3 Advice from David LeBlanc
http://blogs.msdn.com/david_leblanc/archive/2008/01/16/a-good-reason-to-install-sp3.aspx Read More...
Cry or Smile? You Decide...
On Wednesday Mark Curphey emailed me about a conversation his team had with a customer. I see he has now blogged about the conversation. Here's an excerpt. When a customers [sic, you need to learn some simple grammar, Curphey!] development team was recently Read More...
"Open-source projects certified as secure" – huh?
I really got a chuckle out of this news item , especially this line: “Coverity, which creates automated source-code analysis tools, announced late Monday its first list of open-source projects that have been certified as free of security defects.” So Read More...
VBootkit vs. Bitlocker in TPM mode
One of the guys in our group, Robert Hensing has an interesting post about VBootkit and whether BitLocker in TPM offers any defense. Short answer: yes, it does. Slightly longer answer: The BitLocker guys anticiated this attack and the really long answer Read More...
Recent Symantec and IBM vulnerabilities, giblets, banned APIs and the SDL
I just posted some commentary on the SDL blog about some recent Symantec and IBM vulnerabilities, and how the SDL *may* have found them. Read More...
Page view tracker