Microsoft Adds New Anti-Exploit APIs into Windows

Microsoft has announced plans to add new anti-exploitation APIs into Windows Vista SP1, Windows XP SP3 and Windows Server 2008 as part of a larger plan to secure the Windows ecosystem.

According to Michael Howard, a senior program manager in Microsoft's security unit, the delivery of the new NX (/noexecute) APIs significantly lowers the barriers to entry for application developers to opt-in to using DEP on Windows programs.

Microsoft Adds New Anti-Exploit APIs into Windows

In his announcement, Howard said the new APIs will let developers set DEP on their process at runtime rather than using linker options.

The key API being added is SetProcessDEPPolicy, which sets the DEP policy for the running process, he said.

[ SEE: Microsoft Claims Security Win with New Development Rules ]

Howard said there are three main reasons to use the new Windows APIs:

* If your application has some form of in-process extensibility mechanism, and some applications might use older ATL, then you can enable DEP for your process, and the extensibility mechanisms using ATL will function correctly.
* If you support DEP but want to allow customers to disable DEP if there are serious compatibility issues, then this is the API to use because the argument can be a configuration option.
* If your application uses an old version of ATL, and you still want to do the right thing by DEP, then use this function. Of course, you really ought to use an updated version of ATL!

TrackBack

http://securitywatch.eweek.com/cgi-bin/mte/mt-tb.cgi/12597

Listed below are links to weblogs that reference Microsoft Adds New Anti-Exploit APIs into Windows:

Microsoft Adds New Anti-Exploit APIs into Windows from Microsoft Switzerland Security Blog
Microsoft has announced plans to add new anti-exploitation APIs into Windows Vista SP1, Windows XP SP3 [Read More]

Tracked on February 4, 2008 7:30 AM

Comments (1)

Kostya Kortchinsky :

It appears to me as the best idea Microsoft could come up with to ease ret2libc-style attacks in DEP protected applications. Nowadays you have to chain 3+ calls to do that, when this feature is available, it will be 1 (2 at most).

Maybe they thought about something to prevent that?

Posted by Kostya Kortchinsky | January 30, 2008 5:32 PM