New security mitigations in Windows 8 already defeated

[munkery]

The new runtime security mitigation improvements to be included in Windows 8 have already been defeated.

http://vulnfactory.org/blog/2011/09/21/defeating-windows-8-rop-mitigation/

To put this into perspective, methods to bypass the new runtime security mitigations in Mac OS X Lion are not yet available.

 

[yg17]

It's a pre-alpha version. Lion is a shipping product. You can't even compare the two

 

[munkery]

It's a pre-alpha version. Lion is a shipping product. You can't even compare the two

No, Windows 8 is currently a beta release.

Mac OS X Lion has been available to security researchers since the beta release. The NDAs for the Lion beta ended with the retail release and still no methods are available.

 

[sk1wbw]

I'm sure Microsoft has the experience and foundation to have avoided this. It's not like Windows just came out the same time as Lion.

 

[yg17]

No, Windows 8 is currently a beta release.

Mac OS X Lion has been available to security researchers since the beta release. The NDAs for the Lion beta ended with the retail release and still no methods are available.

Alpha...beta, who cares? What matters is what's in the final, GM version of Windows.

 

[Peace]

Windows 8 is a "Developer Preview". Historically this places it in the Alpha category.

 

[munkery]

I'm sure Microsoft has the experience and foundation to have avoided this. It's not like Windows just came out the same time as Lion.

Alpha...beta, who cares? What matters is what's in the final, GM version of Windows.

The truth is that many of the issues that facilitate exploitation in earlier releases of Windows still exist in Windows 8.

The article shows that the new improvements in Windows 8 are trivial to bypass and the same methods applied to Windows 7 are useable with Windows 8 after bypassing the new features.

While this provides yet another hurdle for exploit writers, it’s fairly easy to bypass.

http://vulnfactory.org/blog/2011/09/21/defeating-windows-8-rop-mitigation/

----------

Windows 8 is a "Developer Preview". Historically this places it in the Alpha category.

OK, Mac OS X Lion has been available to security researchers since being a "Developer Preview."

But, nothing.