New research finds Vista firewall can be subverted

gallery

The firewall that comes as part of Windows Vista can easily be subverted by hackers, according to research carried out by IT security company Symantec.

One of the company's security response team members Orlando Padilla wrote in a report that the Windows Vista firewall is configured to disallow all network communications unless the user clicks the unblock button.

"Unfortunately, the unblock function can be accessed with the same set of privileges as those of the restricted user," said Padilla. "This configuration of privileges creates a point of vulnerability that undermines the effectiveness of the firewall's policy in Windows Vista."

Padilla added that malicious code can automate the unblock process by simply sending a message to the firewall pop-up dialog box via the SendMessage application programming interface (API) call.

Symantec said in another report that while Microsoft had fixed a number of security bugs in its new operating system, attackers have largely moved away from exploiting these flaws in core operating system components.

"Attackers have moved to attack third-party applications, such as Office suites, web browsers, and other common software," said Oliver Friedrichs, director of emerging technologies in Symantec Security Response. "The defence mechanisms that are intended to make Windows more secure are also, in many cases, not extended to third-party applications. As a result, software that isn't developed to leverage Windows Vista's security features remains exposed."

He said that today's malicious code is quite capable of surviving on Windows Vista with no modification. "This demonstrates that malicious code authors will easily adapt to Microsoft's new operating system," he warned.

Email to a friend

Print this page