Major Windows security update foiled

[genesis]

Major Windows security update foiled

A Russian security company claims it found a way to beat a security measure in Microsoft's Windows XP Service Pack 2, a major update aimed at securing customers' PCs.

The SP2 measure, known as Data Execution Protection, is intended to prevent would-be attackers from inserting rogue code into a PC's memory and tricking Windows into running the program. However, in a paper published Friday, Moscow-based Positive Technologies said two minor mistakes in the implementation of the technology allow a knowledgeable programmer to sidestep the protection.

The company notified Microsoft of the problem Dec. 22, but it apparently decided not to wait for the software giant to patch the flaws.

Neither Microsoft nor Positive Technologies immediately responded to requests for comment Friday.

After several delays, Microsoft began rolling out SP2 in August of last year, at which time company Chairman Bill Gates called the update "a significant step in delivering on our goal to help customers make their PCs better isolated and more resilient in the face of increasingly sophisticated attacks."

Source: CNet

[Millermagic]

That's nice. Why does windows have to make something and not test it looking for all the problems in it.

[genesis]

That's how you get newer service packs. It's normal, if they were able to make it perfect, we'd not get any updates.

[trackrat]

No matter how good Microsoft make their products there will always be someone trying to hack it.

Still at least they are leaving Linux alone, but having to run as root to install malicious code makes it more difficult to successfully hack than Windows.

[genesis]

Linux is almost hack free unless someone sniffs your root password. Microsoft should be able to come up with something like this soon.

[CoolJsa14]

Hopefully, I just hope they will think things through before they release something that can allow harm to your computer.

[genesis]

They do, as far as I can remember SP2 costed them 2 million dollars in testing alone. But it'll never be perfect, there is no such thing as perfect software.

[Jason Lu]

I agree with you , Genesis! There is no "Perfect" in software industry. "Perfect" is not a techincal word, I think it's more or less an literature word.

Micro$oft dominant the software markets for years, and there isn't any other gaint company alike can leverage Micro$oft. I think that's probably why hackers/attackers going after MS B)

[genesis]

of course, the more attention you get, the more problems.