Search:  

 
 
   All ForumsHot TopicsGallery






how-to block ads


 
Forums » Vista Flaws Pile Up » How is this stuff found?
Uniqs:
31
Share Topic:
RSS topic:
toggle:
flat / full
normal / watch
Post a:
Post a:
Those aren't FLAWS those are FEATURES... »
« Half-baked article  

bleearg13

join:2001-03-03
Gaithersburg, MD

How is this stuff found?

Reading about one of the vulnerabilities, I'm interested to know how these vulnerabilities are discovered. There are obviously hackers/crackers and researchers alike that spend every waking hour trying to identify vulnerabilities, but exactly how is it done? Most specifically, this exploit regarding the "MessageBox" function:

»www.darkreading.com/document.asp···d=113414

How on earth is this found?

John_W
Premium
join:2000-04-25
Worcester, MA
clubs:
·Vonage

Re: How is this stuff found?

It's the black hats we have to worry about.

It's the white hats MS has to worry about. It's how quickly the software companies respond to the white hat vulnerability discoveries that concern us.

Almost all, if not all, software has some sort of exploitable code in it. It is just how fast those companies fix the problem that makes the difference between a good and bad company. MS has had a habit of ignoring white hat findings, or at best putting off, where other software companies, like mozilla, who who get their patches right out there as soon as they can.
--
Chef says to put a cucumber down my pants for good luck.
rdmiller

join:2005-09-23
Richmond, VA

Re: How is this stuff found?

didn't answer the question!
severach

join:2002-09-12
Jackson, MI

Re: How is this stuff found?

Black hats harm everybody by destroying stuff. The white hats either do something that is unimportant to you or something that is highly desirable to you but highly undesirable to Microsoft. For example, if a white hat found out a way to permanently disable the signed driver protection in Vista, that would be wonderful for everyone in the world except for Microsoft who's sole purpose for that feature is to prevent you and me from modifying the system to our advantage. Noone wants that except for Microsoft.

72276539
Premium
join:2001-01-19
Atlanta, GA


1 edit
said by John_W See Profile :

MS has had a habit of ignoring white hat findings, or at best putting off, where other software companies, like mozilla, who who get their patches right out there as soon as they can.
It's a hell of a lot fuckin easier to edit code on a browser then an entire OS. How bout comparing apples to apples instead of apples to porcupines.

PS- Answer the OP's question while you are at it.
--
RIP Dimebag- August 20, 1966 to December 8th, 2004.

Hi

@comcast.net

For buffer overflows, you can just try dumping a long, long string of data into every function that takes strings of data and see which ones crash.

If a long, long string of data causes your OS to crash (in one way or another, not necessarily requiring a complete reboot), then you've overwritten something and maybe you can use this to your advantage to overwrite executable code.
Forums » Vista Flaws Pile UpThose aren't FLAWS those are FEATURES... »
« Half-baked article  


Saturday, 05-Dec 18:28:37 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 10 years online! © 1999-2009 dslreports.com.
page compression OFF
Most commented news this week
· [163] Comcast Releasing Promised Usage Meter
· [147] Avast Antivirus Has Gone Mad
· [128] Comcast Makes NBC Universal Acquisition Official
· [104] Graduate Student Unveils Sprint's GPS Sharing With Feds
· [104] The Bandwidth Hog Does Not Exist
· [101] Google Invades ISP, OpenDNS Turf With Google Public DNS
· [85] FCC Ponders Moving From PSTN To IP Voice
· [81] Latest Consumer Reports Survey Not Kind To AT&T
· [80] New Bill Aims To Limit ETFs
· [74] Sprint Defuses GPS Privacy Media Bomb
Most people now reading
· False positive in Avast! or is it real? [Security]
· First commercial tool to crack BitLocker arrives (Updated) [Security]
· Wife might have to work in.... Iowa for a few months!!! [General Questions]
· 3.x Feral Druid - Bear Tanking Guide [World of Warcraft]
· DNS options, what are YOU using? [TekSavvy]
· Connecting to Google Voice Via SIP [VOIP Tech Chat]
· RG Firmware update to VDSL2 this morning [AT&T U-verse]
· Windows 7 boot manager editing questions [Microsoft Help]
· [How to] Install Asterisk on an Asus WL-520GU router [VOIP Tech Chat]
· [WotLK] Whats the level 80 pve spec for mages? [World of Warcraft]