700 likes | 862 Views
Windows Vista Security Tidbits. Steve Lamb Technical Security Evangelist @ Microsoft Ltd Stephen.lamb@microsoft.com http://blogs.technet.com/steve_lamb. Overview. User And Group Changes Admin account New/Missing SIDs New/Missing Users and Groups Cached credentials Kernel Changes
E N D
Windows Vista Security Tidbits Steve Lamb Technical Security Evangelist @ Microsoft Ltd Stephen.lamb@microsoft.com http://blogs.technet.com/steve_lamb
Overview • User And Group Changes • Admin account • New/Missing SIDs • New/Missing Users and Groups • Cached credentials • Kernel Changes • Buffer overflow protection • ACL Changes • Encryption changes • Suite B • TS SSO • EFS with Smart Cards • Audit changes • User rights • New and changed security options • Firewall • Auth IP • SMBv2
And A Few More SIDs The Trusted Installer INTERNET USER High integrity SID System integrity SID A Service Low integrity SID Medium integrity SID
Better Buffer Overflow Protection • Second cookie protects exception handlers • Safer CRT exception handlers • No more executable pages outside images • Enforced by better development practices and code scanning tools • /NXCOMPAT linker flag in build tools • If all binaries in a process are marked NX is automatically enabled for the process • Heap protection • Signed kernel code (x64 only)
Suite-B Crypto • Software and Smart Card Key Storage Providers • Cryptographic configuration • NIST ECC Prime Curves support (smart cards too) • AES • SHA-2 • IPsec support for AES and ECDH • ECC cipher suites in SSL • EFS with smart cards
Object Access Auditing Object Access Attempt: Object Server: %1 Handle ID: %2 Object Type: %3 Process ID: %4 Image File Name: %5 Access Mask: %6
Object Access Auditing An operation was performed on an object. Subject : Security ID: %1 Account Name: %2 Account Domain: %3 Logon ID: %4 Object: Object Server: %5 Object Type: %6 Object Name: %7 Handle ID: %9 Operation: Operation Type: %8 Accesses: %10 Access Mask: %11 Properties: %12 Additional Info: %13 Additional Info2: %14
Added Auditing For • Registry value change audit events (old+new values) • AD change audit events (old+new values) • Improved operation-based audit • Audit events for UAC • Improved IPSec audit events including support for AuthIP • RPC Call audit events • Share Access audit events • Share Management events • Cryptographic function audit events • NAP audit events (server only) • IAS (RADIUS) audit events (server only)
Changes to User Rights • All rights for Power Users removed • Create global objects does not have INTERACTIVE • SE_IMPERSONATE has added IIS_IUSRS and removed ASPNET • Logon as a service is now empty by default
New User Rights • Access credential manager as a trusted caller • Change time zone user right • Create symbolic links • Modify an object label • Synchronize directory service data • Increase a process working set
Network Security: Do not store LAN Manager hash value on next password change
Network Security: Do not store LAN Manager hash value on next password change
Devices: Restrict CD-ROM/Floppy access to locally logged on user only
Devices: Restrict CD-ROM/Floppy access to locally logged on user only