Security Flaws in Windows XP Service Pack 2.ppt

Security Flaws in Windows XP Service Pack 2 CSE 7339 9/14/04 By: Saeed Abu Nimeh Outline Microsoft Introducing SP2 Collaboration with the industry What’s New in SP2 Heise Security Advisory Microsoft’s Response References Microsoft Introducing SP2 Microsoft releases a SP every year for Win XP. It was supposed to be released in the first half of the year. Friday, August 6, 2004 SP2 was released. Gates: “SP2 modifies less than 5 percent of the nearly 3-year-old operating system”. Microsoft Introducing SP2 Gates: “SP2 2 is a significant step in delivering on our goal to help customers make their PCs better isolated and more resilient in the face of increasingly sophisticated attacks“. “It is the result of sustained investments in innovation and extensive industry collaboration.“ Collaboration with the industry Windows Security Center: Symantec: Antivirus, Firewall and Intrusion Prevention security solutions are compatible with SP2. Data execution prevention: Intel: Improve security PC platform by Execute Disable Bit and Microsofts Data Execution Prevention AMD: Support for AMD Athlon 64-bit desktop and mobile processors Preloaded PCs: Working with computer manufacturers: Dell, HP and IBM to ship machines preloaded with SP2 beginning in September and October. What’s New in SP2 SP2 reduces the most common attack vectors four ways: Network protection Memory protection More secure browsing E-mail security and Safer message handling Improved computer maintenance Network Protection Windows Firewall (Internet Connection Firewall-ICF): Is enabled by default. The firewall turns on very early in the system boot cycle, and turns off very late in the shutdown cycle. Enhanced Group Policy settings to support IPv6. Remote Procedure Call (RPC): Permissions to block services. Distributed Component Object Model (DCOM): Restrictions to reduce the risk, only authenticated administrators can remotely activate and launch COM components. Disabling the Windows Messenger Service