Newsgroup: it.comp.os.win.xp
Titolo: Il SP2 di WinXP sarà da INFARTO! Ecco perc hè tutta questa attesa... NE VALE LA PENA!

Overview of Windows XP SP2 Security Technologies
Many customers do not or cannot roll out patches as soon as they
become available, but still need to be protected against the risks
that the patches mitigate. Each security bulletin that Microsoft
delivers includes information that customers can use to help mitigate
risk while they deploy the patch. However, Microsoft is innovating
further delivering security technologies that provide additional
mitigation ahead of deploying a patch. These security technologies
will cover the following areas:
    * Network protection. These security technologies will help
provide better protection against network-based attacks, like Blaster,
through a number of innovations, including enhancements to Internet
Connection Firewall (ICF). The planned enhancements include turning on
ICF in default installations of SP2, closing ports except when they
are in use, improving the user interface for configuration, improving
application compatibility when ICF is on, and enhancing enterprise
administration of ICF through Group Policy. The attack surface of the
RPC service will be reduced as well as running in a reduced privilege.
The DCOM infrastructure will also have additional access control
restrictions to reduce the risk of a successful network attack.
    * Memory protection. Some attacks by malicious software leverage
software vulnerabilities that allow too much data to be copied into
areas of the computer's memory. These vulnerabilities are typically
referred to as buffer overruns. Although no single technique can
completely eliminate this type of vulnerability, Microsoft is
employing a number of security technologies to mitigate these attacks
from different angles. First, core Windows components are being
recompiled with the most recent version of our compiler technology to
help mitigate against buffer overruns. Additionally, Microsoft is
working with microprocessor companies to help Windows support
hardware-enforced "no execute" (or NX) on microprocessors that contain
the feature. NX uses the CPU itself to enforce the separation of
application code and data, preventing an application or Windows
component from executing program code that an attacking worm or virus
inserted into a portion of memory marked for data only.
    * Safer e-mail. Security technologies will help stop viruses (such
as SoBig.F) that spread through e-mail and instant messaging. These
technologies include default settings that are more secure, improved
attachment control for Outlook Express and Windows Messenger, and
increased Outlook Express security and reliability. As a result,
potentially unsafe attachments sent through e-mail and instant
messages will be isolated so that they cannot affect other parts of
the system.
    * Safer browsing. Security technologies delivered in Internet
Explorer that will provide improved protection against malicious
content on the Web. One enhancement includes locking down the local
machine zone to prevent against the running of malicious scripts and
fortifying against harmful Web downloads. Additionally, we will
provide better user controls and user interfaces that help prevent
malicious ActiveX® controls and spyware from running on customers'
systems without their knowledge and consent.
Microsoft understands that security technologies are only one aspect
of a sound defense-in-depth security strategy. The security
technologies outlined here are the next steps being taken in the
Trustworthy Computing initiative to make customers' systems more
resilient.
Network Protection in SP2
In SP2, Microsoft is investing in three key technologies that will
make systems less vulnerable to attacks over the network:
    * Internet Connection Firewall. Internet Connection Firewall (ICF)
is a stateful filtering firewall for Windows XP and Windows Server
2003. ICF provides protection for PCs connected to a network by
preventing unsolicited inbound connections through TCP/IP version 4
(IPv4). SP2 turns on ICF by default and starts it earlier in the boot
process.
    * RPC Interface Restriction. Interface restriction (exposed to
developers, for example, through a new registry key called
RestrictRemoteClients) modifies the behavior of all remote procedure
call interfaces on the system and will, by default, eliminate remote
anonymous access to RPC interfaces on the system, with some
exceptions. Practically speaking, RPC interface restriction requires
callers to perform authentication, which makes it much more difficult
to attack an interface. This is a particularly useful mitigation
against Trojan horses, which tend to rely on exploitable buffer
overruns that can be invoked remotely through anonymous connections.
    * Changes to DCOM. SP2 makes two changes to the behavior of
Distributed Component Object Model (DCOM). First, it introduces
computer-wide restrictions, which, in effect, provide an additional
access check against a computer-wide access control list (ACL) on each
call, activation, or launch of any COM server on the computer. Second,
it introduces a set of more granular COM permissions, which give
administrators flexibility to control a computer's COM permission
policy.
    Note: If you only use COM for in-process COM components, you
application won't be affected by SP2.
Internet Connection Firewall in SP2
ICF for SP2 will include a host of new features. This paper will
discuss five of them that will have some impact on existing
applications:
   1. On by default. Prior to SP2, Windows XP shipped with ICF
disabled by default; users either needed to run a wizard or navigate
through the Network Connections folder to enable ICF. By enabling ICF
by default, the computer will be protected from many network based
attacks. For example, if ICF had been enabled by default the recent
Blaster attack would have been greatly reduced in impact, regardless
of whether users were up to date with patches. This may have an impact
on existing applications if the application does not work with
stateful filtering by default.
   2. Boot time security. In earlier versions of Windows there is a
window of time between when the network stack started and when ICF
provided protection. Consequently, a packet could have been received
and delivered to a service without ICF filtering it, potentially
exposing the computer to vulnerabilities. In SP2, the firewall driver
has a static rule called a boot-time policy to perform stateful
filtering. This will allow the computer to perform basic networking
tasks such as DNS and DHCP and communicate with a Domain Controller to
obtain policy. Once the firewall service is running, it will load and
apply the run-time ICF policy and remove the boot-time filters. This
change should increase system security without affecting applications.
   3. Application white list. Prior to SP2, applications needed to
call the ICF APIs to enable the necessary listening ports to be open
to send and receive messages. This proved difficult in peer-to-peer
situations when the port was not known in advance. Further, it was up
to the application to close the hole in the firewall, which could lead
to unnecessary openings in the firewall should the application
terminate unexpectedly. Additionally, these holes could only be opened
by applications running in the security context of a local
administrator. In SP2, an application that needs to listen to the
network can be added to the Application White List. An application on
the white list will have the necessary listening hole created
automatically. By having an application on the white list, only
necessary ports are opened, and they are only opened for the duration
that the application is listening on it. This prevents an application
from opening up a port it's not using and either deliberately or
inadvertently exposing another application or service to network
traffic from that port. Further, this also allows applications
listening to the network to run as a regular user. Applications that
work with stateful filtering do not need to be placed on the white
list. Only administrators can add an application to the white list.
   4. RPC support. In earlier versions of Windows, ICF blocked RPC
communication, causing functions such as file and print sharing and
remote administration to fail. This was because the RPC process image
filename was the same for many RPC servers (svchost.exe). SP2 enables
granular control of which RPC services have the ability to traverse
ICF. When opening a port, a caller may claim that the port is to be
used for RPC. ICF will only accept this claim if the caller is running
in the Local System, Network Service, or Local Service security
contexts. ICF supports a profile level flag that enables RPC ports to
be opened even if the caller is not on the Application White List:
PrivilegedRpcServerPermission. By having granularity, administrators
can control which RPC services are exposed to the network, limiting
communication to only those who need it.
   5. "Shielded" mode. In the event a malicious application that finds
and exploits a vulnerability in one of the listening Windows services
is threatening users, SP2 introduces a setting to ICF, code-named
"shielded" mode. This mode enables users to easily protect themselves
by switching ICF to prevent all unsolicited inbound traffic until a
patch is available, without having to reconfigure the firewall. When
in this operation mode, the computer cannot listen for requests that
originate from the network. Outgoing connections are the only
connections that succeed. Any API call to open up a static hole will
be allowed and the configuration stored, but it will not be applied
until the ICF operational mode switches back to normal operation.
continua su:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnwxp/html/securityinxpsp2.asp
Saluti da P4


Praticamente incorporano roba che richiedeva o programmi di terze
parti o interventi manuali.
-- 
Know what you like and know what you yearn
but they don't know a thing about me
I'm not that easy, I'm blank file in their memory
                            mousse[at]
softhome.net

 parti o interventi manuali.
Vogliono, quindi, alleggerire windows.
-- 
@#@#@#@#@#@#@#@#@#@#@
#            #
@               Simone          @
#            #
@         
s.p...@email.it
                   @
#            #
@        Forza Unione         @
#            #
@#@#@#@#@#@#@#@#@#@#@


Beh aggiungendo roba lo appesantiscono, in effetti. Integrando piu'
funzioni nel SO comunque la stabilita' genarale dovrebbe migliorare (e
gia' XP e' piuttosto robusto..)


 gia' XP e' piuttosto robusto..)
mi sa un po' di abuso di posizione dominante.
Se poi si disintallano bene con il messenger di xp...

 parti o interventi manuali.
a parte il nuovo firewall che assomiglia molto ad un programma di
terze parti, la cosa piů bella del nuovo service pack 2 č la nuova
feature riguardante il nuovo "flag" NO-EXECUTE di protezione della
memoria (che ha anche legami con l'architettura delle CPU):
Execution protection
Execution protection (NX, or no execute) is an operating system
feature that relies on processor hardware to mark memory with an
attribute indicating that code should not be executed from that
memory. Execution protection functions on a per-virtual memory page
basis, most often leveraging a bit in the page table entry (PTE) to
mark the memory page.
Execution protection prevents code execution from data pages such as
the default heap, various stacks, and memory pools. Protection can be
applied in both user and kernel-mode. As execution protection prevents
data execution from the stack, the specific exploit leveraged by the
recent MSBlaster worm would have resulted in a memory access violation
and termination of the process. On a system with execution protection,
MSBlaster would have been limited to a Denial-of-Service (DOS) attack,
but would not have had the ability to replicate and spread to other
systems. This would have significantly limited the scope and impact of
the worm. And although MSBlaster in its original form may have been
less malicious, it should be noted that execution protection is by no
means a comprehensive defense against all viruses, worms, and other
malicious code.
The actual hardware implementation of execution protection and marking
of the virtual memory page varies by processor architecture. However,
processors supporting execution protection are capable of raising an
exception when code is executed from a page marked with the
appropriate attribute set. The 32-bit version of Windows currently
leverages the NX processor feature, as defined by the AMD64
Architecture Programmer's Manual. This processor feature requires the
processor run in Physical Address Extension (PAE) mode.
Although the only currently shipping processor families with
Windows-compatible hardware support for execution protection are the
AMD K8 and the Intel Itanium Processor Family, it is expected that
future 32 and 64-bit processors will provide execution protection.
Microsoft is preparing for and encouraging this trend by supporting
execution protection in its flagship Windows operating systems.
Microsoft will be supporting emerging processors with execution
protection by making additions to Windows, beginning with SP2.
Execution protection has obvious advantages concerning buffer overrun
exploits and promoting general good coding practices for Microsoft and
third-party developers. Table 1 below outlines various types of
user-mode memory regions and their default execution protection.
Table 1. User-Mode Execution Protection (32-bit OS)
Memory Region Type 	                        Is Region Executable?
  	                                        SP2     Windows XP
System-Wide Execution Protection Enabled? 	Yes 	No
Stack 	                                        No 	Yes
Heap 	                            by default, No      Yes
Saluti da P4


Se non ti piace windows non lo usi, direi che non c'e' abuso. 
Cmq se proprio vogliamo parlare di abusi, parliamo di Apple: per
costruire dei compatibili macintosh le royalty erano cosi' alte che
nessuno lo faceva. Ah, provate a vedere le applicazioni incluse in mac
OSX... c'e' ichat (messenger), ical (PIM), itunes (media player),
safari (web browser), mail (mailer). In piu' il sistema ha i
protocolli e i client di rete per reti microsoft, appletalk, tcp/ip,
un firewall integrato, puo' fungere da gateway internet, webserver,
mailserver (questi sono gia' inclusi).
Linux, almeno non in tutte le distrubuzioni, non offre tanta roba ^^
Quindi io non parlerei di abuso di posizione dominante ma di sistema
operativo completo.


 
Veramente piu' incorporano roba, piu' il sistema diventa instabile.
Se il programma per internet (leggi IE), quello di posta (leggi OE), 
quello di videoscrittura, calcolo, presentazioni, riproduzione cd, 
decompressione file Zip, masterizzazione, preparazione caffe' e 
pasticcini vengono eseguiti direttamente nel cuore del SO, ci sono piu' 
probabilita' che andando in errore creino guai all'intero sistema.
Immagina se ti trovassi in macchina in autostrada e tutti i passeggeri 
avessero una replicazione di pedaliera e sterzo. La macchina sarebbe 
piu' stabile? andrebbe piu' veloce?
Poi sul fatto che XP sia robusto ... preferisco non commentare. Windows 
(la continua uscita di patch lo dimostra) ha gia' superato da tempo il 
punto critico dei programmi dove ogni problema che correggi ne introduci 
almeno 2.
Ammetto che come progetto e' mastodontico e che non e' facile gestire un 
pachiderma come questo, ma definire stabile un sistema che necessita di 
essere riavviato se IE va in errore ...
NT4 era 'abbastanza' robusto, ma appunto perche' spartano.
Luca

 Se non ti piace windows non lo usi, direi che non c'e' abuso.
Infatti. C'è stata una sentenza di condanna per Explorer troppo integrato, e
per, appunto, posizione dominante, imponendo la microsoft ai rivenditori i
propri sistemi.

 gia' XP e' piuttosto robusto..)
Veramente per un sistema non ridondante vale il contrario: meno
componenti sono presenti nell'insieme, piu' questo e' affidabile.
Windows e' la dimostrazione vivente della validita' di questo teorema.
C:\>iao Angelo 
-- 
Posted via Mailgate.ORG Server - 
http://www.Mailgate.ORG


Io non ho mai avuto di questi problemi...


 
Non su tutti i computer, ma io si'. Per lavoro mi vengo a trovare di 
fronte a diverse decine di computer ogni anno, la maggior parte con 
configurazioni minime per via del loro scopo (utilizzo industriale, 
quindi niente internet, reti isolate, console bloccate e applicazioni 
kiosk), ma anche PC "normali" alla merce' delle persone normali.
Se qualcuno fa pasticci con IE, fa pasticci con il SO e rischia di 
bloccare tutto il computer.
La mia non e' una crociata di quelle Linux e' bello Microsoft sucks.
Cerco solo di essere critico obbiettivamente come sviluppatore, 
amministratore e utente.
Luca.


Forse non sai che i kernel Linux rilasciati negli ultimi 4 mesi (dalla
2.4.18 in poi) addirittura bruciano il firmware dei lettori CDRom LG...
Quanti test avranno fatto prima di rilasciarli ?
Linux Mandrake 9.2 è stato rilasciato agli utenti paganti 2 settimane or
sono. Stamane c'erano già 190 MB di patch e bug fixes da scaricare...
Finiamola con le leggende metropolitane...
Se proprio vogliamo ispirarci a qualcosa di meglio di Windows XP facciamo
riferimento a S.O. seri quali appunto gli "Unix veri", magari anche Open
Source come OpenBSD o FreeBSD: questi si che sono veramente testati e le
varie versione vengono dichiarati stabili dopo 12 / 18 mesi dal rilascio...
-- 
Entropia


Leggi bene: ho detto UNIX non LINUX quando mi riferivo ai test che 
duravano anni prima del rilascio!
Di Linux dicevo semplicemente questo e lo ribadisco ancora: di SO (e mi 
riferisco al kernel, non a KDE, Gnome, o altri pacchetti forniti con le 
varie distibuzioni), come procedono i rilasci delle nuove versioni?
Non sto dicendo che e' esente da bachi. Neanche Unix o FreeBSD o OpenBSD 
lo sono come non lo e' Win, MacOS, OS2, DOS e chi piu' ne ha piu' ne metta.
Della versione 2.2 ci sono ancora nuove sottorelease? a quanto mi 
risulta (e se mi sbaglio sono pronto a chiedere scusa) hanno iniziato a 
sviluppare la 2.4 e la 2.5 intorno alla fine della vita della 2.2 
continuando a correggere non solo i bachi che trovavano, ma 
"riscrivendo" alcune sezioni e aggiungendo nuove funzionalita'.
E comunque una cosa nuova nuova che mi e' appena successa: un bel 
messaggino dal mio XP Home
"Si e' verificato un errore in Internet Explorer.
L'applicazione verra' terminata.
Se si riscontrano altri problemi,
Riavviare il computer"
Il bello e' non sto usando IE (per navigare in internet si intende), 
sto usando Netscape 7.1 per la posta e i Newsgroup e stavo trascinando 
un file da una cartella sulla taskbar per inserirlo come attach in una 
mail (operazione fatta migliaia di volte e questa e' la prima volta che 
mi appare questo messaggio).
Luca


Viva MacOs Panther!
scherzi a parte credo che sia l'OS di "uso generale" più stabile che ci sia
al momento  ...o mi sbaglio?


Purtroppo sbagli: quando cominci a usarlo sul serio con Illustrator 10
/ Photoshop 7 ha tanti di quei problemi... (ma forse e' colpa delle
applicazioni) :( 
(sono ANCHE utente di mac osX panther).


 sto usando Netscape 7.1 per la posta e i Newsgroup
Ecco probabilmente è questo il tuo problema: usi Windows che di per se di
bachetti ne ha già un bel po' e sopra gli metti qualcosa (Netscape) che
sopratutto nella versione Win32 è una mega-accozzaglia di bug e pretendi che
il tutto funzioni...
Se vuoi continuare ad usare Windows e non IE / OE ti consiglio di pensare a
qualcosa di decente come per esempio Mozilla e/o Firebird se poi vuoi
passare a qualcosa di estremamente più affidabile ti consiglio FreeBSD
oppure ancora QNX...
-- 
Entropia


Per FreeBSD non manchero'. In effetti era un po' che volevo provare a 
smanettarci su.
Per il crash, NS7 non e' stato neanche toccato (tant'e' vero che sono 
riuscito a inviare il messaggio usando NS senza neanche chiudere una 
finestra)
Il problema era successo quando ho spostato un file su un pulsante della 
taskbar, prima di raggiungere la barra, mi e' comparsa la finestrella e 
mi sono beccato l'immagine di un file in semitrasparenza in mezzo allo 
schermo.
Anyway, purtroppo, la maggior parte deglle societa' che sviluppano siti 
intenet, utilizzano funzioni implementate solo in IE, quindi diventa 
difficile visualizzarli senza usare il programma di Microsoft.
Finora, ho trovato solo NS7 che riesce a visualizzarne una buona parte, 
quando ho provato Mozilla, era come usare (scusa se sto riducendo) NS4. 
Piu' stabile, ma sempre limitato a pochi siti.
Che posso dire, provero' anche Firebird.
Ciao
Luca


Essendo basato sull'engine di Mozilla si comporta nello stesso modo.
Lo uso spesso ed e' solo piu' "semplice" come opzioni disponibili
rispetto al fratello maggiore.
