Microsoft talks more about malware protection for Windows 8

[nsane.forums]

Microsoft's official Windows 8 blog reveals more about the company's plans to offer built in malware protection in the next version of its operating system.

Earlier this week at Microsoft's BUILD Conference in Anaheim, California, the company announced that the upcoming Windows 8 operating system would have built in malware and virus protection. Today, the official Windows 8 blog site gives more information on the malware protection features in Windows 8. Jason Garms, who works as Microsoft's group program manager for its reliability and security team, said, "With Windows XP SP2, we began creating defenses called mitigations that make it difficult to develop reliable exploits for security vulnerabilities. Each subsequent version of Windows has continued to expand and improve on these mitigations, because a single mitigation feature can break an entire class of exploits. Windows 8 includes mitigation enhancements that further reduce the likelihood of common attacks."

Just one of those mitigation improvements is what Microsoft is calling Address Space Layout Randomization. It was first launched in Windows Vista and allow the Windows OS to randomly shuffle "the location of most code and data in memory to block assumptions that the code and data are at same address on all PCs." Garms says, "In Windows 8, we extended ASLR’s protection to more parts of Windows and introduced enhancements such as increased randomization that will break many known techniques for circumventing ASLR." Windows 8's kernel also gets some protection improvements. Garms says, "For example, we now prevent user-mode processes from allocating the low 64K of process memory, which prevents a whole class of kernel-mode NULL dereference vulnerabilities from being exploited. We also added integrity checks to the kernel pool memory allocator to mitigate kernel pool corruption attacks."

While Microsoft expects a number of third party malware protection applications will be released for Windows 8, Garms says, "If you don’t have another solution installed, Windows 8 will provide you protection with a significantly improved version of Windows Defender." Garms says that it will protect your Windows 8 device "from all types of malware, including viruses, worms, bots and rootkits" and it will be regularly updated with new signatures via Windows Update. The Windows 8 version of Defender will also "provide you with real-time detection and protection from malware threats using a file system filter, and will interface with Windows secured boot, another new Window 8 protection feature."

The Microsoft SmartScreen feature, which alerts Internet Explorer users if they are about to download and install a possible malware program, will also be expanded to Windows 8 when it launches. Garms says, "We understand that Internet Explorer isn’t the only way you download applications from the Internet, so Windows now uses SmartScreen to perform an application reputation check the first time you launch applications that come from the Internet."

View: Original Article

[DKT27]

They are including many things? Fine. It's great to have in-build features. But bloody give us an easy way to totally disable them whenever or however we need. Hell, if disabling Windows Defender in Windows 7 wasn't hard enough, they are going even further with it in Windows 8.

[xXHelperXx]

Thank you so much Bro!

it's nice to see another Israeli in here.

[mayeray]

I just hope it wont be harder to disable things on Windows 8. The built in features look cool especially the new BSOD but some of the features look like shit like the new explorer for example.

Looks like im going back to Directory Opus.

[dexanilas]

Very interesting. Thanks a lot.

[HX1]

You know I got a popup from Windows Firewall the other day.. first time since I have had Windows 7.. but it re-affirmed that I have more than one software firewall on...

BUT yeah we do need configuration options.. I think though in a way they want to protect those who would make stupid decisions to make windows even safer..

Windows Defender is not that hard to turn off if you cover the bases on it..

[DKT27]

Good point. Had come across it some time ago. Got a Windows Firewall message, even when I remember disabling it. Actually, first thing I did using Windows 7 was disabling UAC and WF.

[HX1]

Well.. used to.. in XP.. when you installed a Suite like ESS or GDATA or something the Firewall was turned off.. but I think because of UAC/HIDS and some other security measures including some of the filtering and logging.. MS had to leave it on as a component.. MirandaIM update notification was what set it off if I remember right...

I have some much logging going on .. Security Audits are logging stuff too related to Firewall..