Symantec Finds Flaws In Vista's Network Stack - InformationWeek
02:44 PM

Symantec Finds Flaws In Vista's Network Stack

Researchers with Symantec's advanced threat team said some of the flaws have been fixed, but they also claim that the rewrite of the networking code could cause problems.

Researchers with Symantec's advanced threat team poked through Vista's new network stack in several recent builds of the still-under-construction operating system, and found several bugs -- some of which have been fixed, including a few in Monday's release -- as well as broader evidence that the rewrite of the networking code could easily lead to problems.

"New code, whether it's been rewritten or added, needs to go through an aging process," said Oliver Friedrichs, the senior director of Symantec's security response group. "Virgin code is likely to contain more bugs and flaws. And that's particularly true in a network stack, which is one of the most complex pieces of code in an operating system."

In a just-released paper, two of Friedrich's researchers, Tim Newsham and Jim Hoagland, detailed research that began with a September 2005 build of Vista and wrapped up with May's public Beta 2.

Among Newsham's and Hoagland's conclusions: "The amount of new code present in Windows Vista provides many opportunities for new defects."

"It's true that some of the things we found were 'low-hanging fruit,' and that some are getting fixed in later builds," said Friedrichs. "But that begs the question of what else is in there?"

Vista, the first across-the-board Windows upgrade since the 2001 debut of XP, is touted by Microsoft as its most-secure operating system ever. And the stack is one of the OS's most important security components.

"It's the single point of exposure of the network," explained Friedrichs. "It's the first point of entry that an attacker takes. They have to pass through the stack to get to the core of the operating system."

Vista's stack adds support for IPv6, the next-generation IP protocol, for instance, and includes IPv6 tunneling to transition from the now-in-use technologies to IPv6. Dubbed "Teredo," the tunneling technology is enabled by default, and could, said Symantec, serve as a welcome mat to attackers.

"If it's not deployed or configured correctly, [Toredo] may actually provide an entry method for attackers through this tunneling," said Friedrichs.

1 of 2
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
How Enterprises Are Attacking the IT Security Enterprise
How Enterprises Are Attacking the IT Security Enterprise
To learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Register for InformationWeek Newsletters
White Papers
Current Issue
Digital Transformation Myths & Truths
Transformation is on every IT organization's to-do list, but effectively transforming IT means a major shift in technology as well as business models and culture. In this IT Trend Report, we examine some of the misconceptions of digital transformation and look at steps you can take to succeed technically and culturally.
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll