processor anti-execute protection from malicious code

DEP backdoor

More here

 

Which means setting DEP to AlwaysOn, not OptOut. There are no exceptions possible in this mode, and even if you don't have exceptions in OptOut, AlwaysOn is still safer. The second link in Lucas post explains this.

One has to edit the boot.ini for AlwaysOn (followed by a reboot), and then see some programs not open. The big name for me was Opera, i completely stopped using it i'm afraid.

 

I´m not sure what´s going on, but lately I´ve been getting a couple of unexpected DEP alerts (about SnagIt, Maxthon and Gadwin Printscreen), I´m not sure if they were false positives or not, but interesting was that Comodo Memory Firewall didn´t make a sound.

 

If i recall Ilya correctly, there are just some programs badly coded that violate DEP parameters, sort of speak. The programs, or just some extension.

 

The problem with CMF is that it do not make stack and heap areas non-executable.

 

Thanks for the info Ilya, I totally forget that you´re the make of an anti BO tool yourself, so that´s why you know so much about this stuff. But what are you saying, that CMF isn´t really that powerful, or is it still useful?

 

It is useful in order to provide some kind of ASLR protection. Other its protective staff is about 'call function' analize and can be bypassed.

 

Thanks for the feedback. From what I´ve been reading, I get the general impression that eventhough CMF is not THE ultimate anti BO tool, it might still actually be useful, and might still stop certain BO attacks, combined with hardware DEP. Btw, wouldn´t ASLR cause trouble on XP? I know a while back, some of us tried WehnTrust, and it caused problems. To my surprise, CMF seems to be running just fine with all my other tools.

 

No, there should be no problems at all because of ASLR. As about WehnTrust- it is written poor way, too many bugs within

 

Thanks for the feedback. Btw, I´ve read some stuff and this made me think about ASLR, should apps support this tech natively in order to make it effective? And does CMF really add about the same ASLR capability as seen in Vista?

http://blogs.zdnet.com/security/?p=912
http://erratasec.blogspot.com/2008/02/unsafe-at-anyspeed.html

 

I don't know about it too much.