BigUnix has a fascinating article on computer security. Well, I found it fascinating. If you read it all the way through, then you may be a geek, too:
If a system has bugs, sometimes those bugs can be exploited in order to inject new code for the processor to execute. This can be a hardware, Operating System, or application bug. Almost always, the bugs tend to be a software bug. Those software bugs are usually the result of an unchecked boundary for some input data. When that boundary is passed, or overflowed, some of that input data mingles with execution code. This problem is a very old one. The naive solution, which has been tried for years, is to just fix all the broken code. The OS vendors may be realizing that this is too hard. Is there another solution?
If we look at the most common platform on the net for common users, it is the Windows Platform. According to the Google zeitgeist for May, this is probably at least 50% of the internet. This platform has also been the most popular for viruses as well. Recently, Microsoft has stated that security is an important focus for them, and they have been taking great strides to redeem themselves from a long history of security issues.
Here are some of their solutions to code injection:
# They are pushing .NET CLR which will dramatically reduce the possibility of an exploit
# They are turning on the firewall on as the default and re-securing all of their network exposed systems (code reviews)
# They are implementing new stack checking systems into Visual C and other compilers for future programs
# They are utilizing the No-Execute (NX) feature from the AMD64 architecture to provide memory protections in a finer granularity within a Win32 process
Of all of these, the No-Execute feature is by far the most interesting. It is a simple hardware enhancement to the x86 architecture that arrived with the introduction of the AMD64 system. It is interesting to note that it has been present in other non-x86 CPU architectures (like MIPS) for years. Microsoft is going to give users the ability to use the NX feature under the name Data Execution Prevention (DEP) via XP Service Pack 2. So, what is it, and why did it take so long to get here?
The bad news is you’ll probably need all-new hardware to take advantage of this. But it’s coming.
Ed Bott 