Windows Vista Security Tidbits Steve Riley Senior Security

Windows Vista Security Tidbits Steve Riley Senior Security Strategist Microsoft Corporation steve. riley@microsoft. com http: //blogs. technet. com/steriley © 2006 Microsoft Corporation. All rights reserved.

Overview User And Group Changes Admin account New/Missing SIDs New/Missing Users and Groups Cached credentials Kernel Changes Buffer overflow protection ACL Changes Encryption changes Suite B TS SSO EFS with Smart Cards Audit changes User rights New and changed security options Firewall Auth IP SMBv 2 © 2006 Microsoft Corporation. All rights reserved.

User and Group Changes © 2006 Microsoft Corporation. All rights reserved.

Administrator Account Status © 2006 Microsoft Corporation. All rights reserved.

Built-in “Administrator” Safe mode created a hole: reboot and login without a password! New behavior: Non-domain: if you have a local admin, safe mode prohibits use of BA Domain: BA can never be used © 2006 Microsoft Corporation. All rights reserved.

Power Users Are Not Anymore © 2006 Microsoft Corporation. All rights reserved.

New Groups © 2006 Microsoft Corporation. All rights reserved.

Some Additional SIDs © 2006 Microsoft Corporation. All rights reserved.

And A Few More SIDs The Trusted Installer INTERNET USER High integrity SID A Service Medium integrity SID System integrity SID Low integrity SID © 2006 Microsoft Corporation. All rights reserved.

Integrity Levels in Token © 2006 Microsoft Corporation. All rights reserved.

ACL Changes © 2006 Microsoft Corporation. All rights reserved.

ACL Modifications © 2006 Microsoft Corporation. All rights reserved.

Old ACL UI © 2006 Microsoft Corporation. All rights reserved.

New ACL UI © 2006 Microsoft Corporation. All rights reserved.

Owner Needs Explicit Perms © 2006 Microsoft Corporation. All rights reserved.

Crypto Changes © 2006 Microsoft Corporation. All rights reserved.

Offline Files Encrypted Per User © 2006 Microsoft Corporation. All rights reserved.

Encrypted Pagefile © 2006 Microsoft Corporation. All rights reserved.

Suite-B Crypto Software and Smart Card Key Storage Providers Cryptographic configuration NIST ECC Prime Curves support (smart cards too) AES SHA-2 IPsec support for AES and ECDH ECC cipher suites in SSL EFS with smart cards © 2006 Microsoft Corporation. All rights reserved.

Cached Credentials Much Tougher © 2006 Microsoft Corporation. All rights reserved.

Improved Auditing © 2006 Microsoft Corporation. All rights reserved.

Granular Audit Policy © 2006 Microsoft Corporation. All rights reserved.

Object Access Auditing Object Access Attempt: Object Server: %1 Handle ID: %2 Object Type: %3 Process ID: %4 Image File Name: %5 Access Mask: %6 © 2006 Microsoft Corporation. All rights reserved.

Object Access Auditing An operation was performed on an object. Subject : Security ID: %1 Account Name: %2 Account Domain: %3 Logon ID: %4 Object: Object Server: %5 Object Type: %6 Object Name: %7 Handle ID: %9 Operation: Operation Type: %8 Accesses: %10 Access Mask: %11 Properties: %12 Additional Info: %13 Additional Info 2: %14 © 2006 Microsoft Corporation. All rights reserved.

Added Auditing For Registry value change audit events (old+new values) AD change audit events (old+new values) Improved operation-based audit Audit events for UAC Improved IPSec audit events including support for Auth. IP RPC Call audit events Share Access audit events Share Management events Cryptographic function audit events NAP audit events (server only) IAS (RADIUS) audit events (server only) © 2006 Microsoft Corporation. All rights reserved.

More Info In Event Log UI © 2006 Microsoft Corporation. All rights reserved.

XML Events © 2006 Microsoft Corporation. All rights reserved.

New Event Numbers © 2006 Microsoft Corporation. All rights reserved.

New and Modified User Rights © 2006 Microsoft Corporation. All rights reserved.

Changes to User Rights All rights for Power Users removed Create global objects does not have INTERACTIVE SE_IMPERSONATE has added IIS_IUSRS and removed ASPNET Logon as a service is now empty by default © 2006 Microsoft Corporation. All rights reserved.

New User Rights Access credential manager as a trusted caller Winlogon uses for credential manager backup/restore Change time zone user right Create symbolic links Modify an object’s integrity label Synchronize directory service data Increase a process working set © 2006 Microsoft Corporation. All rights reserved.

Security Options With Modified Defaults © 2006 Microsoft Corporation. All rights reserved.

Anonymous Named Pipes © 2006 Microsoft Corporation. All rights reserved.

Anonymous Named Pipes © 2006 Microsoft Corporation. All rights reserved.

Network access: remotely accessible registry paths © 2006 Microsoft Corporation. All rights reserved.

Network access: remotely accessible registry paths © 2006 Microsoft Corporation. All rights reserved.

Network access: shares that can be accessed anonymously © 2006 Microsoft Corporation. All rights reserved.

Network access: shares that can be accessed anonymously © 2006 Microsoft Corporation. All rights reserved.

Network Security: Do not store LAN Manager hash value on next password change © 2006 Microsoft Corporation. All rights reserved.

Network Security: Do not store LAN Manager hash value on next password change © 2006 Microsoft Corporation. All rights reserved.

Network security: LAN Manager authentication level © 2006 Microsoft Corporation. All rights reserved.

Network security: LAN Manager authentication level © 2006 Microsoft Corporation. All rights reserved.

Devices: Allowed to format and eject removable media © 2006 Microsoft Corporation. All rights reserved.

Devices: Allowed to format and eject removable media © 2006 Microsoft Corporation. All rights reserved.

Devices: Restrict CD-ROM/Floppy access to locally logged on user only © 2006 Microsoft Corporation. All rights reserved.

Devices: Restrict CD-ROM/Floppy access to locally logged on user only © 2006 Microsoft Corporation. All rights reserved.

Devices: Unsigned driver installation behavior © 2006 Microsoft Corporation. All rights reserved.

Devices: Unsigned driver installation behavior © 2006 Microsoft Corporation. All rights reserved.

Why Change It? © 2006 Microsoft Corporation. All rights reserved.

Devices and Drivers © 2006 Microsoft Corporation. All rights reserved.

Allowing users to install drivers © 2006 Microsoft Corporation. All rights reserved.

Installing devices © 2006 Microsoft Corporation. All rights reserved.

Configuring device restrictions © 2006 Microsoft Corporation. All rights reserved.

New Security Options © 2006 Microsoft Corporation. All rights reserved.

Network access: Restrict anonymous access to named pipes and shares © 2006 Microsoft Corporation. All rights reserved.

System settings: Optional subsystems © 2006 Microsoft Corporation. All rights reserved.

System settings: Use certificate rules on windows executables for software restriction policies © 2006 Microsoft Corporation. All rights reserved.

Lots and lots of GP changes © 2006 Microsoft Corporation. All rights reserved.

Last Logon Display © 2006 Microsoft Corporation. All rights reserved.

Trusted Path Credential Entry © 2006 Microsoft Corporation. All rights reserved.

Smart Card Policies © 2006 Microsoft Corporation. All rights reserved.

RDP © 2006 Microsoft Corporation. All rights reserved.

New RDP Control © 2006 Microsoft Corporation. All rights reserved.

New RDP Control © 2006 Microsoft Corporation. All rights reserved.

Timeless Security Advice! Order online: http: //www. protectyourwindowsnetwork. c om steve. riley@microsoft. com http: //blogs. technet. com/steriley © 2006 Microsoft Corporation. All rights reserved.