Back door breach of Windows XP SP2

Back door breach of Windows XP SP2 It is all to do with the SP2 measure, known as Data Execution Protection, which is intended to prevent attackers from inserting rogue code into a PC's memory and tricking Windows into running the program.

Problem

In October 2004 it was discovered by MaxPatrol team that it is possible to defeat Microsoft® Windows® XP SP2 Heap protection and Data Execution Prevention mechanism. As a result it is possible to implement:

1. Arbitrary memory region write access (smaller or equal to 1016 bytes)
2. Arbitrary code execution
3. DEP bypass.

Details are described in the article by our expert: PDF format, HTML format. Solution As a temporary security measure we've developed simple utility PTmsHORP, which allows restriction of lookaside list creation, governed by a special global flag.

Download PTmsHORP (21 Kb)

During the first execution this program shows the list of applications which already have this flag set. In order to activate this safety flag for other applications you just need to add the name of the executable file to the list. Any time you can review or modify the list of protected applications by running PTmsHORP again.

Warning. The flag, while enabled, may decrease the application performance.