5 ms·
Worth noting that removing 16bit support in windows is an enormous security win, because the DOS stuff relied on things that are really bad for security. 32-bit
by rvp-x 7y ago
Worth noting that removing 16bit support in windows is an enormous security win, because the DOS stuff relied on things that are really bad for security. 32-bit support is a lot more sustainable.
- asveikau 7y agoCitation needed. 16 bit code is fairly well isolated in NT-based Windows.
- yegle 7y agoWiki suggest 16bit of Address Space Layer Randomization can be bruteforced in minutes, citing source: Shacham, H.; Page, M.; Pfaff, B.; Goh, E.J.; Modadugu, N.; Boneh, D (2004). On the Effectiveness of Address-Space Randomization. 11th ACM conference on Computer and communications security. pp. 298–307.
- badsectoracula 7y agoWhat sort of security critical software will run as a 16bit Windows program and be the target for an attack accessible from wherever those attacks enter the system?
- asveikau 7y agoNobody expects aslr from 16 bit legacy code with only 1mb of address space. I think you are describing 16 bits of randomization on a 32 or 64 bit process though. What I mean is that the virtualization of 16 bit code (using vm86) is isolated from a security perspective, it won't violate process boundaries or kernel security features like ACLs. I believe this was less true in 9x which might be where the confusion comes from.
- makomk 7y agoDunno about on Windows, but the Linux kernel support for 16-bit code has lead to some nasty, subtle privilege escalation exploits due to the really gnarly processor state changes required.
- masterchill 7y agoDidn't know Linux kernel had 16-bit support.