Windows 8 Bible

Thwarting Exploits with DEP

Thwarting malware attacks that exploit software vulnerabilities is the most important element of automatic updates. But Windows 8 offers a second way of thwarting such attacks. It’s called Data Execution Prevention (DEP). You don’t want to use DEP as an alternative to other techniques described in this part of the book. Rather, you want to use it in addition to other techniques.

Many malware attacks use a technique called buffer overflow (or buffer overrun) to sneak code (program instructions) into areas of memory that only the operating system (Windows) should be using. Those areas of memory have direct access to everything on your computer. So any bad code that sneaks into that area can do great damage.

More Security Tricks Up Its Sleeve

Some malware techniques rely on well-known memory locations to exploit system vulnerabilities. Windows 8 has a surprise for those programs, too. It does not load essential programs to well-known, predictable locations. Instead, it uses Address Space Layout Randomization (ASLR) to load things in a random location each time you start your computer. So malware writers can’t really know in advance where a particular exploit resides in memory, making it much more difficult to exploit those memory addresses.

Data Execution Prevention is a security antidote to such attacks. It monitors programs to make sure they use only safe and appropriate memory locations. If DEP notices a program trying to do anything sneaky, ...