Data Execution Prevention - White Paper, 2nd Edition

ManualsBrandsHP ManualsDesktopsHP Compaq dc5100 Small Form Factor PC

Data Execution Prevention

v1.2

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2

Data Execution Prevention (DEP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3

What does Data Execution Prevention do? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3

Data Execution Prevention Exception Message Box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

Hardware-Enforced DEP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

What is PAE? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4

Why is this change important? What threats does it help mitigate? . . . . . . . . . . . . . . . . . . .4

Will my NX- or XD-enabled systems protect me from virus attacks? . . . . . . . . . . . . . . . . . . .5

What are the required components for XD/NX to function? . . . . . . . . . . . . . . . . . . . . . . . . 5

How do I control the DEP functionality on my computer? . . . . . . . . . . . . . . . . . . . . . . . . . . 8

DEP Level Chart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Data Execution Prevention Tab - No XD/NX Processor . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Software-Enforced DEP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Deploying Hardware-Enabled Data Execution Prevention . . . . . . . . . . . . . . . . . . . . . . . . . . . .11

How will XD/NX impact HP customers? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

What about customers who create their own software image? . . . . . . . . . . . . . . . . . . . . . 11

Advantages of using XD/NX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12

Disadvantages of using XD/NX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Conclusion and Recommendation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12

Known Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13

Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16

Summary of content (21 pages)

PAGE 1
Data Execution Prevention v1.2 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Data Execution Prevention (DEP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 What does Data Execution Prevention do? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Data Execution Prevention Exception Message Box . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 2
Based upon Microsoft TechNet article “Changes to Functionality in Microsoft's Windows XP Service Pack 2,” dated August 9, 2004, by Starr Anderson & Vincent Abella. Introduction Microsoft’s Windows XP Service Pack 2 introduces a set of security technologies that will help improve the ability of computers running Windows XP to withstand malicious attacks, especially those from viruses and worms such as Code Red, Blaster and Sasser.
PAGE 3
Data Execution Prevention (DEP) What does Data Execution Prevention do? Data Execution Prevention (DEP) is a set of hardware and software technologies that perform checks on memory to help protect against malicious code and viruses. In Windows XP SP2, DEP is enforced by both hardware and software.
PAGE 4
What is PAE? The XD and NX features require that the processor run in Physical Address Extension (PAE) mode. A 32-bit processor, such as the Intel Pentium 4 (IA32 family), is usually limited to addressing a maximum of 4-GB of memory. This limitation is due to 32 bits of address capability, as follows: 232 = 4,294,967,296 (4 GB) To address more than 4-GB of memory, Intel created PAE mode.
PAGE 5
Will my NX- or XD-enabled systems protect me from virus attacks? XD and NX are promising technologies, but they do not protect against all attacks. You should use XD and NX with antivirus software, firewall, and other security measures to reduce the propagation of viruses and limit the amount of damage they can create.
PAGE 6
How do I know if I have an XD- or NX- capable processor? The System Properties window indicates whether PAE is enabled on systems installed with Windows XP SP2 that also have an XD- or NX-capable processor. System BIOS • Default XD support is disabled for Intel 915 2004 systems. • Default XD support is enabled for Intel 945 2005 systems. • Default NX support is enabled for AMD 2005 systems. • Default NX support is disabled for Transmeta systems.
PAGE 7
The Data Execution Prevention option is disabled by default in i915-based systems, and enabled by default in i945-based systems. Applications and drivers run without compatibility problems when the XD feature is not enabled.
PAGE 8
How do I control the DEP functionality on my computer? Systems installed with Windows XP SP2 include a Data Execution Prevention tab, located at System Properties > Advanced. This tab allows the user to enable DEP for either: • Essential Windows programs and services only - This option equates to the OptIn policy. Applications can enable DEP protection by creating a compatibility shim (a small piece of software added to a program to provide an enhancement) and installing it with the application.
PAGE 9
DEP Level Chart Processor Support BIOS DEP Setting OS BOOT.INI Setting No N/A Any Setting Only software-enforced DEP is available for limited Windows system binaries. Yes Disabled Any Setting Only software-enforced DEP is available for limited Windows system binaries. Yes Enabled Always On • Hardware and software-enforced DEP coverage for all Windows binaries, programs, and drivers. • • No programs or drivers can be exempted.
PAGE 10
Data Execution Prevention Tab - No XD/NX Processor The following image shows the Data Execution Prevention tab on a system without an XD/NX-enabled processor. Windows notifies the user that the system does not contain a processor capable of XD/NX, but that software-enforced DEP is available. NOTE: To prevent Windows XP SP2 from using DEP, set the operating system to /alwaysoff in the BOOT.INI file.
PAGE 11
If a program was built with Safe Structured Exception Handling (SafeSEH), then software-enforced DEP can determine if the exception handler is registered in the function table located within the program image file before an exception is dispatched. If a program is not built with SafeSEH, then softwareenforced DEP checks whether the exception handler is located within a memory region marked as executable before an exception is dispatched.
PAGE 12
Advantages of using XD/NX Enabling XD/NX provides increased protection against viruses that use buffer overflow attacks. This increased protection provides the benefit of increased network security as malicious code cannot propagate or spread to infect more computers. Support staff also benefits from much improved containment and easier eradication of unwanted software. Disadvantages of using XD/NX XD/NX compatibility issues can occur for both applications and drivers.
PAGE 13
Known Issues The following table provides a list of drivers and applications for which HP has discovered XD compatibility issues during testing. The table also provides a list of Microsoft Knowledge Base articles that address incompatibilities Microsoft has found during testing. Application Effect Workaround/Solution 3DMark 2001 SE. Exception error. Add to exclusion list. 3DMark 2003 SE. Exception error. Add to exclusion list. Adobe Reader 6.0. Long time to load. Add to exclusion list.
PAGE 14
Application Effect Workaround/Solution (Continued) Intervideo WinDVD. Exception error during installation and runtime. Add to exclusion list. Intervideo WinDVD Creator. Exception error during installation due to Install Shield. Add to exclusion list for installation, can remove afterwards. Java Web Start. Program does not run, but no exception error. Add to exclusion list. JAWS. Exception error during installation due to Install Shield.
PAGE 15
Application Effect Workaround/Solution (Continued) Roxio Cineplayer. Exception error during installation and runtime. Add to exclusion list. Roxio Easy Media Creator. Exception error during installation and runtime. Add to exclusion list. Sysmark 2004. Exception error during installation and runtime. Add to exclusion list. WinDiags. Exception error. Add to exclusion list. Window-Eyes Exception error during installation due to Install Shield.
PAGE 16
Frequently Asked Questions What is XD? Execute Disable Bit (XD) functionality can prevent certain types of buffer overflow attacks when used with a supporting operating system and system BIOS. XD allows the processor to classify areas in memory where application code can and cannot execute. When a virus or worm attempts to insert code in the buffer, the processor disables code execution, preventing damage or virus or worm propagation.
PAGE 17
How or where does DEP fit in? DEP works with XD/NX to help prevent execution of malicious code. Will an XD or NX processor work without Windows XP SP2? At this time, XD/NX support requires the following operating systems: • Windows XP SP2 • Windows Server 2003 SP1 • SUSE Linux 9.2 • Red Hat Enterprise Linux 3 Update 3 What will these technologies do for me? XD and/or NX potentially reduces the number of viruses that exploit buffer overruns, providing greater overall system security.
PAGE 18
If the XD is disabled by default, how do I turn it on? The BIOS for the i915 chipset-based 2004 and i945-chipset based 2005 desktop systems uses the CPUID instruction to locate the Execute Disable bit to determine if the installed processor supports XD. If XD is supported, then the Data Execution Prevention option appears in the Security section of F10 Setup. You can enable or disable this feature.
PAGE 19
Will XD-capable processors cost more? XD/NX-capable chips will be sold at approximately the same or slightly higher cost compared to versions without XD bit. When will they start showing up in the HP desktops I purchase? HP is shipping: • i915 chipset desktop systems with XD disabled in F10 Setup. • i945 chipset desktop systems with XD enabled in F10 Setup.
PAGE 20
How will I know if current applications will work? If an application conflicts with DEP, you may see the following error message: Data Execution Prevention – Microsoft Windows To help protect your computer, Windows has closed this program. Name: program name Publisher: program publisher To avoid this behavior, contact your program vendor to see if an update is available that enables the program to work correctly with DEP.
PAGE 21
What is the minimum processor speed required Because XD/NX uses memory tagging, there is no minimum processor speed required for XD/ NX to function. The minimum speed XD processor that Intel has released is the 325J Celeron that runs at 2.53GHz. Currently, all AMD Athlon 64 processors support NX. Will this affect remote users on my network? As long as software is properly developed, remote users will not be affected.