Windows Vista Network Attack Surface Analysis

Short Description
operating system, Windows Vista will be widely deployed and as such is an important topic for security research. We studied the …

Website: www.symantec.com | Filesize: 2316kb

Content
Windows Vista Network Attack Surface Analysis
Dr. James Hoagland, Principal Security Researcher
Matt Conover, Principal Security Researcher, Tim Newsham, Independent Contractor, Ollie Whitehouse, Architect
Symantec Advanced Threat Research
Abstract
A broad analysis was performed on the network-facing components of the Microsoft Windows VistaTM release version. Our
analysis explores how it affects network security and how it differs from previous versions of Microsoft Windows. Windows Vista
features a rewritten network stack, which introduces a number of core behavior changes. Windows Vista also introduces a number
of new protocols, most importantly IPv6, its supporting protocols, and several IPv4 to IPv6 transition protocols. As a client
operating system, Windows Vista will be widely deployed and as such is an important topic for security research. We studied the
following protocols and technologies: LLTD, IPv4, IPv6, Teredo, TCP, SMB2 named pipes, MS-RPC, and the Windows Firewall.
We also studied ARP, NDP, IGMP, MLD, ICMPv6, and UDP.CONTENTS
I Introduction 5
II Link Layer Protocols 5
II-A Link Layer Topology Discovery protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
II-B Address Resolution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
III Network Layer 7
III-A IP Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
III-A.1 IPv4 ID Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ….