The Microsoft Windows Vista operating system mitigates this security risk by isolating services in Session 0 and making Session 0 non-interactive. In Windows Vista (and Windows Longhorn Server), only system processes and services run in Session 0. The user logs on to Session 1. On Windows Longhorn Server, subsequent users log on to subsequent sessions (Session 2, Session 3 etc). This means that services never run in the same session as users' applications and are therefore protected from attacks that originate in application code.
Specific examples of affected driver classes include:
Application classes affected by this feature:
Sessions in Windows XP / 2003
OK - so we've already mentioned that Session 0 poses a security risk because services run at elevated privilege. The first user on the console also runs in Session 0 - which provides the most common attack vector used to target unsuspecting users.
Sessions in Windows Vista
In Windows Vista, Session 0 is created for services and user-mode drivers. Session 1 is created for the first user who logs in. Applications for this user run in Session 1.
OK - so what could this actually look like in a real world scenario? Consider the following example - if a service belonging to an application generates a UI element in Session 0 - for example a dialog box waiting for the user to click "OK" or "Cancel", the application is now waiting on the service, and the UI is not displayed in the user session. From the user perspective, the application appears to be hung, when in actual fact it is performing quite normally, and patiently waiting for a user response that the user cannot see!
As you can imagine - this presents a problem for users, administrators and developers. However, there are some quick mitigating factors to consider.
When testing applications for compatibility with Windows Vista, consider the following test scenarios:
Finally, you can leverage the following Windows Vista capability solutions:
And that will do it for a quick look at how Session 0 isolation affects Application Compatibility in Windows Vista. The links below contain more information on some of the concepts discussed above. Until next time ...
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.