Microsoft Attack Surface Analyzer Catalogs Threats

Free tool helps developers, IT personnel, and security audit teams review threats posed by software installed on a Windows PC.

11 Security Sights Seen Only At Black Hat (click image for larger view and for slideshow)
Whats the information security threat posed by any given piece of software thats installed on a Windows machine?
To help businesses answer that question, Microsoft last week released its free
Attack Surface Analyzer 1.0 tool
. The purpose of this tool is to help software developers, independent software vendors (ISVs), and IT professionals better understand changes in Windows systems attack surface resulting from the installation of new applications, according to a blog post written by Microsofts Monty LaRue and Jimmie Lee, who are part of its trustworthy computing security group.
The tool analyzes newly added--or changed since the last scan--files and registry keys, as well as Microsoft ActiveX controls, services, process threads, and open ports, among other parameters. Unlike many tools that analyze a system based on signatures or known vulnerabilities, Attack Surface Analyzer looks for classes of security weaknesses Microsoft has seen when applications are installed on the Windows operating system, and it highlights these as issues, according to LaRue and Lee. The tool also gives an overview of changes to the system that Microsoft considers important to the security of the platform, and it highlights these changes in the attack surface report.
Attack Surface Analyzer will collect attack data from Windows Vista, Windows 7, Windows 8, as well as various versions of Windows Server 2008 and 2012 systems. Using the .NET Framework 4, all of those systems--bar Vista--can also be used to analyze the collected data and generate related reports.
[ Learn
Microsoft Windows Support Call Scams: 7 Facts
. ]
Microsoft had released a
beta version
of the tool for general use early last year. Microsoft said the latest version incorporates a number of performance enhancements and bug fixes, results in a lower number of false positives, has a better graphical user interface, and now includes in-depth documentation. Beta users, however, will need to start with fresh data collection, as Microsoft said the latest version wont work with any previously collected baseline or application scans.
In recent years, Microsoft has been working to reduce the attack surface of its own applications by getting serious about secure coding, as well as adding the latest
attack mitigation technologies
into its products. Those include data execution prevention (DEP), which helps block arbitrary code execution, as well as address space layout randomization (ASLR), which makes it difficult for attackers to locate objects--such as DLL files--that would make it easier for them to launch a successful exploit.
On a related note, Microsoft last month released a new version of its
Enhanced Mitigation Experience Toolkit
(EMET), now at v3.5, which allows newer mitigation technologies to be applied to older products. It takes mitigations that exist in later versions of Windows--like ASLR and DEP-- and it will allow you to run them on XP and Vista, said Mike Reavey, director of the Microsoft Security Response Center, in an interview at the Black Hat conference in Las Vegas last month. So if you have an old version of Office that isnt aware of DEP, or even Adobe Reader, you can now apply DEP to that.
He said the latest version also incorporates four new defenses against return-oriented programming (ROP), which Microsoft gleaned thanks to its $250,000
BlueHat Prize
. Ivan Fratric, a researcher at the University of Zagreb in Croatia, invented ROPGuard, which watches for--and blocks at runtime--certain types of return-oriented programming attacks. Fratric ultimately
took second place
in the contest, winning $50,000.
Microsofts Reavey said that the innovative ROP watch-guard technology demonstrated the benefit of having vendors work with independent security researchers, via such programs as the BlueHat prize. That shows the power thats available if you partner with this community, he said.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Microsoft Attack Surface Analyzer Catalogs Threats