main

Apple adds Vista security features to QuickTime

franzon   via eweek.com on 13 April 2008 - 20:04 · 47 comments & 18305 views

Advertisement (Why?)
QuickTime for Windows Vista now supports ASLR (Address Space Layout Randomization), a Windows Vista security technology that randomly arranges the positions of key data areas to prevent malware authors from predicting target addresses. In addition to ASLR, QuickTime for Windows will also do stack buffer safety checking (Visual Studio 2005's /GS option) and support for hardware NX on Windows Vista.

Security researchers reacted to Apple's move with applause. "That's a pretty big change for a point release," said Dino Dai Zovi, a hacker who has written multiple exploits for QuickTime. "They [Apple] have way more guts than many other software companies to do something like that. Either that, or they are afraid of the backlash if malware starts targeting QuickTime and iTunes in a more serious way.”

Link: eWeek

Post a comment · Send to friend Comments · There are 47 additional comments
(14 replies) #1 Titoist on 13 Apr 2008 - 20:14
Hi, I'm a Mac,
I have stated many times how much Vista sucks, that is why I am here to say that Apple has begun innovating it's software even further by including Vista's own security technology.
#1.1 HalcyonX12 on 13 Apr 2008 - 21:46
Hi, I'm Linux. That's some great innovation, glad to see you folks catching up to 7 years ago.
#1.2 brent3000 on 13 Apr 2008 - 23:35
Hi, I'm a PC
I won
#1.3 RAID 0 on 14 Apr 2008 - 01:12
Hi, I'M A PC. All of us share the same insides, so can't we all live together in relative peace and harmony?
#1.4 TRC on 14 Apr 2008 - 01:40
I'm an Amiga, and I'm sick of all of you.
#1.5 Titoist on 14 Apr 2008 - 01:40
Hi, I'm a Mac. How DARE you call me a PC.
#1.6 cyberdrone2000 on 14 Apr 2008 - 03:03
Hi, I'm a computer user.
I'm going to use the platform that provides me with the tools and software that I need to use, regardless of the opinions of others. My rationale for using a particular system in no way defines who I am, or what demographic I am a part of. I find the comments of fanboys to be frivolous and overzealous, and I am aware of the fact that the actual differences between the platforms is minimal at best.
HA.
#1.7 Avi on 14 Apr 2008 - 03:16
Hi, I'm a sane person. You all need to get a life.
#1.8 Skyfrog on 14 Apr 2008 - 04:15
Hi, I'm a toaster oven.
#1.9 +vlsi0n on 14 Apr 2008 - 04:27
Hi toaster over,

I'm toast.
#1.10 HalcyonX12 on 14 Apr 2008 - 04:38
Hi, I'm Linux, and I can still run on all of you.
#1.11 michael.dobrofsky on 14 Apr 2008 - 06:14
(Avi said @ #1.7)
Hi, I'm a sane person. You all need to get a life.


Sense of humor gone AWOL?
#1.12 Faisal Islam on 14 Apr 2008 - 08:51
(Titoist said @ #1)
Hi, I'm a Mac,
I have stated many times how much Vista sucks.


u fool & u don't know Vista is better. Vista is Ready Now! Just get Core 2 Duo CPU, 2GB+ DDR2 Ram, Windows Vista SP1, A good AGP (I mean your computer have to a base score of 3.3*+ then you can run windows Vista confidently)

*It should be AGP's rating & minimum rating & others hardware should have 4.5+
#1.13 Pc_Madness on 14 Apr 2008 - 10:35
Hahaha, great comments. (minus Faisal's :p)
#1.14 Typhon on 14 Apr 2008 - 14:01
Hi my penis is bigger than all of you. I know cause I said so, and when you were asleep I measured you and I was bigger.

"Interviewer" So what happened when you took Extenze? "Man on street" Well what can I say? I got bigger. Then I sold my ZO6 and got a Honda Civic.
(1 reply) #2 Screaming Slave on 13 Apr 2008 - 20:15
I think it's a great move for them, too. As much as Apple enjoys taking cheap shots at Vista, they're evidently human after all.
#2.1 +Octol on 14 Apr 2008 - 04:29
(Screaming Slave said @ #2)
I think it's a great move for them, too. As much as Apple enjoys taking cheap shots at Vista, they're evidently human after all.

I beg your pardon! Apple does not take cheap shots at Vista! Apple takes very expensive shots at Vista.

You think those TV commercials are cheap??
#3 Chicane-UK on 13 Apr 2008 - 20:38
Indeed. Regardless of the bickering, if the feature is there to improve security for users, it makes sense to use it!
(2 replies) #4 pjak on 13 Apr 2008 - 21:24
the above seems to miss the most important part - what version this feature was added to:
QuickTime 7.4.5 (http://support.apple.com/kb/HT1241)
#4.1 excalpius on 14 Apr 2008 - 01:38
Thanks! It's extraordinary how bad journalism has become since the blogosphere took over.
#4.2 +Octol on 14 Apr 2008 - 04:32
(excalpius said @ #4.1)
Thanks! It's extraordinary how bad journalism has become since the blogosphere took over.

Yeah, well it's always been "unprofessional" here. Apparently it looks better, too!
#5 Express on 13 Apr 2008 - 21:25
Must have been major project to turn ON /NXCompat /dynamicbase and /GS compiler options.
#6 RealFduch on 13 Apr 2008 - 21:27
Wait until Apple says Microsoft copied these features from QuickTime.
(3 replies) #7 HalcyonX12 on 13 Apr 2008 - 21:38
QuickTime will be getting stack buffer safety checking and function call safety checking, all designed to help prevent buffer overflows. Also just to clarify, ASLR isn't a Vista or MS technology, I'm not sure why the article refers to it as a "Vista security feature"... even if only referring to MS products, WehnTrust enables ASLR in Windows 2000/XP/2003.
#7.1 BBinder on 13 Apr 2008 - 21:54
(HalcyonX12 said @ #7)
WehnTrust enables ASLR in Windows 2000/XP/2003.


omg i'm not installing that again took my computer into a rebooting loop had to safemode to disable the program before i could get int windows properly
#7.2 HalcyonX12 on 13 Apr 2008 - 21:59
Thanks for the warning, I guess some programs rely on the bugs and break badly when they aren't present? That software's been around for a while though so they must have worked through most issues. File a bug report or check the FAQ I guess!
#7.3 helios01 on 14 Apr 2008 - 06:10
Maybe because it's available in the Windows Vista API, it just took Apple this long to use Vista security features.
http://msdn2.microsoft.com/en-us/library/bb430720.aspx
(1 reply) #8 stevehoot on 13 Apr 2008 - 21:47
It's about time. Whilst I don't use a Mac on a daily basis, I am aware that the iTunes software is rated as pretty good in terms of the UI etc.

However as it stands, the day Apple written software runs on my system is the day you can prise the root password from my dead, lifeless hands. Quicktime, iTunes and Safari are a joke in terms of security - I applaud their efforts in addressing security, but it's long, long overdue.
#8.1 excalpius on 14 Apr 2008 - 01:39
They're a joke in terms of memory management too. Really, really amateur hour stuff on display from Apple in this regard.
(8 replies) #9 theyarecomingforyou on 13 Apr 2008 - 22:37
Now if they could just turn iTunes and Quicktime into decent pieces of software people might actually care.
#9.1 Islander on 13 Apr 2008 - 22:42
I'd be happy if they started to make the updater work. If you happen to own a x64 system and want to update iTunes 64bit using the provided updater... you get the 32bit installer from their servers. Great work, Apple !
#9.2 HalcyonX12 on 13 Apr 2008 - 22:47
'Cause you badly want Safari?

(theyarecomingforyou said @ #9)
Now if they could just turn iTunes and Quicktime into decent pieces of software people might actually care.


I understand your gripes about using QuickTime as a media player (I'd rather use VLC) but it's also an underlying framework for video and audio on OSX. But iTunes pioneered a great way of cataloging + searching your local music, and managing devices and playlists. It may not be your preference, but it's not without merit.
#9.3 5Horizons on 13 Apr 2008 - 23:04
(Islander said @ #9.1)
I'd be happy if they started to make the updater work. If you happen to own a x64 system and want to update iTunes 64bit using the provided updater... you get the 32bit installer from their servers. Great work, Apple !

Haha, I hadn't tried updating yet so I'm glad I read your post. I usually only update once in a while since it rarely adds any functionality and re-enables all of its stupid services.
#9.4 anthonyspt on 13 Apr 2008 - 23:48
(HalcyonX12 said @ #9.2)
But iTunes pioneered a great way of cataloging + searching your local music, and managing devices and playlists. It may not be your preference, but it's not without merit.


This is where I have to say something, and go, no...

The iTunes cataloging system, the way the UI works, the search mechanism, or even device management are not things that Apple created, in fact are direct copies of two different products, one of them being MS's own Windows Media Player.

Go look at the Vista (longhorn) Windows Media player preivew from several years ago, it was about a year after MS demoed it at a tech conference, that its features appeared in the next version of iTunes. This includes the library UI, cataloging system, and search abilities, where MS Windows Media player even demoed searching the Web Media store within the UI transparently. (And worked like this until URGE got POed at MS for Zune)

Even the device management, is a knock off of Windows XP, which built MP3 and media device support into the OS, long before OS X even could handle these devices. WMP uses the OS inherent technologies. Sadly using iTunes on Windows is painful, as Apple tries to handle all the iPod management themselves and does it poorly if have used products from Creative or other MP3 player companies that have inherent Windows support at the OS level.

(Nothing better than dragging and dropping WMA, MP3, XVID, etc files to your MP3 player from explorer, and Explorer will even convert the content if your player doesn't support it.)

Anyway, iTunes isn't bad, but what you are giving it credit for bringing to the market or users is stuff that Apple ripped off. Google it for more info or references...
#9.5 theyarecomingforyou on 14 Apr 2008 - 00:15
I love the interface of iTunes - it's just that the program itself is slow and bloated, becoming more so with later versions. On Vista it also features the black screen bug and the interface is very slow to redraw when dragging columns. It does not respond like a native Windows application.
#9.6 ajua on 14 Apr 2008 - 03:54
(HalcyonX12 said @ #9.2)
'Cause you badly want Safari?

(theyarecomingforyou said @ #9)
Now if they could just turn iTunes and Quicktime into decent pieces of software people might actually care.


I understand your gripes about using QuickTime as a media player (I'd rather use VLC) but it's also an underlying framework for video and audio on OSX. But iTunes pioneered a great way of cataloging + searching your local music, and managing devices and playlists. It may not be your preference, but it's not without merit.


Since when iTunes "pioneered" catalogs and searching local databases of music files? Some windows and linux software did pioneered this. AS of now, iTunes is unable to show a "playing now" view or feature. Also they can't remove automatically files that are no longer in your hard disks. You can't even reset your iPod if you dont't have an internet connection! And the obsession to make file duplicates without asking in the first place (the latest versions don't do this anymore)?.

Is that too much to ask? (not for me, i use J. River Media Center).

After all the hype of iPods, iTunes really is an "ok" program at best. There are more for Windows and Linux which are better. Maybe, i don't know there are as well some OSX alternatives out there.
#9.7 HalcyonX12 on 14 Apr 2008 - 04:43
iTunes was out in 2001, although it was created in 1999. I dunno what you mean, but I guess you're talking about some extra features, I'm just talking about the device syncing to different playlists as well as the search and catalog functions introduced at that time. Can you reference WMP having that at that time?
#9.8 ajua on 15 Apr 2008 - 01:43
(HalcyonX12 said @ #9.7)
iTunes was out in 2001, although it was created in 1999. I dunno what you mean, but I guess you're talking about some extra features, I'm just talking about the device syncing to different playlists as well as the search and catalog functions introduced at that time. Can you reference WMP having that at that time?


WMP no, but as far as i can recall, J River Media Center was in v7 o v8 with the same music library approach and better management features than iTunes. Also iTunes didn't support windows at that time. By now, iTunes is believed by many to add those features to the users in the first place.
(4 replies) #10 Quasar2112 on 14 Apr 2008 - 00:31
What I don't like about iTunes for Windows:

1. Bloat

2. Bloat

3. Lack of security

4. Most songs aren't available DRM-free

5. Bloat

6. Can't buy AACs with a web browser. Have to use iTunes

7. Having software from Apple, Inc. on my computer
#10.1 hagjohn on 14 Apr 2008 - 01:00
8. Duplicate songs
#10.2 r3volution on 14 Apr 2008 - 04:46
I think you forgot "Bloat"
#10.3 NegaC on 14 Apr 2008 - 13:06
I actually like iTunes, I use it pretty much full time as my media player now. I use to hate it but I've realised it's great at organising all my music and albums. I've even bought a few songs from the music store (iTunes plus of course, no DRM). I'm not sure how it's 'bloated', because it runs pretty snappy for me, and I can't live without the instant search now.

The only thing that's annoying is that can't download music from shared libraries over the network.

Perhaps someone can suggest a media player with similar features including sharing and downloading easily over a network?

And I hardly think duplicate songs is a fault of iTunes, at least it allows you to see all your duplicates seperately so you can delete them if you want to.
#10.4 ajua on 15 Apr 2008 - 01:45
(NegaC said @ #10.3)
I actually like iTunes, I use it pretty much full time as my media player now. I use to hate it but I've realised it's great at organising all my music and albums. I've even bought a few songs from the music store (iTunes plus of course, no DRM). I'm not sure how it's 'bloated', because it runs pretty snappy for me, and I can't live without the instant search now.

The only thing that's annoying is that can't download music from shared libraries over the network.

Perhaps someone can suggest a media player with similar features including sharing and downloading easily over a network?

And I hardly think duplicate songs is a fault of iTunes, at least it allows you to see all your duplicates seperately so you can delete them if you want to.


J. River Media Center can do sharing over network, streaming music, photos or video and more. You have yo pay for those features though.

If you want just music support, burning, ripping etc try their free version called Media Jukebox, its the same as Media Center but without video, photo and server support.
#11 ajua on 14 Apr 2008 - 04:01
It is just a standard practice in software development, but apple did take too long to take care of their mess with Quicktime for Windows / iTunes for Windows. Hopefully the wave of security flaws about quicktime will drop bacause for more than a year or so their player was infested with them.
#12 _dandy_ on 14 Apr 2008 - 12:36
> They [Apple] have way more guts than many other software companies to do something like that

I don't understand that claim. Using a few compiler switches makes them "have way more guts than many other software companies"?
#13 C_Guy on 14 Apr 2008 - 15:09
"or they are afraid of the backlash if malware starts targeting QuickTime and iTunes in a more serious way"

Bingo.
#14 Patchou on 15 Apr 2008 - 02:31
They [Apple] have way more guts than many other software companies to do something like that

What?! Since when being a year and a half late gets you some praise from "security researchers"? that's the kind of comment that seriously ****es me off as a software developer. Using a new API call and a compiler switch is nothing to be proud about, get real.

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Advertisement (Why?)