ASLR support

[reca]

Hello,

I'd like to ask you to fully support ASLR protection on Windows, including for the dll that Virtual Clone loads to Explorer.exe. It opens Explorer to attacks.


Thanks

 

[James]

Hello,

I'd like to ask you to fully support ASLR protection on Windows, including for the dll that Virtual Clone loads to Explorer.exe. It opens Explorer to attacks.


Thanks

What is ASLR?
Do you have a link which explains it?

 

[reca]

What is ASLR?
Do you have a link which explains it?

ASLR means Address Space Layout Randomization.

ASLR moves executable images into random locations when a system boots, making it harder for exploit code to operate predictably.

Source: http://msdn.microsoft.com/en-us/library/bb430720.aspx

I didn't verify if Virtual Clone supports DEP, but DEP and ASLR should be used together.

DEP is also mentioned in the same link.

More:

http://blogs.msdn.com/b/michael_how...ce-layout-randomization-in-windows-vista.aspx

http://msdn.microsoft.com/en-us/library/bb384887.aspx

I'm sure you'll find more info on both ASLR and DEP, by searching MSDN library.


Thanks

 

[James]

ASLR means Address Space Layout Randomization.



Source: http://msdn.microsoft.com/en-us/library/bb430720.aspx

I didn't verify if Virtual Clone supports DEP, but DEP and ASLR should be used together.

DEP is also mentioned in the same link.

More:

http://blogs.msdn.com/b/michael_how...ce-layout-randomization-in-windows-vista.aspx

http://msdn.microsoft.com/en-us/library/bb384887.aspx

I'm sure you'll find more info on both ASLR and DEP, by searching MSDN library.


Thanks

Thanks, I'll forward this to the people in charge.

 

[evlncrn8]

Its another useless microsoft 'security' thing, and its easy to get the addresses of dlls etc in a process without apis, theres quite a few rootkits out there that do it.. As for dep, thats a joke too..there are at least two methods to backdoor it (ie: get windows to turn it off for the process..and its easily visible in the code), and one api call to disable it in the current process or in another process.

Note that i am being deliberately vague and not going into details but believe me.. Dep and aslr in windows is about as good as a chocolate fireguard.. Also dep was enabled by default in xp sp2, using hardware nx flag (if supported) or software mode... In essence it doesnt allow code to be executed from stack (unless backdoor or api call is used) or from an area of memory not marked as PAGE_EXECUTE... nothing a VirtualProtect / VirtualProtectEx call cant fix..and not many viruses / rootkits execute code on the stack nowadays anyway....

 

[reca]

Its another useless microsoft 'security' thing, and its easy to get the addresses of dlls etc in a process without apis, theres quite a few rootkits out there that do it.. As for dep, thats a joke too..there are at least two methods to backdoor it (ie: get windows to turn it off for the process..and its easily visible in the code), and one api call to disable it in the current process or in another process.

I suppose you know your stuff...

Note that i am being deliberately vague and not going into details but believe me..~snip~

Vague... Providing no details... I'll trust you...

No one (Microsoft, etc) ever said that DEP and ASLR are the silver-bullet. They aren't. But they do make it harder for processes to be exploited, untill developers of the different applications patch their apps.

Windows 8 will step up in terms of attacks mitigation, including improved ASLR.

Address Space Layout Randomization (ASLR). ASLR was first introduced in Windows Vista and works by randomly shuffling the location of most code and data in memory to block assumptions that the code and data are at same address on all PCs. In Windows 8, Microsoft extended ASLR’s protection to more parts of Windows and introduced enhancements such as increased randomization that will break many known techniques for circumventing ASLR.

Sometime ago a friend told me this: Any security implementation is useless, because, at some point, everything gets breached. Not necessarily related to computers, but everything in life.

The question is: If the means to make such breach harder exist, then why not make the breach harder and mitigate it?

It's like diseases. Are we free from them? No. Can we make it harder for them to breach our defenses and mitigate what they do? Yes, we can.