| Address space layout randomization in Vista |
 |
 |
| Thursday, 04 January 2007 19:38 | |||||||||||||
      
Windows Vista includes a new defense against buffer overrun exploits called address space layout randomization. ASLR. is just a way to hide insecure code, and make harder automated attacks on millions of machine except if....but I will come on that later
In Vista, a DLL or EXE could be loaded into any of 256 locations, which means an attacker has a 1/256 chance of getting the address right. In short, this reduce the number of successful exploits. Vitsa address-space layouts are randomized only at boot time. Ae You safer with Vista? YES! and NO! On a 32 bits machine, this protection is not working, simply because some smart people, have already worked on a way to circumvent ASLR, so a Linux PC will be more or less 216 seconds longer safe!Google when typing ASLR give a second link (sic) this handy white paper: On the Effectiveness of AddressSpace Randomization
Why it take so much time? because they have decide to translate the buffer overflow issue in the translated address space.. and brute forcing till success. In Apache, the famous opensource webserver, that mean 2^16 = 65; 536 probes at worst and 32,768 probes on the average....Vista has only 256 slots for a dll or exe...so how much time would it take? For all reader which like to play with pointer, the white paper is worth reading... Vista has also long pointer obfuscation, long living address being encrypted and decrypted at runtime when needed...this long pointer values will have particularities like a high entropy values so easily reperable in memory even if they move then periodically or randomly from place to place (Like PGP caching keys in memory). Implementation which randomizes the base address of the stack, heap, and code segments and adds random padding to stack frame and malloc() function calls. Since for sure the obfuscation algorithm is secret, it will break quite fast, as security by obscurity has always be known to failed. What would I like to say? first that this technology is nothing special, it is one technique among others, and will be broken quite fast depending on how informations the Operating system leak or how it was implemented Moreover, it is existing since a long time.
Nothing will replace a well written code, that mean architecturally reviewed, with an open code, open to see, open to critics. Open Source IS the future.
Powered by !JoomlaComment 3.20
3.20 Copyright (C) 2007 Alain Georgette / Copyright (C) 2006 Frantisek Hliva. All rights reserved."
|
Tags
| Another articles: |
|---|
|
| Powered By relatedArticle |
