Slashdot Mirror
Defeating XP SP2 Heap Protection
hobo2k writes "XP SP2 included canary values and hardware-implemented execution protection in order to avoid exploitable buffer overruns. Now Positive Technologies has released an article describing one way that protection could be bypassed. To solve the problem, they provide a program which disables the small allocation heap as described here. CNET reports that SP2 has been foiled."
firefox
maybe Microsoft?
Now Positive Technologies has released an article describing one way that protection could be bypassed.
A security problem in Windows? no way...
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Protection? What protection?
http://www.vorck.com/remove-ie.htmlm sfn.org/nlite.html
http://nuhi.
C'mon, this has been known for a while ;)
Error 407 - No creative sig found
should bugs or exploits in windows still be frontpagenews ?
I'm surprised it took this long...
I happen to like Chalk and Cheese!
XP SP2 included canary values and hardware-implemented execution protection in order to avoid exploitable buffer overruns.
;-). Software and hardware implementations differ in that software is executed sequential, while hardware executes concurrently.
Gosh, every day I learn something new on Slashdot
StefanoB
-- com'along, let's go womanizing (Mr. Burns needs a chick)
I read the .PDF pretty carefully, but I still don't understand how DEP (data execution protection via the NX bit in the page tables) fails to prevent this exploit. The 1016 bytes of memory is on the heap, isn't it? So how is any code you put there going to be executed?
Netcraft confirms it, it's official
All your Sybase are belong to us.
Slightly unrelated: What about NX under Linux on the amd64 architecture. Anyone know if/when it is supported?
Get your own free personal location tracker
> Microsoft and security?
;-)
> Chalk and cheese?
Don't you mean simply "swiss cheese"?
Is that link that says 'here' to microsoft.com correct? It points to something for Windows NT4.0 w/SP4
"Published 28th January 2005."
And
"In October 2004 it was discovered by MaxPatrol team that it is possible to defeat Microsoft® Windows® XP SP2 Heap protection and Data Execution Prevention mechanism."
This is too much time to fix something. I can agree with some delayed disclosure but not anything above a month.
It takes a man to suffer ignorance and smile
Be yourself no matter what they say
Is it just me or is relying on hardware to protect your application heaps seem to be a bad idea. Not just because its non-portable (not that this matters for windows) but it basically offloads the work on HW that may or may not be up to the task.
We know that unix, its variants and progeny, have memory protection. How many of these rely on the hardware to protect them? Certainly 'legacy' *nixes didnt run on HW that had these features.
I guess what im saying is i dont like it as a long term strategy.
T.J. Schmitz - the man, the myth, the legend - o
I've never though of why my Windows with *all* patches and a positive Microsoft Windows Baseline Security Analyzer check doesn't produce those annoying "are you sure" questions. Can't say that I miss them though because I know my system is up to date :)
I'm surprised about the reporting that SP2 has been "foiled". SP2 is supposed to be a step to make xp more secure, not invincible. There's a lot more to SP2 than the heap protection.
I'm shocked! I have been reading all these independent studies, and according to Forrester, Windows users have fewer vulnerabilities. Check it out yourself, if you don't believe!y stem/facts /analyses/default.mspx#EHAA
http://www.microsoft.com/windowsservers
It's a fact. So this vulnerability, and the dozen others I've been patching at the work, are just some kind of imagination. Or maybe Linux / BSD / OS X users have just amazing amounts of vulnerabilities (counted together, OS & apps).
I'm drunk. And it's not a surprise. Every hardcore Linux geek (like myself), who has to maintain Windows networks for living, have more drinking problems than those who are using solely operating systems and software which are free as speech (as opposed to beer).
Responsible for security of Windows network? Next recommendation for security enhancements: different operating systems, no more IE. If there are costs, then they're definitely worth it. Microsoft has proved that they don't care. All they care is money, monopoly and marketing (FUD / brainwashing / propaganda).
I wonder what Nick McGrath's opinion on this is, and who is HE holding accountable?
Perhaps Nick McGrath was misquoted he was actually saying "Windows security is highly exaggerated"
Hey look no pointless curley braces or semicolons... just like Python
When asked about the problem Steve Ballmer said that Linux sucks.
CNET reports that SP2 has been foiled.
Shouldn't that read tin-foiled? C'mon, slashdot, standards?
All the attacker has to do is set the evil bit, and it overrides NX.
www.apple.com/switch :)
...probably Nick McGrath ;o)
...Rob
The American Dream isn't an SUV and a house in the suburbs; it's Don't Tread On Me.
Linux is not invulnerable to this type of problem either. Hell, does Linux even have executable stack protection AT ALL?
I don't know about the others but I'm still choking it like it owes me money. That GPL is so hot!
Yeah. A bit sensationalist, I suppose. And SP2 did live up to the ideal of making Windows more secure, but the typical user mentality operates more in the realm of absolutes. "I want perfect security, and SP2 isn't perfect so therefore it's useless." Good security is a process, a continuing evolution, and that's true no matter what OS you use. Would I plug an XP SP2 box right into my cable modem? Not unless I was setting up a honeypot. But it is an improvement.
The higher the technology, the sharper that two-edged sword.
Don't put down the swiss cheese. Last time I tried to put a Windows CD in a sub it didn't work out so well.
Windows XP Service Pack 2 has only 1 problem (for me) beyond those of regular XP.
My celphone can no longer be used as a cerial divice, aka; Dialup modem.
Yes, The same hardware works on Linux (Dell Inspiron 8200, Sony Erricson T220 on a USB cable) and removing the pack got it working in Windows again.
--= Isn't it surprising how badly I spell ?
When Are they going to blame them?
When will they bother to fix this?Place bets NOW
is itA: Hackers, right away
B: Hackers, from the Open Source community, when they make something better than them (Eg Someone failing asleep on there keyboard)C: Themselves (Odds at 1 to 10^67^687^3945^Pi for this)
"I may be full of crap about this game, and I may be wrong, and that's fine." -Jack Thompson
Just curious exactly where, though Microsoft's guys have said things like this a lot.
That said, I can't wait for NX flags and other hardware measures to go mainstream. Unless you have a hardware firewall (or Linux?) software like Windows can still be teh flimsy, though in SP2 I have seen VERY few 0xC0000005 errors or STOP bluescreens. (But that's just my eXPerience(TM) with XP(TM).)
BTW, if you dont like adware, don't go to just-free-games.com; their "freeware" games use Gator et al. to pay their bills.
You can hold down the "B" button for continuous firing.
Heap protection has been broken virtually everytime it has been implemented. The reason for this is, you still have system libraries from which have execution powers that can still be used for writing shellcode.
You actually trust Microsoft to say that? Windows is one of the worst OSes in the world in terms of security. And everyone else can tell you that, you can trust it
The patch may be quick. It will still take a long time to deploy.
Anyway you have to wonder about this kind of technical oversight. If you are implementing an NX heap, you obviously need to NX the WHOLE heap for it to be useful.
Basically it looks like Microsoft is incapable of secure development at the core OS layer. I find that absolutely mind boggling given their resources.
I don't think Windows users should lose too much sleep over this. How is an exploit supposed to unprotect the heap segment in order to execute the buffer overrun code -- before such code has been executed?
This is probably a good thing, because it proves that even with stackguarding, etc.. Treating your system as if they dont exist is the best thing you can do. Microsoft unfortunately chooses to use stackguarding as a first line of defence to allow them to take their time patching software, which is a terrible idea.
So basically, nothing has changed in the security world in the past year. The only thing is that the attitude of programmers have in some cases, become slacker because of technologies like this, believing they can get away with it now.
If you ask me though personally, I'm betting Microsoft didn't run major tests on the security of DEP anyway, only simpler ones
http://shit.slashdot.org/article.pl?sid=05/01/29/2 038207
I did blog on another way using only a stack overflow on my blog. My way was more "all existing exploits work as-is after just a little extra step" than "exploits still exist that get around DEP" though.
My way was to just slap DEP in the face by using a ret2libc with a constructed stack frame that gave the shellcode a nice, clean, executable area of memory to execute in, then copied the memory there, then returned to it. This is done by 1) Return to VirtualAlloc(), 2) Return to memcpy(), 3) return to shellcode.
They noticed this in October; it took me until January and I'm not a security expert.
Support my political activism on Patreon.
You even mentioned non-portability as an argument. Yours ranks among the stupidest posts I have seen in a long time.
While it's common sense that situations exist where Windows is not the most secure option, baseless and overly broad statements like your's are very unhelpful.
... the juicy bits are here. Scroll down to the bottom for the appendices where there are C code examples on how to bypass these measures.
Beware: In C++, your friends can see your privates!
Since MS claims Linux companies can't be held responsible for Linux security, will MS claim responsibility for this?
I'd rather have someone respond than be modded up.
I don't think that's typical user mentality. That's stupid people mentality.
The code execution protection is one of these protection layers, pretty much the last one when everything else has been breached and a buffer has overflown. It prevents the class of exploits that load code in a data buffer and somehow jump into it. But there is still a way through, using a stack overflow to rewrite a return pointer or a function pointer and direct it to an existing procedure, e.g. one in libc.
Protecting against such exploits is very hard, and the problem is by no means specific to Windows. Don't expect a quick fix.
I'm assuming you've never actually tried real swiss cheese from switzerland. Real Emmental or Gruyere is amazingly good cheese. Nothing like the crap "swiss" cheese they serve at subway or sell in slices at grocery stores.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Naturally, the only real solution is to avoid the overruns by sensible code. But, if one would be ready to believe that this level of checking would be enough to put native compiled code written by idiots on par with Java or .NET code written by idiots in the area of buffer overrun, it would be a cheap choice, performance-wise.
This would be an excellent time for a re-hash of another article posted just today
/ 1511218&tid=109&tid=172&tid=106
http://linux.slashdot.org/article.pl?sid=05/01/29
Tired of bullshit Slashdot comments? Browse at +3!
And no one would ever see your posts.
>> As far as I know, Windows is the only OS that actually makes use of hardware features to protect against buffer overflows.
It's nice that MS is even trying this, but really I think the onus is on the developer. It doesn't matter if were talking microsoft or not.
while((*(szShit++)=*(szHappens++))!='\0');
You can't make assumptions about the data you get passed...
http://request-header.info
Well Laaa-Deee-Daaa, "Netcraft confirms it" you say. Is that one of your Linsux companies? If you didn't hear it from us, then it's not official.
Steve Ballmer
Right, there's also the security center... because clippy alone isn't annoying enough.
how dare you mod parent down as a troll you friggin WinTard...
"I did blog"?
Okay worm, you owe it to us to conjugate blog.
Now!
Err... Anyone else notice something funny here?
During the first execution this program shows the list of applications which already have this flag set.
I have DEP set to protect "essential Windows programs and services only"...
Yet, running this util, the list of programs looks nothing like a list of "essential" Windows programs. In fact, I honestly don't recognize any of the programs listed, and I say that as someone that knows what a normal Windows XP SP2 install "should" have running, even down to the device-driver level.
So what gives? Has Microsoft pulled the DRM-wool over us all in the form of DEP, and it has nothing to do with "security" at all? Okay, call me paranoid, but, something looks not quite right here (and I don't even mean the possibility of an exploit, I mean the uses of DEP itself, working or not).
...doesn't the processor need to support NX for the XP PS2 protection mechanism to work as it was intended? Until that time, this is a feature that can't be fully utilized.
So Windows could be exploited by this but how does Linux not get hit by this. My memory on os design and assembly programming isn't what it use to be, especialy since I do mostly web apps these days and avoid lower level things like the plauge.
What does Linux have in the way of heap protection? The NX bit is on AMD 64 and Itanium chips only (as far as I remember), so what's to stop this from working on any x86 based OS?
On a sidenote, I've always wondered how Linux protects, or doesn't protect, it's exception and interup handlers. After briefly dabbleing in User Mode Linux I've had this sinking feeling that my box never could be secure from this sort of attack.
Linux is really boring from an os standpoint. Now Plan 9......
??? As far as I can read (at 03:00 hours in the morning) I can't find anything about this issue in any GPL... I'm not a f***ing lawyer but I think that someone has misunderstood something...
Linux has used hardware features to protect against buffer overflows since LONG before sp2 came out. Linux also uses software protection to protect against buffer overflows (i.e. Execution-Shield).
I suppose that the real merit is not how to defeat it, but how fix it, maybe the article should have been titled "Fixing the XP SP2 Heap Protection",
The difference is MS software is like a hooker, you have to pay to get jerked! Open sores is what you wind up getting after you realise you have been shafted.
Okay, so in order to disable the heap protection either the user has to execute arbitrary code while running under the context of a user with sufficient permissions, or be enticed to follow a fairly obscure set of instructions to edit the registry.
How the shit is this a vulnerability exactly? The only way to exploit it is to have already 0wned the machine so there would be no need to disable memory protection at any scope.
Also, as mentioned, this doesn't work correctly on hardware that supports NX. There is no pure software method to carry out NX and all existing measures, such as DEP, can be defeated through complex means. Microsoft makes no claims to the methodology being 100% secure, but it will help stop 60% of buffer overrun scenarios which account for the vast majority of said vulnerabilities. But that is the only way to carry it out in code without imposing huge amounts of overhead, which would still be defeatable without hardware support. Developers practically have to go out of their way in order to embed such vulnerabilities. These proofs of concept are irrelevant; they are not representative of the forms of vulnerabilities accidentally introduced into software.
In other words, another non-story from the shit-eaters at Snatchrot.
Let's see:
Thanks, my computer works too.
This might have been an argument against PC's with Windows a few years ago, but not so much now. I won't even mention Linux, of course.
Wou grate!!!11!!!
This one really turns me on too...
Maybe they could stop repeating themselves... BTW, the best programs to produce music and multimedia content exist for PC too, and the quantity of plugins is much greater on the PC.
On this section they say:
Consider this: Can your PC laptop go coast to coast with just one battery? Can you put the system to sleep just by closing the lid? Does it wake up instantly? Can your PC laptop automatically switch between Ethernet, dial-up and wireless connections on the fly? Without a restart? Ours can.
Yep, my PC can do all that too...
Fact is, most of our customers are up-and-surfing within 15 minutes.
I can do that easily too. So maybe this would only be valid for people who know nothing about computers. Even then, I doubt it's much easier to configure an internet connection than in a PC in most cases. Prove me wrong.
OK, so this section tells me that some of the programs I use on the PC are also available for the MAC. This is hardly a reason for me to switch.
See previous answer.
11- Fuck That.
The AACS key is NOT 0xF606EEFD628B1CA427BEA93A9CA9773F
I was refering to the cheese with the holes in it. But the Subway angle also works. Thanks. ;-)
Please do not compare Linux to murder; it only makes conservative organizations buy products from a convicted monopolist. Please do not compare viruses to children if doing so makes you compare Linux to murder.
Off topic? I think the reply is a hoot! Is everyone else humor-impaired, or am I just easily (and cheaply) amused?
Best,
Mal the Elder
Press up, up, down, down, left, right, left, right, B, A, B, A, START in succession to disable the NX protection.
The support the NX bit where it's available. However, many CPUs don't support that. In those cases stackguarding is the only thing that they can do.
There are two different kinds of canaries, stack canaries and heap canaries. The heap canaries are the ones that this PoC claims to attack, which is relevant because heap overruns are much harder to exploit than stack overruns, not to mention less common.
BSD is under the BSD license. You may rewrite it, steal their code, and not give it out.
You can build things with GCC and not GPL them.
You can build things and link to libraries that are GPL and not GPL them.
So, you can develope apps for linux, using only your own code and any code that BSD people threw under the BSD license, and build them against open source libraries to use those, and have an MS style EULA and closed source.
Support my political activism on Patreon.
Using Knoppix to have a go that C:boot is the go - DEP is optional.
/fastdetect /NoExecute=AlwaysOff
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=" Windows XP Unprofessional"
That's okay; we planned to release this version to those owning the pirated version of XP anyway. Next question.
He compared it to the morning after pill. The morning after pill doesn't "abort" anything -- it simply causes the egg to fail to implant itself in the uterus. This is EXACTLY what IUDs and "The Pill" do, and what happens in 90% of all fertilizations anyway. The morning after pill is just interventive birth-control. It has absolutely nothing to do with abortions.
Hmmm, let me check what is says in my copy of the Windows EULA...
How many times are you going to publish this same tripe?
>> Microsoft and security?
>> Chalk and cheese?
> Don't you mean simply "swiss cheese"? ;-)
as a swiss citizen, i must protest this defamation of our fine emmentaler cheese by its being mentioned in the same sentence as microsoft software. please find another way to say "full of holes."
thank you|danke|merci|grazie|grazia.
;-)
if i'm a grammar nazi, you're an illiteracy nazi.
The Intel 386 processor implements protection bits in their segment descriptors. The OS can use this to mark a segment for read, write, execute or any combination, thereof. Windows, like a lot of Unix implementations, does not leverage the benefits of proper segmentation on the i386.
Each process is given 1 segment that is logically segregated into executable space and heap space. Since each process has a different segment, one cannot overwrite another -- voila! better inter-process separation and reliability (first seen in winnt for Windows).
To prevent a buffer overflow that results in the execution of malicious code, we need to separate the data and the executable code within a process. In order to implement this correctly, MS would have had to use more than one NON-overlapping segment. The code segments would have to be marked for execution/read only, while multiple data segments would have to be marked for read/write only. If this were done, the processor would raise an exception when a non-executable segment descriptor was loaded into the CS (code segment register). If the application/malign software tried to read/write to a code segment, which was did not have the read/write bits set, the processor would raise an exception. If the code and data segments pointed to non-overlapping regions in memory, code segments could be setup to prevent write access. The use of properly marked segments gives you tremendous power over what can be executed and what can be changed.
Windows uses virtual pages extensively and has separate pages for code and data. I bet that the NX bit that is mentioned in previous comments is a modifier for the page register. The i386 does not support execution protection at the page level. The i386 expects the OS to use segments properly to partition the logical address space (4GB most of which does not map to physical hardware), and page registers to implement virtual memory in limited physical memory.
Windows does not wield the power of segmentation correctly. We should not blame intel for it.
(Note: I am not in any way affiliated with Intel, though I did look for a job there when I got out of college.)
The method of attack for most stack buffer-overflows is to write enough data into a stack-allocated object to clobber the return pointer, which is allocated above it.
So why not make the stack grow upwards instead of downwards?
I hereby place the above post in the public domain.
Mac OS X uses GCC for its compiler, and last I checked, a lot of Mac OS X programs are closed source. Mac OS X itself is compiled with GCC and there are huge chunks of closed source there.
How can a software (SP2) implement something in hardware? Does it activate hardware-implemented (but unused prior SP2) protection? Or does someone not know the difference between hard/soft-ware, but keeps posting anyway?
Please stop producing horrible versions of windows. Please stop continually patching the code. It is just a pile of band-aids now. Trash and renew, THEN you will have a good product.
Until then, penguins will haunt your dreams.
Warning, knife is sharp. Please keep out of children.
hmm... Al Bundy's underwear?
Whenever Mrs. Fitch breaks wind, we beat the dog.
...use to be... used to be
...especialy... especially
...plauge... plague
...it's exception... its (it's = 'it is')
...interup handlers... interrupt
...dabbleing... dabbling
You can build things and link to libraries that are GPL and not GPL them.
Whoopsie daysie, that's not true. From gnu.org:
If a library is released under the GPL (not the LGPL), does that mean that any program which uses it has to be under the GPL?
Yes, because the program as it is actually run includes the library.
You can link non-GPL programs only with LGPL libraries.
Life is Reality
Microsoft and the hackers are just playing CoreWars, for real, on our systems. Isn't that great?
In fact, Windows XP's heap boundary checking sounds like little more than the old RADAR-X REDCODE program...
$#!^ happens, but why does it always have to happen to me???
Unfortunately, I don't see how this is a security risk.
All my users run under "limited" accounts, not administrator accounts, in other words...
Have no access to write such things in that part of the registry.
Much like linux's magical root, which can override all.
Change is certain; progress is not obligatory.
They could patch the security holes themselves rather than relying on stack protection to make them not exploitable. There are many unpatched security holes in Windows because MS is relying on SP2's stack protection rather than patching the buggy code itself.
No, I don't think I will.
The whole idea of spelling is a somewhat new development. Why should I be forced to conform to a completely imaginary set of rules that do nothing but to stop us from worrying about the content of our writing and instead worry about if the style conforms to the somewhat arbitrary standards set by bitter old english teachers? You may wish to be bound by such things but I do not.
Linux is really boring from an os standpoint. Now Plan 9......
Protecting against such exploits is easy, all Microsoft has to do is fix buffer overrun holes instead of relying on SP2's stack protection to make them not exploitable. How many times have you seen an unpatched hole mentioned and people have said "but it is patched, SP2 is immune". This proves SP2 is not immune, you just need to use different shellcode. See David Litchfield's paper on defeating Windows Server 2003's protection for more information.
A better way to defeat this class of attack is to move the metadata (in this case the link table) elsewhere to another, noncontiguous page. You could still induce a buffer overflow, but such an overflow would not corrupt the whole allocation mechanism.
For extra security you could put it in kernel space and give the library a new system call to do memory allocation, but that would increase memory allocation overhead, likely unacceptably.
Analysis and solution depend heavily on what attack you wish to defend against.
I would like to tell people who comment without having knowledge of the topic that, there is no software which can be declared "Hack Proof". And buffer overflows are bound to happen in most of the software. You cannot have code to prevent buffer overflows in all the step of the procedure the simple reason is because the software will start to crawl. If you want to get more info on how buffer overflows happen exactly, you can search in alstalavista.com for 'buffer overflow video'. You will get man video download links. Download a 7 min avi video and you will get very clearly how this happens (to learn this you dont have to be albert einsteins, its a very simple video)
...making it a footrace between crackers and the kernel team at MS, but only one of those parties entered the race with their shoes tied together and you don't need three guesses to figure out which.