Slashdot Mirror
ALSR in Vista Gets OEM Push
gr00ve writes "Eweek is reporting that all the major OEMs will enable DEP/NX in their BIOSes by default to allow Address Space Layout Randomization (ASLR), a new security feature in Windows Vista, to work as advertised. ASLR, which is used to randomly arrange the positions of key data areas to block hackers from predicting target addresses, is meant to make Windows Vista more resilient to virus and worm attacks." From the article: "Because most CPUs that ship today support DEP/NX, Howard explained that Vista users on older hardware can use the control panel to manually verify that PCs have DEP enabled. With full support from OEMs, Microsoft is effectively using ASLR to create software diversity within a single operating system, a move that is widely seen as Redmond's attempt to address the monoculture risk. The memory-space randomization technique will block the majority of buffer overflow tricks used in about two-thirds of all worm and virus attacks."
ALSR?
34/en/m/c
-Dave
This is a legitimate technique already used by some other high-security OSes (e.g. Open BSD). So it's a legitimately good security measure.
That said, I don't doubt that wanting to better secure their DRM is high on their list of reasons to improve security. That is, they probably want more to secure the machine *from* you than *for* you... While I've certainly had users that the system needed protection from, I still don't like what they're doing with DRM.
Soon, at this rate, you'll either have an unencumbered OS, or what you have won't be fit to call a computer. It'll probably look something more like a high definition TV with popup ads.
Now if only Microsoft could develop a system for delivering electric shocks to users who run untrusted executables they receive in email, that would be something.
That's "Mr. Soulless Automaton" to you, Bub.
The technique is simply a scrambling of address of DLLs and eventually of procedures of those DLLs. The symbols will be remapped accordingly and you should be able to use your debugger as always. It just makes more difficult to make "jump to libc" attacks which defy DEP [mastropaolo.com] entirely.
Isn't this the same as Linux virtual address randomization that works without BIOS?
Yes, but the NX bit enforcement is part of a larger security push. It just happens that most articles confuse ASLR with NX (or are fuzzy on the details of each) when talking about them both. Part of the confusion is the fact in order for ASLR to be effective, then the NX bit should be enforced. AFAICT, ASLR doesn't actually require NX at all and it's a mistake these "technical journalists" are making.
Basically, Vista adds a bunch of walls to increase security. the NX bit and ASLR are just two separate instances of those walls.
The big news is that even though some OEMs have previously disabled the NX bit in the BIOS (due to software compatibility issues), they've said they'll enable it by default in the future.
It's PaX actually, but yes. You can randomise the kernel stack base, the user stack base and the mmap() base.
Security Options->PaX->Address Space Layout Randomisation in your kernel config, assuming you have the appropriate patches installed.
Cheers,
Roger
Do you have any better hostages?
I have noticed if DEP is turned on in XP when I look at the folder with all my porn and thumbnails are turned on it causes Explorer to crash. I hope they fix this.
In what way does this prevent FairUse4WM?
f _Buffer_Overflow_Attacks.html
This is a good thing to prevent viruses, without affecting anything else. Buffer overflow attacks need to rely on a known location in memory to jump to, typically kernel32!LoadLibrary/GetProcAddress, which will allow them to dynamically access the rest of the functions they need. Read more here: http://www.windowsecurity.com/articles/Analysis_o
This is 100% completely unrelated to DRM bypass programs, which can actually link to the correct functions. Anyone who mods the parent up has no idea about how windows security or programming works.
It sounds like the parent might (just trying to be generous here) be confusing FairUse4WM with the Apple Fairplay hack tool, which does rely on known offsets within the fairplay module's memory layout. However, even that wouldn't be affacted by this, since an actual properly linked program can still determine the base address it needs.
Well sure it is! But MS doesn't control all the source code of the software the OS runs (but they're working on that ;)). Even if the OS is free of buffer overruns (which is should be after 5+ years of development), if a poorly implemented yet popular program (such as an IM client) still has buffer overruns, there is only so much that the OS can do/not do.
Space for rent, inquire within
This probably isn't such a big deal for open source.
With Windows, whole swaths of the user community are running nearly identical binaries so malware authors have a large attractive market for their worms.
With Linux, you have virtually thousands of possible binary configurations due to the high prevalence of custom compiled from source and the sheer number of competing distributions with frequent releases. Reduces the attraction.
DISCLAIMER: Yes, I know, there are players who target niches, this rationale isn't bullet proof.
DISCLAIMER2: Yes, address space virtualization can't stop all buffer overflow exploits either.
Duel boot?
Linux: On-guard! This MBR is MINE!
Windows: *parry* *thrust* Never! The first 512B are the domain of NTLDR! Mu-ha-ha!
Linux: Touche! Looks like the boot CD will be needed to get GRUB back on here. *removes mask*
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.