Slashdot Mirror
Researchers Bypass ASLR Protection On Intel Haswell CPUs (softpedia.com)
An anonymous reader writes: "A team of scientists from two U.S. universities has devised a method of bypassing ASLR (Address Space Layout Randomization) protection by taking advantage of the BTB (Branch Target Buffer), a component included in many modern CPU architectures, including Intel Haswell CPUs, the processor they used for tests in their research," reports Softpedia. The researchers discovered that by blasting the BTB with random data, they could run a successful collision attack that reveals the memory locations where apps execute code in the computer's memory -- the very thing that ASLR protection was meant to hide. While during their tests they used a Linux PC with a Intel Haswell CPU, researchers said the attack can be ported to other CPU architectures and operating systems where ASLR is deployed, such as Android, iOS, macOS, and Windows. From start to finish, the collision attack only takes 60 milliseconds, meaning it can be embedded with malware or any other digital forensics tool and run without needing hours of intense CPU processing. You can read the research paper, titled "Jump Over ASLR: Attacking Branch Predictors to Bypass ASLR," here.
define malware.
this would be useful for killing some of the more nasty forms of drm, for instance. a runtime patcher could learn exactly where to patch, and booya.
the more idiots trying to count chickens before they hatch thart get their eggs smashed, the happier i am. maybe they will one day learn that they cant have *all* of the pie, no matter how much they want it.
I've been a true blue IT pro foss loonix guy for most of the last 16 years. And every year. Nay. Every 6-10 months some hardware designed to "thwart" crackers, and other crypto attackers goes the way of the dodo.
I think the industry looks at security the wrong way and the lulzsec guys weren't wrong in that ideological rant they made. You can't predict the unpredictable. Firewalls aren't a wall in any meaningful sense. "Software defined" networks are just a catchphrase for networking complex things in a dynamic manner. Intrusion Prevention Systems do not prevent. Hell, if you let your cisco guy deploy it, it wont even log a thing and when it dies you will have no idea why.
Bollocks, Shenanigans and costly Stupidity (don't get me started on "hardware routers" or "storage networks"). This is what I have found in my years in the battlefields, young grasshoppers. And a deeply felt wish that I had chosen archeology instead.
NO SIG
removing the BTB entirely. I've seen libraries rip out faster routines or add some nondeterminism to the latency just so that it could mask such a "hot cache" vulnerability. It seems a bit backward to rip out a performance enhancing capability in the architecture just because of ASLR bypass.
Wrong. Plenty of code correctness has been deployed in service of this goal.
Unfortunately, there are endemic economic and political reasons why we constantly choose the protocols and implementations that are bigger, hairier, and less continent.
All you need is a culture of kicking non-conforming implementations to the curb, and then the rigorous implementations have a chance to emerge from the weeds. Do we have such a culture? No—most of the time—no, we do not. Such a culture would cramp Megacorp style, and interfere with timeless value-adds, such as embrace and extend, closed ecosystem, DRM jungle, NIST-sanctioned algorithmic weevils, definition by implementation, documentation by implementation, etc. etc.
Far, far away in dull and dusty places like the Erlang OTP or Bernstein's qmail or Knuth's TeX—or perhaps even the Google protocol buffers for at least one lucky and unusually blessed language binding from the somewhat recent past—you just might find a rigorously coded parser or two.
For the most part, however, I agree. We'll probably never have rigorous parsers in a dominant culture of "screw everyone else", Wild West dysenteroperability.
Wouldn't a HOSTS file protect against this exploit?