Dave Aitel: "ASLR + DEP = no problem"

Tombkeeper

From: dave <dave () immunityinc com>
Date: Wed, 03 Feb 2010 11:52:34-0500

----- Begin pgp signed message -----
Hash: SHA1

Not so long ago, ASLR and DEP were gaining wide acceptance. Execshield was on almost all Linux systems, and the "golden age" of buffer overflow exploitation looked like it was coming to a close.

It is true that the code is getting better, and the mitigating protective mechanisms in Windows and Linux are getting better. but like in a ceramic, the physical properties of a system are defined by the interfaces between components, not the crystals themselves.

Today, Immunity released a working version of the Aurora exploit for Windows 7 and IE8 today to CANVAS Early Updates. it does this by playing some very odd tricks with Flashs JIT compiler. this technique is extendible to almost all similar vulnerabilities. in other words, ASLR and DEP are not longer the shield they once were.

I believe Dionysus Blazakis is going to release some details on a similar technique at BlackHat DC today. If you miss the rest of the talks, Id recommend popping into that one.:>

Thanks,
Dave Aitel
Immunity, Inc.


----- Begin pgp signature -----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora-http://enigmail.mozdev.org

Bytes
AL0AnjmW40zWTjtwitHJO3Fcv1z9F9QI
= L0KE
----- End pgp signature -----

Yesterday, I am still talking to Sowhat. You will be able to see that someone will release the ASLR + DEP technology within this year. I didn't expect it to be fulfilled today.

Dave Aitel mentioned that with the help of Flashs JIT compiler, I guess it should be like this:

Any JIT technology, in the process of instruction translation, always generates machine code; these machine codes always exist in a piece of memory; this memory must be executable.

Using this, we can construct a Flash that will generate a large amount of code data for JIT translation. In fact, it is similar to Heap Spray, but the memory generated now has executable attributes.

"Iron is still there", and the red flag is still floating.