ASLR not the panacea it seems

[unixronin]

Microsoft has added a feature called Address Space Layout Randomization, or ASLR, to Windows Vista beta 2.  They tout this as an important security feature.

Certain attacks attempt to call Windows system functions, such as the "socket()" function in "wsock32.dll," to open a network socket.  The new security feature moves these system files around so they're in unpredictable locations.  In Windows Vista Beta 2, a DLL or EXE file could be loaded into any of 256 locations, [Michael Howard, a senior security program manager at Microsoft] wrote.

"An attacker has a 1/256 chance of getting the address right," Howard wrote.

The article also mentions,

ASLR is not a Microsoft invention.  Several open-source security systems use it already, including OpenBSD, and the PaX and Exec Shield patches for Linux.

Now, maybe I'm missing something here, but ....... OK, so you randomize where things are loaded in your address space.  But, your code and applications still have to be able to make library calls to a lot of that code.  So what do you do?  Does the OS handle "de-virtualizing" the calls automatically?  Do you have a public table where programs can look up the location of whatever they need to call?

The precise mechanism doesn't really matter.  The point is this:  If there is a mechanism to allow authorized code to still be able to call code in your load-address-randomized libraries, what's to stop malicious code from utilizing that exact mechanism?

Somebody using the alias "c0ntex" wrote in a reply to [David Litchfield, a researcher at Next Generation Security Software] that ASLR has been "trivially circumvented in Linux for years now."

Unless there's more to this than meets the eye, I don't see what's to stop it from being trivially circumvented on any OS.  ASLR seems to be to be something akin to trying to stop telemarketers from calling my phone by moving the phone somewhere else in the house and not telling them where I moved it.  Doing so may comfort me, but it doesn't matter to the telemarketers -- if they dial my number, my phone still rings.

Comments

[ilcylic.livejournal.com]

Unless there's more to this than meets the eye, I don't see what's to stop it from being trivially circumvented on any OS. ASLR seems to be to be something akin to trying to stop telemarketers from calling my phone by moving the phone somewhere else in the house and not telling them where I moved it. Doing so may comfort me, but it doesn't matter to the telemarketers -- if they dial my number, my phone still rings.

Heh. Damn straight.

-Ogre

[dafydd.livejournal.com]

"This is not the panacea you're looking for..."

[johnkzin.livejournal.com]

I don't think it's there to keep telemarketers (ie. outside attacks coming in). I think it's there to stop burglars from knowing which phone to add a bug to (ie. keeping a virus that is already inside from knowing where to drop its payload).

Though, again, trivial to get around. Oooh! I have to search 256 rooms of your house to find which one has the phone ... on a 2 GHz machine.... yeah, that 256 item search is going to take SO long. And, if I find a copy in all 256 locations, I just don't know which one is real, then, hey, how long would it take for me to infect all 256 copies?

[unixronin.livejournal.com]

Actually, the way it looks to me is this: It won't stop malware from calling any code it wants to. It won't stop malware from executing buffer overflow attacks. What it CAN do is prevent malware from knowing the address of shellcode it just wrote using a buffer overflow, which should prevent the malware from executing a direct jump to that shellcode, and may make it harder to write the shellcode.

actually, it's not a bad idea...

[echristo.livejournal.com]

Here's a comment from the guy at MS about it:

http://blogs.msdn.com/michael_howard/archive/2006/05/26/608315.aspx

Then again, linux has had it for some time. Here's an interesting set of commentary on it:

http://www.stanford.edu/~blp/papers/asrandom.pdf

It ends up being another method to help fortify a system against certain classes of security attacks with a very small penalty imposed at runtime.

Re: actually, it's not a bad idea...

[unixronin.livejournal.com]

Oh, so the point is not to relocate libraries containing publicly accessible functions (though it accomplsihes its goal by doing that), it's to relocate the entry points of functions that malicious code may be attempting to call directly without going through the public interface (or even attempting to jump into a calculated location in the middle of)? That makes quite a bit more sense.

Re: actually, it's not a bad idea...

[echristo.livejournal.com]

a good summary is what you responded to john with above. basically if you don't know at what address your code is going to be loaded at it makes it much more difficult to overwrite the data of something else in memory.