Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

3/31/2011
12:29 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Most Windows Applications Use Microsoft's DEP

SDL Progress Report from Microsoft shows one-third of popular consumer apps using ASLR

Most popular consumer applications today use Microsoft's Data Execution Prevention (DEP) attack mitigation feature in Windows, while about one-third use its Address Space Layout Randomization (ASLR) security function.

The data was released today as part of Microsoft's progress report on its Security Development Lifecycle (SDL). The software giant surveyed the DEP and ASLR settings in 41 popular third-party applications to measure the adoption of these attack mitigation technologies. ASLR was not deployed in 70 percent of browser plug-ins: That means even if a browser were running ASLR, if a plug-in does not, then ASLR isn't fully functional.

Microsoft's SDL, a process of building security and privacy into its software, has been mandatory in-house at the software giant since 2004. Microsoft in 2007 began publicly releasing SDL tools and documentation in order to promote secure coding. DEP and ASLR are two of the higher profile security functions Microsoft has added to Windows.

Jeff Jones, director of Trustworthy Computing at Microsoft, says the disparity between DEP and ASLR adoption among apps likely has to do with DEP being available longer (since XP Service Pack 2) as well as being "simpler to understand." DEP prevents an exploit from directly injecting and executing code from sections of memory used for data.

"It has been around longer, and it's pretty simple to enable," Jones says. ASLR didn't come on the scene until Windows Vista, where it first rolled out. ASLR is basically a security feature in Vista and Windows 7 that protects the system from an exploit attempting to call a system function. It places code in random areas of memory that makes it more difficult for an attacker to run malware on a machine.

While ASLR is fully enabled in 34 percent of these apps, it's partially enabled in 46 percent of the commercial apps. Some 20 percent don't use ASLR at all.

Microsoft's Jones says that's a respectable percentage of adoption. "I was pleasantly surprised. Eighty percent has either fully or partially [deployed] it -- that's a good number," he says.

Gary McGraw, CTO at Cigital, also considers the new Microsoft data on DEP and ASLR deployment good news. "That rate of adoption is pretty darn good ... because [the technology] is relatively new," says Gary McGraw, CTO at Cigital.

But deploying ASLR and DEP alone doesn't make for a secure app, he says. "If you just count on only these two security functions, you won't get a secure app. You have to do everything else, too, [including] static analysis, pen testing, and the rest of the [steps] in the SDL."

When apps only partially enable ASLR, that means not all libraries are compiled with ASLR, which could allow an attacker to bypass DEP, notes Thomas Kristensen, CTO at Secunia.

And apps that only support either DEP or ASLR, or just partially support one, don't reap the same security benefits, security experts say.

"DEP alone is less effective than ASLR as there are much easier ways to defeat DEP than ASLR. Combining DEP and ASLR results in the most effective exploit mitigation," says Chaouki Bekrar, CEO and head of research at VUPEN.

Some app developers avoid DEP because it can crash buggy apps, notes Secunia's Kristensen. "That obviously doesn't look good, and then it is natural to choose less security and more 'stability,'" he says.

Even so, DEP and ASLR aren't impenetrable. Security researchers have found and demonstrated ways to bypass DEP. "There are ways to bypass each individually, but combining the two makes the protection more efficient and significantly harder to exploit," Kristensen says.

The Microsoft SDL Progress Report can be downloaded here.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-32693
PUBLISHED: 2021-06-17
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in Symfony starting with version 5.3.0 and prior to 5.3.2. When an application defines multiple firewalls, the token authenticated by one of the fir...
CVE-2021-32424
PUBLISHED: 2021-06-17
In TrendNet TW100-S4W1CA 2.3.32, due to a lack of proper session controls, a threat actor could make unauthorized changes to an affected router via a specially crafted web page. If an authenticated user were to interact with a malicious web page it could allow for a complete takeover of the router.
CVE-2021-32426
PUBLISHED: 2021-06-17
In TrendNet TW100-S4W1CA 2.3.32, it is possible to inject arbitrary JavaScript into the router's web interface via the "echo" command.
CVE-2021-32694
PUBLISHED: 2021-06-17
Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.15.1, a malicious application on the same device is possible to crash the Nextcloud Android Client due to an uncaught exception. The vulnerability is patched in version 3.15.1.
CVE-2021-32695
PUBLISHED: 2021-06-17
Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.16.1, a malicious app on the same device could have gotten access to the shared preferences of the Nextcloud Android application. This required user-interaction as a victim had to initiate the sharing flow and choose t...