Vulnerabilities / Threats

11/20/2017
04:55 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Researcher Finds Hole in Windows ASLR Security Defense

A security expert found a way to work around Microsoft's Address Space Randomization Layer, which protects the OS from memory-based attacks.

The latest versions of Microsoft Windows are vulnerable to attacks due to a newly discovered vulnerability in Address Space Layout Randomization (ASLR).

The vulnerability affects Windows 8, Windows 8.1, and Windows 10 systems with system-wide ASLR enabled via Microsoft's Enhanced Mitigation Experience Toolkit (EMET) or Windows Defender Exploit Guard.

Will Dormann, a senior vulnerability analyst at Carnegie Mellon's CERT-CC discovered and reported the vulnerability. System-wide mandatory ASLR on all affected systems, enabled via EMET, has zero entropy, "essentially making it worthless," he explained on Twitter.

Dormann was investigating Microsoft Office vulnerability CVE-2017-11882 when he found the issue. He wanted to see which exploit mitigations potentially already in place could have prevented exploitation of CVE-2017-11882. Dormann noticed even if mandatory ASLR was enabled on his machine, the code loaded at the same location every time. The load address was not actually being randomized.

His discovery means an attacker can more easily exploit memory corruption vulnerabilities in Windows 8 and newer systems, which ASLR would normally protect. The advantage of ASLR is it makes exploiting memory corruption bugs more difficult; however, it isn't working as intended.

ASLR arrived in Windows Vista to prevent code-reuse attacks, which rely on code executing at predictable memory locations, by loading executable modules at random addresses. Starting in Windows 8, Microsoft began to offer system-wide mandatory ASLR. Admins could enable programs to randomize locations even for applications without ASLR support.

EMET is a free tool Microsoft previously released to protect applications not opted into ASLR and other exploit mitigation tools. Admins could enable them through the EMET interface. When Microsoft launched the Windows 10 Fall Creators Update, it integrated EMET's key capabilities into the Windows Defender Exploit Guard.

Exploit Guard has an option to enable system-wide bottom-up ASLR. However, as Dormann discovered, setting system-wide ASLR in Windows, Windows 8.1, and Windows 10 does not actually randomize memory locations. If the default GUI in Exploit Guard says "On by default," programs will still be relocated, but to the same address across different reboots and systems.

Dormann likens the issue to buying a high-security deadbolt to add to an existing lock on your front door, only to dealize the deadbolt lock doesn't actually activate when turned. The result: you don't have as much protection as you think you do.

This could lead to a "wide variety" of common types of attacks, explains a DHS spokesman.

People who believe they are protected by ASLR may take risks they wouldn't normally take; for example, opening an attachment in an unsolicited message. If the message is a spearphish and ASLR is working properly, the exploit would fail. However, without ASLR, the attacker could gain complete control of the victim's system and view their access to other systems.

Microsoft says the problem is not a flaw. It says the issue, discovered by CMU's CERT/CC and reported by US-CERT, is with configuring non-default settings for ASLR using Exploit Guard and EMET, and providing workarounds. The company is investigating and will address the configuration issue.

"The issue described by the US CERT is not a vulnerability," a Microsoft spokesperson says. "ASLR is functioning as designed and customers running default configurations of Windows are not at increased risk."

However, Dormann says when it comes to deciding whether this is a vulnerability or not, this problem is "a little bit tricky." It's not a vulnerability that an attacker can directly exploit; however, it is an issue where users' expectations of protection are not met.

"If a user enables system-wide mandatory ASLR, the user should rightfully expect that code is forced to be randomized on a system-wide basis," he explains. "But this is not the case with Windows 8 or later systems, due to a change in how mandatory ASLR is implemented in Windows."

CERT/CC is currently unaware of a practical solution to the problem, Dormann says, adding a workaround for administrators in his blog post on the discovery. He advises enabling both bottom-up and mandatory ASLR system-wide for all systems running Windows 8 or later, using a certain registry value. Businesses should also use defense-in-depth strategies to protect networks, users, and data from unauthorized access, he adds.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Intellijoule
50%
50%
Intellijoule,
User Rank: Apprentice
11/21/2017 | 10:24:48 AM
A new operating system based on NSA Class A1 of the TCSEC is a must. NSA and the industry should return to Class A1
NSA, under Dr.Roger R.Schell, Deputy Director, developed the only secure operating system and secure kernel with secure TPM that has never been breached, not once even up to today.  The only remaining source for the verified code is Aesec.com in California.  We are attempting to have Senator Daines require Government and Industry to apply Class A1 as a rider on his cybersecurity bill now in Congress. Dr. Schell recently taught NSA Class A1 and general cybersecurity at the University of California. Class A1 is under examination again at the University of Minnesota, just launching. Not even Blackhat could crack the code after many years. 

Stay tuned to Dr. Schell's site at www.aesec.com  NSA Class A1. I captured a motivation for NSA Class A1 on our company website.  You can find it right under "Our Caltech and JPL Experience" in the News listings. 

Charles G. Nutter, CEO, Intellijoule, Inc. 
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15583
PUBLISHED: 2019-03-25
Cross-Site Scripting (XSS) vulnerability in point_list.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter.
CVE-2017-7340
PUBLISHED: 2019-03-25
A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via the applicationSearch parameter in the FortiView functionality.
CVE-2014-9187
PUBLISHED: 2019-03-25
Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules, which could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recomme...
CVE-2014-9189
PUBLISHED: 2019-03-25
Multiple stack-based buffer overflow vulnerabilities were found in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules that could lead to possible remote code execution, dynamic memory corruption, or denial of service. Honeywell...
CVE-2019-10044
PUBLISHED: 2019-03-25
Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters e...