Popular Windows Apps Reject Microsoft Security Features
Some third-party applications aren't using Microsoft's Windows DEP, ASLR security
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Turns out Microsoft's much-lauded Data Execution Protection (DEP) and Address Space Layout Randomization (ASLR) security features for Windows aren't necessarily being deployed in widespread third-party Windows applications.
Secunia sampled 16 of the most popular third-party Windows apps to study how or if they supported Microsoft's and ASLR, and found that half of these apps don't use them at all.
The apps analyzed were Adobe Flash Player, Sun Java JRE, Adobe Reader, Mozilla Firefox, Apple QuickTime Player, VLC Media Player, Apple iTunes, Google Chrome, Adobe Shockwave Player, OpenOffice.org, Google Picasa, Foxit Reader, Opera, Winamp, RealPlayer, and Apple Safari. Among those, QuickTime, Foxit Reader, Picasa, Java, OpenOffice.org, RealPlayer, VideoLAN VLC Player, and Winamp do not use Microsoft's DEP and ASLR.
DEP helps quell code execution in nonexecutable memory and was one of the key defenses against the original Operation Aurora exploit code. ASLR basically protects the system from an exploit attempting to call a system function by placing code in random areas of memory and making it more difficult for an attacker to run malware on a machine.
Thomas Kristensen, CSO at Secunia, says he was surprised that these key Windows apps weren't taking advantage of the Microsoft security features. "That such popular, high-profile products -- some of which has been active exploited recently -- aren't doing more to secure their users" was surprising, he says. "Using DEP/ASLR is a cheap and easy way to make exploitation significantly more difficult."
And all of these apps also have recently discovered memory-corruption vulnerabilities that allow for code execution, he says.
Meanwhile, several of these vendors plan to implement DEP and ASLR, but in the interim their apps remain more exposed. "It is much easier to exploit vulnerabilities in a reliable and consistent manner" without DEP and ASLR, Kristensen says.
A copy of Secunia's full report can be downloaded here (PDF). Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024