Researcher Finds Hole in Windows ASLR Security Defense

A security expert found a way to work around Microsofts Address Space Randomization Layer, which protects the OS from memory-based attacks.

The latest versions of Microsoft Windows are vulnerable to attacks due to a newly discovered vulnerability in Address Space Layout Randomization (ASLR).
The vulnerability affects Windows 8, Windows 8.1, and Windows 10 systems with system-wide ASLR enabled via Microsofts Enhanced Mitigation Experience Toolkit (EMET) or Windows Defender Exploit Guard.
Will Dormann, a senior vulnerability analyst at Carnegie Mellons CERT-CC
discovered
and reported the vulnerability. System-wide mandatory ASLR on all affected systems, enabled via EMET, has zero entropy, essentially making it worthless, he
explained
on Twitter.
Dormann was investigating Microsoft Office vulnerability CVE-2017-11882 when he found the issue. He wanted to see which exploit mitigations potentially already in place could have prevented exploitation of CVE-2017-11882. Dormann noticed even if mandatory ASLR was enabled on his machine, the code loaded at the same location every time. The load address was not actually being randomized.
His discovery means an attacker can more easily exploit memory corruption vulnerabilities in Windows 8 and newer systems, which ASLR would normally protect. The advantage of ASLR is it makes exploiting memory corruption bugs more difficult; however, it isnt working as intended.
ASLR arrived in Windows Vista to prevent code-reuse attacks, which rely on code executing at predictable memory locations, by loading executable modules at random addresses. Starting in Windows 8, Microsoft began to offer system-wide mandatory ASLR. Admins could enable programs to randomize locations even for applications without ASLR support.
EMET is a free tool Microsoft previously released to protect applications not opted into ASLR and other exploit mitigation tools. Admins could enable them through the EMET interface. When Microsoft launched the Windows 10 Fall Creators Update, it integrated EMETs key capabilities into the
Windows Defender Exploit Guard
.
Exploit Guard has an option to enable system-wide bottom-up ASLR. However, as Dormann discovered, setting system-wide ASLR in Windows, Windows 8.1, and Windows 10 does not actually randomize memory locations. If the default GUI in Exploit Guard says On by default, programs will still be relocated, but to the same address across different reboots and systems.
Dormann likens the issue to buying a high-security deadbolt to add to an existing lock on your front door, only to dealize the deadbolt lock doesnt actually activate when turned. The result: you dont have as much protection as you think you do.
This could lead to a wide variety of common types of attacks, explains a DHS spokesman.
People who believe they are protected by ASLR may take risks they wouldnt normally take; for example, opening an attachment in an unsolicited message. If the message is a spearphish and ASLR is working properly, the exploit would fail. However, without ASLR, the attacker could gain complete control of the victims system and view their access to other systems.
Microsoft says the problem is not a flaw. It says the issue, discovered by CMUs CERT/CC and reported by US-CERT, is with configuring non-default settings for ASLR using Exploit Guard and EMET, and providing workarounds. The company is investigating and will address the configuration issue.
The issue described by the US CERT is not a vulnerability, a Microsoft spokesperson says. ASLR is functioning as designed and customers running default configurations of Windows are not at increased risk.
However, Dormann says when it comes to deciding whether this is a vulnerability or not, this problem is a little bit tricky. Its not a vulnerability that an attacker can directly exploit; however, it is an issue where users expectations of protection are not met.
If a user enables system-wide mandatory ASLR, the user should rightfully expect that code is forced to be randomized on a system-wide basis, he explains. But this is not the case with Windows 8 or later systems, due to a change in how mandatory ASLR is implemented in Windows.
CERT/CC is currently unaware of a practical solution to the problem, Dormann says, adding a workaround for administrators in his blog post on the discovery. He advises enabling both bottom-up and mandatory ASLR system-wide for all systems running Windows 8 or later, using a certain registry value. Businesses should also use defense-in-depth strategies to protect networks, users, and data from unauthorized access, he adds.
Related Content:
North Koreas Lazarus Group Evolves Tactics, Goes Mobile
Terdot Banking Trojan Spies on Email, Social Media
Forget APTs: Lets Talk about Advanced Persistent Infrastructure
White House Releases New Charter for Using, Disclosing Security Vulnerabilities
Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity
agenda here
.

Last News
▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security	▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Researcher Finds Hole in Windows ASLR Security Defense