|
The non-clickbait title should read, "But you almost certainly don't need to, and are equally unlikely to be able to do so if you do need to".
ASLR is only bugged in EMET mode; a cluster ![Elephant | [mastadon]](https://www.codeproject.com/script/Forums/Images/elephant.gif) of system lock downs that make guns firing bullets in 2 directions at once seem like extra safe nursery toys. Unless you're the sysadmin whose full time job is dealing with all the ways it blows up in your users faces you're not going to be able to touch any of the settings required because you've been locked out for your own good. (Or someone's paranoid power trip anyway.)
Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason?
Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful?
--Zachris Topelius
Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies.
-- Sarah Hoyt
|
|
|
|
|
Hi,
Dan Neely wrote: ASLR is only bugged in EMET mode;
That's completely false.
Also, there is no such thing as 'EMET Mode' as the 'Mandatory ASLR' implementation resides in the windows kernel since Windows 8. The entropy is disabled even if you use the Windows 10 'Windows Defender Security Center' UI to change the setting to 'Use Default (On)'
I believe you are referring to the legacy behavior of EMET on XP/Win7 where EMET scans all executable DLL imports (excluding kernel32 and user32) and preallocates a page identical to the base address of each DLL dependency thereby forcing a conflict... which causes the NT loader to move the DLL base address. (Forced ASLR via address conflict)
Interesting enough... I've known about this entropy issue since ~2012 but I always assumed that the obfuscation was intentional.
P.S.
I highly recommend that you enable this setting on corporate/critical infrastructure. Not sure why you want to tell everyone they do not need this setting... even all current Unix/Linux distributions have an ASLR implementation[^].
|
|
|
|
|
Randor wrote: Dan Neely wrote: ASLR is only bugged in EMET mode;
That's completely false.
The CERT warning itself says otherwise.
The Problem
Both EMET and Windows Defender Exploit Guard enable system-wide ASLR without also enabling system-wide bottom-up ASLR. Although Windows Defender Exploit guard does have a system-wide option for system-wide bottom-up-ASLR, the default GUI value of "On by default" does not reflect the underlying registry value (unset). This causes programs without /DYNAMICBASE to get relocated, but without any entropy. The result of this is that such programs will be relocated, but to the same address every time across reboots and even across different systems.
Impact
Windows 8 and newer systems that have system-wide ASLR enabled via EMET or Windows Defender Exploit Guard will have non-DYNAMICBASE applications relocated to a predictable location, thus voiding any benefit of mandatory ASLR. This can make exploitation of some classes of vulnerabilities easier.
It repeatedly says the problem is only with EMET not fulling enabling ASLR.
Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason?
Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful?
--Zachris Topelius
Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies.
-- Sarah Hoyt
|
|
|
|
|
Hi,
Dan Neely wrote: The CERT warning itself says otherwise.
No, it doesn't.
How are you mising the word 'Both' and 'Windows Defender Exploit Guard' at the very beginning of the CERT advisary? Both of these user interfaces simply change a registry key for the operating system kernel where Mandatory ASLR is implemented
Experimental exploit mitigations has been my field of research for nearly a decade.
Best Wishes,
-David Delaune
|
|
|
|
|
Windows Defender Exploit Guard is just the new version/name for EMET after MS changed its mind about discontinuing it.
For the vast majority of systems not using it, normal ASLR is controlled at the app level via manifest. That's the version I'm contrasting to; and there's nothing about that being broken in the CERT warning.
Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason?
Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful?
--Zachris Topelius
Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies.
-- Sarah Hoyt
|
|
|
|
|
You are not making sense. The new 'Windows Defender Exploit Guard' is only available on the latest Windows 10 builds. The CERT advisary covers Windows 8 through the latest Windows 10 release build.
Let me be clear one final time:
Both the legacy EMET user interface and the Windows 10 'Windows Defender' user interfaces are incorrectly setting the registry key that controls the windows kernel implementation of ASLR.
The statement in your original post: "ASLR is only bugged in EMET mode" is completely false.
Can we change the direction of conversation? Is there anything I can do to help you understand? I have a complete understanding of how ASLR is implemented in the Windows OS and also the current entropy issue.
Best Wishes,
-David Delaune
|
|
|
|
|
Languages have evolved quite a bit over the years. The early evolution from machine language to assembler was necessary and obvious. The evolution from assembler to Fortran and Basic was also necessary and obvious. We might even say that the evolution of COBOL was predictable, if not entirely necessary. "You can't stop yourself from fallin'"
|
|
|
|
|
Quote: By 1990, C was just too small a language for the tasks at hand. We needed something better. And C++ was waiting in the wings.
Completly ignores Algol, Simula, SmallTalk, SAIL (Xerox Parc), etc. pioneering OOP brfore 1990: all of which influenced C++. "too small" is a bizarre characterization.Quote: Could it be that we are living at the beginning of a period in which language evolution will slow it’s frenetic pace? Will we see the number of languages cease it’s relentless rise, and begin to decline? Will our industry gradually abandon the exuberance of adolescence and settle down into a stable period of adulthood and middle age?
imho, as much devolution as evolution has been at play: consider the growth of JavaScript and its hydra of frameworks and extensions ... in my view, that has been a result of a geo-political struggle between the "major micro players," a kind of lowest-common-denominator buffer-state the ambitious rivals settled into by default ... not the best technical language solution, at all.
Other notable omissions from this pseudo-historical romp: LISP, Pascal, Forth, and Basic, Visual Basic, etc.
«While I complain of being able to see only a shadow of the past, I may be insensitive to reality as it is now, since I'm not at a stage of development where I'm capable of seeing it.» Claude Levi-Strauss (Tristes Tropiques, 1955)
modified 21-Nov-17 4:00am.
|
|
|
|
|
Government agencies that deal with cybersecurity, like the National Security Agency, have two competing interests. On the one hand, they want to protect America's online infrastructure and economy from cyberattacks. On the other hand, government agencies want to harness tools to attack opponents in cyberspace. I'm going to go with, 'when it suits their needs' for both
|
|
|
|
|
That's why Windows is not a safe OS; it's a weapon, and you are not in control of it.
Bastard Programmer from Hell 
If you can't read my code, try converting it here[^]
|
|
|
|
|
GitHub's new service will help developers clean up vulnerable project dependencies. But of course, 'more eyes' have already found those flaws, right?
|
|
|
|
|
Porting existing code to .NET Core used to be quite hard because the available API set was very small. In .NET Core 2.0, we already made this much easier, thanks to .NET Standard 2.0. Today, we’re happy to announce that we made it even easier with the Windows Compatibility Pack, which provides access to an additional 20,000 APIs via a single NuGet package. "The port is near, the bells I hear, the people all exulting."
|
|
|
|
|
Microsoft isn't the only company that's interested in scaling Git. The file system may be virtual, but Git is still surreal
|
|
|
|
|
How do you fix a program without the source code? You patch the binary directly. Mission critical software, updated!
|
|
|
|
|
Embattled computer security firm Kaspersky Lab said Thursday that malware-infected Microsoft Office software and not its own was to blame for the hacking theft of top-secret US intelligence materials. When in doubt, blame Microsoft
|
|
|
|
|
Your probability of being correct is usually pretty good.
|
|
|
|
|
As a United States Senator is reported to have said, as he awoke from half-slumber, during a hearing on the Panama Canal:
"What's that canal doing in Panama, anyway?"
«While I complain of being able to see only a shadow of the past, I may be insensitive to reality as it is now, since I'm not at a stage of development where I'm capable of seeing it.» Claude Levi-Strauss (Tristes Tropiques, 1955)
|
|
|
|
|
|
SQL Operations Studio is a free, light-weight tool for modern database development and operations for SQL Server on Windows, Linux and Docker, Azure SQL Database and Azure SQL Data Warehouse on Windows, Mac or Linux machines. Continuing in their fine tradition of horrid product names, I see
|
|
|
|
|
Seems off that the video shows "Script as Create", but not "Script as Alter"
"If you don't fail at least 90 percent of the time, you're not aiming high enough."
Alan Kay.
|
|
|
|
|
RebelLabs wants to get inside the mind of a programmer with its 2017 Developer Productivity Report. The report focuses on why developers use certain tools over others and how satisfied they are in their selection of those tools, architecture, and other aspects of development. In related news, I'm most excited not to work in Java as well
|
|
|
|
|
Who is she ?
Zen and the art of software maintenance : rm -rf *
Maths is like love : a simple idea but it can get complicated.
|
|
|
|
|
Can a close look at the universe give us solutions to problems too difficult even for a planet-sized computer to solve? Uh.... 42?
|
|
|
|
|
First you have to determine whether or not it will halt... 
|
|
|
|
|
Someone found a solution and is wondering what the problem is he can sell it for. Then again, it is not like there are more pressing matters.
Bastard Programmer from Hell
If you can't read my code, try converting it here[^]
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
