Vulnerabilities / Threats

11/20/2017
04:55 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Researcher Finds Hole in Windows ASLR Security Defense

A security expert found a way to work around Microsoft's Address Space Randomization Layer, which protects the OS from memory-based attacks.

The latest versions of Microsoft Windows are vulnerable to attacks due to a newly discovered vulnerability in Address Space Layout Randomization (ASLR).

The vulnerability affects Windows 8, Windows 8.1, and Windows 10 systems with system-wide ASLR enabled via Microsoft's Enhanced Mitigation Experience Toolkit (EMET) or Windows Defender Exploit Guard.

Will Dormann, a senior vulnerability analyst at Carnegie Mellon's CERT-CC discovered and reported the vulnerability. System-wide mandatory ASLR on all affected systems, enabled via EMET, has zero entropy, "essentially making it worthless," he explained on Twitter.

Dormann was investigating Microsoft Office vulnerability CVE-2017-11882 when he found the issue. He wanted to see which exploit mitigations potentially already in place could have prevented exploitation of CVE-2017-11882. Dormann noticed even if mandatory ASLR was enabled on his machine, the code loaded at the same location every time. The load address was not actually being randomized.

His discovery means an attacker can more easily exploit memory corruption vulnerabilities in Windows 8 and newer systems, which ASLR would normally protect. The advantage of ASLR is it makes exploiting memory corruption bugs more difficult; however, it isn't working as intended.

ASLR arrived in Windows Vista to prevent code-reuse attacks, which rely on code executing at predictable memory locations, by loading executable modules at random addresses. Starting in Windows 8, Microsoft began to offer system-wide mandatory ASLR. Admins could enable programs to randomize locations even for applications without ASLR support.

EMET is a free tool Microsoft previously released to protect applications not opted into ASLR and other exploit mitigation tools. Admins could enable them through the EMET interface. When Microsoft launched the Windows 10 Fall Creators Update, it integrated EMET's key capabilities into the Windows Defender Exploit Guard.

Exploit Guard has an option to enable system-wide bottom-up ASLR. However, as Dormann discovered, setting system-wide ASLR in Windows, Windows 8.1, and Windows 10 does not actually randomize memory locations. If the default GUI in Exploit Guard says "On by default," programs will still be relocated, but to the same address across different reboots and systems.

Dormann likens the issue to buying a high-security deadbolt to add to an existing lock on your front door, only to dealize the deadbolt lock doesn't actually activate when turned. The result: you don't have as much protection as you think you do.

This could lead to a "wide variety" of common types of attacks, explains a DHS spokesman.

People who believe they are protected by ASLR may take risks they wouldn't normally take; for example, opening an attachment in an unsolicited message. If the message is a spearphish and ASLR is working properly, the exploit would fail. However, without ASLR, the attacker could gain complete control of the victim's system and view their access to other systems.

Microsoft says the problem is not a flaw. It says the issue, discovered by CMU's CERT/CC and reported by US-CERT, is with configuring non-default settings for ASLR using Exploit Guard and EMET, and providing workarounds. The company is investigating and will address the configuration issue.

"The issue described by the US CERT is not a vulnerability," a Microsoft spokesperson says. "ASLR is functioning as designed and customers running default configurations of Windows are not at increased risk."

However, Dormann says when it comes to deciding whether this is a vulnerability or not, this problem is "a little bit tricky." It's not a vulnerability that an attacker can directly exploit; however, it is an issue where users' expectations of protection are not met.

"If a user enables system-wide mandatory ASLR, the user should rightfully expect that code is forced to be randomized on a system-wide basis," he explains. "But this is not the case with Windows 8 or later systems, due to a change in how mandatory ASLR is implemented in Windows."

CERT/CC is currently unaware of a practical solution to the problem, Dormann says, adding a workaround for administrators in his blog post on the discovery. He advises enabling both bottom-up and mandatory ASLR system-wide for all systems running Windows 8 or later, using a certain registry value. Businesses should also use defense-in-depth strategies to protect networks, users, and data from unauthorized access, he adds.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Intellijoule
50%
50%
Intellijoule,
User Rank: Apprentice
11/21/2017 | 10:24:48 AM
A new operating system based on NSA Class A1 of the TCSEC is a must. NSA and the industry should return to Class A1
NSA, under Dr.Roger R.Schell, Deputy Director, developed the only secure operating system and secure kernel with secure TPM that has never been breached, not once even up to today.  The only remaining source for the verified code is Aesec.com in California.  We are attempting to have Senator Daines require Government and Industry to apply Class A1 as a rider on his cybersecurity bill now in Congress. Dr. Schell recently taught NSA Class A1 and general cybersecurity at the University of California. Class A1 is under examination again at the University of Minnesota, just launching. Not even Blackhat could crack the code after many years. 

Stay tuned to Dr. Schell's site at www.aesec.com  NSA Class A1. I captured a motivation for NSA Class A1 on our company website.  You can find it right under "Our Caltech and JPL Experience" in the News listings. 

Charles G. Nutter, CEO, Intellijoule, Inc. 
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: White Privelege Day
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17283
PUBLISHED: 2018-09-21
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Inject...
CVE-2018-17282
PUBLISHED: 2018-09-20
An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference.
CVE-2018-14592
PUBLISHED: 2018-09-20
The CWJoomla CW Article Attachments PRO extension before 2.0.7 and CW Article Attachments FREE extension before 1.0.6 for Joomla! allow SQL Injection within download.php.
CVE-2018-15832
PUBLISHED: 2018-09-20
upc.exe in Ubisoft Uplay Desktop Client versions 63.0.5699.0 allows remote attackers to execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI ha...
CVE-2018-16282
PUBLISHED: 2018-09-20
A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/net_WebCADELETEGetValue URI.