tag:blogger.com,1999:blog-4088979.post1568342189290630802..comments2023-10-16T06:06:25.012-04:00Comments on TaoSecurity Blog: Secunia Survey of DEP and ASLRRichard Bejtlichhttp://www.blogger.com/profile/13512184196416665417noreply@blogger.comBlogger5125tag:blogger.com,1999:blog-4088979.post-6555121347078165572010-07-03T12:56:28.351-04:002010-07-03T12:56:28.351-04:00What I found even more interesting, is the amount ...What I found even more interesting, is the amount of information online about DEP and ASLR bypass techniques and how even Microsoft's products with DEP and ASLR were bypassed. In some of the articles pertaining to Microsoft's products, it's hard to weed through the content and determine the facts. I read Microsoft's side and the vulnerability researcher's side and it just raises more questions than it answers. <br /><br />Don't get me wrong, implementing DEP and ASLR is a good thing, but as with all security measures, hackers will just step up their game and figure a way around it. That's certainly not a valid reason to not implement these security measures, but does anybody think that DEP and ASLR are the end all security measure that will put an end to memory-based exploits?Mister Reinerhttp://misterreiner.wordpress.comnoreply@blogger.comtag:blogger.com,1999:blog-4088979.post-7298491539243824412010-07-03T05:22:32.129-04:002010-07-03T05:22:32.129-04:00Since they get little credit, I wanted to mention ...Since they get little credit, I wanted to mention that the Solaris CPU had DEP-technology in 1998. Intel had to put this technology in the MMU. Finally Microsoft starting using it. It's about time.Bruce Barnetthttp://blog.grymoire.com/noreply@blogger.comtag:blogger.com,1999:blog-4088979.post-187992396989847762010-07-02T21:59:17.252-04:002010-07-02T21:59:17.252-04:00Here is a wild guess.
DEP and ALSR trip up many s...Here is a wild guess.<br /><br />DEP and ALSR trip up many software protection (licensing) schemes. At least this is the reason we are not using it for Unbrowse SNMP.Unknownhttps://www.blogger.com/profile/07251236869483272697noreply@blogger.comtag:blogger.com,1999:blog-4088979.post-38354595640331056622010-07-02T19:46:58.733-04:002010-07-02T19:46:58.733-04:00let me follow up with one more thing:
I think it&#...let me follow up with one more thing:<br />I think it's a general "people issue". hp also introduced a stack protection feature that would either ignore, alert or prohibit such accesses. <br />I was consulted and suggested to set it to "alert" mode for a limited period (one to cover all server's reboots, like 9 months or so), create monitoring rules to catch the error messages and then after the date, turn it over to prohibit mode.<br /><br />Well. Everyone was convinced. The first step was successfully implemented. Noone remembers the rest.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-4088979.post-90452084930957445042010-07-02T19:41:18.238-04:002010-07-02T19:41:18.238-04:00i've noticed that on many many programs, it wa...i've noticed that on many many programs, it was desirable, but not practical, to generally enable DEP - too many applications broke.<br /><br />Personally I am not surprised, too many windows devs seem to not have the insight or interest for implementing even the easiest bit of security. it will have to be enforced, then they'll do it, but *never* just for a good cause, even if it causes no extra effort at all. I think it was good to introduce the feature, but it should have been enforced soon afterwards - but that's not microsoft's policy. I read that for example symbian apps needed to be signed by the OS vendor after they were ready for release. this makes things safe and good, but this also costs market share...<br /><br />(Disclaimer: I started working in the sw dev department of a company quite closely tied to microsoft and currently do unix stuff at a company that primarly does windows apps)<br /><br />florianAnonymousnoreply@blogger.com