You can leverage ASLR not only for randomizing
the memory locations of Windows
system files but also for randomizing the
memory locations of executables and DLLs
of any application that runs on Vista or Server
2008. To do so, application developers must
compile their code with the /dynamicbase
linker option. Microsoft Visual Studio supports
this option from Visual Studio 2005 SP
1 and later.
Like DEP, ASLR is not a Microsoft-only
invention and implementation. ASLR was implemented long before Vista and Server
2008, on platforms such as Linux and UNIX.
Also certain Host Intrusion Detection System
(HIDS) solutions have been supporting ASLR
on legacy Windows platforms long before the
native Windows support.
A good analysis of the Microsoft ASLR
implementation in Vista is offered in the
Symantec research paper at www.symantec.com/avcenter/reference/Address_Space_Layout_Randomization.pdf. Unlike with
DEP, Microsoft doesn’t offer ASLR-specific
configuration settings for fine-tuning the use
of ASLR.
Important Proactive
Defenses
DEP and ASLR each use a slightly different
proactive defense approach as a buffer-overrun
defense. Where ASLR makes it more difficult
for malware to find the right code, DEP
makes it more difficult for malware to execute
the code once the target code is found. You
can leverage both techniques at the same
time and they can also be leveraged in virtual
computing environments such as Microsoft
Virtual PC or VMware products.
From an application-support point of view,
you should remember that you must test your
applications for DEP compatibility prior to
deploying them on a DEP-enabled Windows
platform. DEP can cause certain applications
to stop working properly or even halt.
Finally, it’s important to understand that
DEP and ASLR aren’t a panacea for the
buffer-overrun problem. Both techniques
certainly make it much more difficult for
malware to leverage buffer overruns. ASLR,
for example, doesn’t make it
impossible for malware to find
system code, but it makes the
process of finding system code
much more challenging. In
many cases, ASLR and DEP
will also effectively stop bufferoverrun–
based attacks.
End of Article
Register
