IT Jobs
Microsoft adopts open-source security feature
If you can't beat 'em ...
By Matthew Broersma, Techworld
Published: 16:33 GMT, 31 May 06
Microsoft is taking a page out of the open-source community's book where it comes to security. In Windows Vista Beta 2, released last week, the company included a feature called address space layout randomisation (ASLR), a method of foiling some classes of attack that has usually been associated with open-source projects.
ASLR involves arranging the positions of certain data areas, such as the position of libraries, heap and stack, randomly in a process' address space. Certain types of attacks, which rely on these components having predictable target addresses, thus have a low chance of success when ASLR is in place.
Until now, the feature has been most prominently used in the OpenBSD Unix variant and the PaX and Exec Shield security patches for Linux.
In a blog entry, Microsoft security expert Michael Howard said the feature had not only been included in Vista Beta 2, but switched on by default.
"We added ASLR pretty late in the game, but we decided that adding it to Beta 2 and enabling it by default was important so we can understand how well it performs in the field," he said.
He said ASLR can defeat attacks such as "return-to-libc", where exploit code attempts to call a system function to open a socket. Because the memory address of the function is randomised, such attacks are much harder to carry out, Howard said.
"In the case of Windows Vista Beta 2, a DLL or EXE could be loaded into any of 256 locations, which means an attacker has a 1/256 chance of getting the address right," he said. "In short, this makes it harder for exploits to work correctly."
He cautioned, however that not only could ASLR cause compatibility problems - one of the main points the team hopes to test in Vista Beta 2 - but it won't solve all problems.
"It is not a panacea, it is not a replacement for secure code," he said. "It is a useful defense because it makes Windows systems look 'different' to malware, making automated attacks harder."
Howard also outlined a number of other security features Microsoft has been adding to Vista over time, such as the /GS stack-based buffer overrun detection option; /SafeSEH, which can automatically kill some corrupted processes; Data Execution Protection, aka NX, which requires hardware support and can prevent buffer overflows; and Function Pointer Obfuscation, which involves encoding many of Vista's long-lived pointers, frequent targets for attack.
Microsoft released a whitepaper detailing these security features.
.gif)
Add your commentComments