3 ms·

I wonder MS has given any thought to 'sealing' executable regions so no new instructions can leak into memory. IOW Once executed, a process can only reference i

by ksk 9y ago

I wonder MS has given any thought to 'sealing' executable regions so no new instructions can leak into memory. IOW Once executed, a process can only reference instructions present in the binary itself. Basically make running JIT-ed code, self-modifying code, etc, a special process privilege, that can then have a limited process context for I/O.

pjc50 9y ago
Isn't that a subset of W^X / DEP https://support.microsoft.com/en-sg/help/875352/a-detailed-description-of-the-data-execution-prevention-dep-feature-in https://support.microsoft.com/en-sg/help/875352/a-detailed-d... ? Can be defeated by "return-orientated programming", which uses only the existing instructions in the binary and a modified stack.
- ksk 9y ago
  Yeah, DEP + ASLR already addresses some of this. Perhaps the stack regions could partially be set to read-only to protect return addresses.
  - kevingadd 9y ago
    Control Flow Integrity is one technique for addressing these sorts of attacks: https://www.microsoft.com/en-us/research/wp-content/uploads/2005/11/ccs05.pdf https://www.microsoft.com/en-us/research/wp-content/uploads/... IIRC there are even some experimental efforts to add hardware support for CFI techniques to new processors (Intel I think?) but there's work going on to add support for it to modern compilers, which would allow you to compile libc and other system libraries with it turned on. EDIT: It appears Clang actually ships with some CFI support already: https://clang.llvm.org/docs/ControlFlowIntegrity.html https://clang.llvm.org/docs/ControlFlowIntegrity.html
muricula 9y ago
A lot of code in the windows ecosystem uses UPX unpackers. The code extracts itself before executing the actual application. This is common for certain installers. Windows does a pretty good job of enforcing Data Execution Prevention for code which opts in.
deleted 9y ago
[deleted]

by ksk 9y ago

pjc50 9y ago

Isn't that a subset of W^X / DEP https://support.microsoft.com/en-sg/help/875352/a-detailed-description-of-the-data-execution-prevention-dep-feature-in https://support.microsoft.com/en-sg/help/875352/a-detailed-d... ? Can be defeated by "return-orientated programming", which uses only the existing instructions in the binary and a modified stack.

ksk 9y ago
Yeah, DEP + ASLR already addresses some of this. Perhaps the stack regions could partially be set to read-only to protect return addresses.
- kevingadd 9y ago
  Control Flow Integrity is one technique for addressing these sorts of attacks: https://www.microsoft.com/en-us/research/wp-content/uploads/2005/11/ccs05.pdf https://www.microsoft.com/en-us/research/wp-content/uploads/... IIRC there are even some experimental efforts to add hardware support for CFI techniques to new processors (Intel I think?) but there's work going on to add support for it to modern compilers, which would allow you to compile libc and other system libraries with it turned on. EDIT: It appears Clang actually ships with some CFI support already: https://clang.llvm.org/docs/ControlFlowIntegrity.html https://clang.llvm.org/docs/ControlFlowIntegrity.html

muricula 9y ago

A lot of code in the windows ecosystem uses UPX unpackers. The code extracts itself before executing the actual application. This is common for certain installers. Windows does a pretty good job of enforcing Data Execution Prevention for code which opts in.

deleted 9y ago

[deleted]