Introduction
Attacks on clients’ browsers have always been the real threat for everyone. And here vulnerabilities have been not only in the browser but also in plug-ins. Bank-clients, business software, antivirus software – all of them use ActiveX (for IE) for clients and here have been and are still many vulnerabilities. Vendors make steps to defend us from it. Software vendors patch vulnerabilities and OS vendors use new mechanisms to prevent attacks at all. But security researchers are trying to find way to bypass these mechanisms. The new versions of browsers (Internet Explorer 8 and FireFox 3.5) use permanent DEP. And the new versions of OS use the ASLR mechanism. All this makes the old methods of attacks impossible. But on BlackHat DC 2010 the interesting way to bypass DEP and ASLR in browsers (not only) and Just-In-Time compilers was presented. This method is called JIT-SPRAY. But here was no one public PoC. In this text we are describe how to write a shellcode for new JIT-Spray attacks and make universal STAGE 0 shellcode that gives control to any common shellcode from MetaSploit, for example.
---------------------------------
Related to this topic, Threatpost.com has a good memory protection article with a great ending quote from Dino Dai Zovi.....
But, as Dai Zovi and others have shown, even with these technologies enabled, exploitation is still possible. Attackers have begun using third-party applications to bypass ASLR and DEP on Windows recently. A researcher named Dionysus Blazakis showed in February how he could use a technique called JIT-spraying to exploit a vulnerability in Adobe Flash and bypass both ASLR and DEP. This scenario is not something that Microsoft security engineers would have contemplated or been able to prevent on their end; it's a result of the complex interactions among applications in production environments, not test labs.
"Systems fail more because of implementation than theory. The real world is complicated," Dai Zovi said.
No comments:
Post a Comment