Researchers Bypass ASLR Protection On Intel Haswell CPUs (softpedia.com) 72
An anonymous reader writes: "A team of scientists from two U.S. universities has devised a method of bypassing ASLR (Address Space Layout Randomization) protection by taking advantage of the BTB (Branch Target Buffer), a component included in many modern CPU architectures, including Intel Haswell CPUs, the processor they used for tests in their research," reports Softpedia. The researchers discovered that by blasting the BTB with random data, they could run a successful collision attack that reveals the memory locations where apps execute code in the computer's memory -- the very thing that ASLR protection was meant to hide. While during their tests they used a Linux PC with a Intel Haswell CPU, researchers said the attack can be ported to other CPU architectures and operating systems where ASLR is deployed, such as Android, iOS, macOS, and Windows. From start to finish, the collision attack only takes 60 milliseconds, meaning it can be embedded with malware or any other digital forensics tool and run without needing hours of intense CPU processing. You can read the research paper, titled "Jump Over ASLR: Attacking Branch Predictors to Bypass ASLR," here.
Kinda makes you wonder... (Score:2)
... was it ever worth it?
Re: (Score:2)
no. locks keep honest people honest. when you decide the user cant be trusted, all pretense of keeping honesty in the mix evaporates.
the responsibility for a system lays at the foot of the user. nobody else.
Re:Kinda makes you wonder... (Score:4, Insightful)
Eh, it's still worth it. I think that these other layers shouldn't be discussed in the same manner as a "lock" type layer though. These are more properly "mitigations", things that are supposed to help some of the time, increase time to entry, increase the burden of resources required for an attack like this. There's merit in there.
Re: (Score:2)
The user is only part of the problem it is the admin that you have to worry about. or more specifically the user who thinks they are an admin.
Would you jump into the pilot's seat of a helicopter and steal it, just because you saw a video of a helicopter flying?
That is how the average user admin's their computer with the predictable result.
Computers are massively complicated machines, with millions of interconnected parts and most don't understand how they connect together and have issues. So you have to d
Re: (Score:2)
Re: (Score:3)
Of course it does. ASLR does not just protect you from local exploits, but also from remote ones.
Re: (Score:2)
I remember when Windows started denying user permission to delete system files, which made manual virus recovery impossible.
I have had to do 3 reinstalls over the years because I couldn't remove such files, and neither could the virus detector.
At one point I had the virus detector running in a loop removing what it could, which fought the virus to a standstill so the computer could be used, but some deeply-rooted thing kept reinstalling it.
Re: (Score:2)
Remote exploit (Score:5, Informative)
TL;DR: because of this bypass ASLR cannot prevent local privilege escalation. but ASLR can still prevent remote access.
The point of ASLR is that it's not easy to determine where the functions are located in memory.
So, if there's an exploit where you can force code to jump at some specific point in memory, you cannot use this exploit to call the function you want because you don't know where they are.
(e.g.: stack smash. Overrun some temporary buffer that is stored on the stack buffer, up to the point where you can overload the return address. So once a function finished, it's doesn't jump back to the caller [it doesn't return] it jumps instead to the address you've overwritten [it jumps to the next function you want to abuse as part of you exploit] )
2 possible situations:
- You've already managed to get (user-level) shell acces (or at least run any payload of your choosing). You want to escalate privileges up to root. You know of a bug in some kernel piece of code that you can try to exploit. ASLR would prevent you from doing it because you don't know where the piece of code is exactly in kernel memory space. So you run the bypass proposed by the researcher and you obtain a list of where is what.
Now you can run your exploit, and gain root.
- You're outside the machine. You want to get remote access. You know a bug in some code (be it kernel or userspace) that could be exploited. But you need to jump into specific function whose precise location in memory you don't know because of ASLR.
So ASLR won't block local privilege escalation anymore (because when you have local access you could defeat ASLR's randomisations)
But ASLR will still block remote access (without local access, you can't get a map of all ASLR-ised functions you need to inject in your remote exploit).
Re: (Score:2)
ASLR is *NOT* Obscurity, quite opposite (Score:2)
(Obscurity. You keep using that word, I do not think it means what you think it means)
ASLR is NOT obscurity.
ASLR is quite the opposite : it's a way to mitigate obscurity.
(Just like a password is NOT security through obscurity).
A kernel without ASLR is obscurity: you count on the attacker not known where the kernel (or any other critical software) stores its code.
Once the address map is known, every single instance of this kernel (or software) everywhere on planet Earth is at risk.
With ASLR (which is, in Lin
Re:ASLR was a dumb idea while it lasted (Score:5, Interesting)
define malware.
this would be useful for killing some of the more nasty forms of drm, for instance. a runtime patcher could learn exactly where to patch, and booya.
the more idiots trying to count chickens before they hatch thart get their eggs smashed, the happier i am. maybe they will one day learn that they cant have *all* of the pie, no matter how much they want it.
Re:ASLR was a dumb idea while it lasted (Score:4, Informative)
Re:ASLR was a dumb idea while it lasted (Score:4, Informative)
Re: (Score:2)
Re: (Score:2)
Yes it is but people have been trying to do that for 40 years and have not gotten it right yet so...
Re:ASLR was a dumb idea while it lasted (Score:5, Interesting)
Wrong. Plenty of code correctness has been deployed in service of this goal.
Unfortunately, there are endemic economic and political reasons why we constantly choose the protocols and implementations that are bigger, hairier, and less continent.
All you need is a culture of kicking non-conforming implementations to the curb, and then the rigorous implementations have a chance to emerge from the weeds. Do we have such a culture? No—most of the time—no, we do not. Such a culture would cramp Megacorp style, and interfere with timeless value-adds, such as embrace and extend, closed ecosystem, DRM jungle, NIST-sanctioned algorithmic weevils, definition by implementation, documentation by implementation, etc. etc.
Far, far away in dull and dusty places like the Erlang OTP or Bernstein's qmail or Knuth's TeX—or perhaps even the Google protocol buffers for at least one lucky and unusually blessed language binding from the somewhat recent past—you just might find a rigorously coded parser or two.
For the most part, however, I agree. We'll probably never have rigorous parsers in a dominant culture of "screw everyone else", Wild West dysenteroperability.
Re: (Score:2)
Re: (Score:1)
Malware is a broad term that encompasses viruses, worms, etc. and achieved widespread use because it's a lot simpler than trying to explain the nuance that separates a trojan from a virus to a layman. There was a void that needed filling, and Malware hit the spot. Ironically, the description that you have attributed to malware is actually known as Grayware. I would much rather someone correctly use the more general term, malware, to describe a virus than incorrectly use the term virus when referring to a tr
Re: (Score:2)
Enhanced Mitigation Experience Toolkit (Score:4, Informative)
The Enhanced Mitigation Experience Toolkit, which is offered by Microsoft for the Windows operating system, provides a software implementation of Address Space Layout Randomization (ASLR), in addition to what is or is not provided in hardware, but that's not all. The software also offers Data Execution Prevention (DEP), Structured Exception Handler Overwrite Protection (SEHOP), Certificate Trust (Pinning) and blocks untrusted fonts. Granted, this is an optional add-on for Windows that requires some expertise on the part of the user to make the best use of, but in knowledgeable hands tools like these can be used to further enhance the security of the system by making it that much harder for attackers to successfully inject executable code into the address space of privileged processes.
+5 realy?, This works against the Win version too (Score:3, Informative)
It is an exploit of the CPU's cache, a cache collision attack, if your data's location is referenced in the "Branch Target Buffer" cache then it is vulnerable, if you can find the location table random locations are meaningless. As such this threatens all software implementations Windows, Linux, whoever does it they are all vulnerable unless they find and implement a way of avoiding the collision or removing themselves from the cache (at a performance cost).
Re: (Score:2)
EMET on Windows is a great tool! What a name though, only the Microsoft marketing droids could invent that one. "Mitigation Experience" never in a million years would it have occurred to me I should be concerned about my experience mitigating something. Thanks marketers!
Re: (Score:1)
Apps execute plenty of code. There's a whole Android NDK to compile native code that runs on the target processor. I'm running an app right now that only uses a small amount of Java for the user interface and the bulk of the app is coded in C.
Re: (Score:2)
Apps don't execute code. Since these idiots don't undertstand this, dismiss it as the nonsense it is.
FYI iOS apps are compiled to binary code, which is why you can't use any dynamic runtime code generation on them, and so *could* be vulnerable to this type of attack. i.e.: from C#-based Xamarin apps you can use Reflection.Emit to generate code at runtime on Android, OSX and Windows (which leverages the JIT features of .NET/Mono/Dalvik), but you can't do this on iOS because they're pre-compiled for specific processors before getting packaged and uploaded to iTunes app store.
Man... oh man.... (Score:5, Interesting)
I've been a true blue IT pro foss loonix guy for most of the last 16 years. And every year. Nay. Every 6-10 months some hardware designed to "thwart" crackers, and other crypto attackers goes the way of the dodo.
I think the industry looks at security the wrong way and the lulzsec guys weren't wrong in that ideological rant they made. You can't predict the unpredictable. Firewalls aren't a wall in any meaningful sense. "Software defined" networks are just a catchphrase for networking complex things in a dynamic manner. Intrusion Prevention Systems do not prevent. Hell, if you let your cisco guy deploy it, it wont even log a thing and when it dies you will have no idea why.
Bollocks, Shenanigans and costly Stupidity (don't get me started on "hardware routers" or "storage networks"). This is what I have found in my years in the battlefields, young grasshoppers. And a deeply felt wish that I had chosen archeology instead.
Re: (Score:2)
I wonder how many archeologists with bad pay wish they had become an IT professional instead.
Re: (Score:2)
Stop making networks interesting. Put PR on the internet when the project is done and ready for sale.
Until then keep everything secret.
Doing code work for years on internet facing networks on hardware designed for easy police and security service access is just a big risk.
Too many nations, their staff, ex staff, cults and smart people have the keys or know of the trap doors and backdoors.
Re: (Score:2)
You should read up on the AS/400 Architecture. So different from the PC word and much more logical, no such thing as device drivers and buffer overflows can't happen.
This is one way. (Score:2)
Imagine the infinite ways of using other people's computers without their explicit permission.
I have a secure Babbage computer (Score:2)
I will guarantee can't be hacked electronically and will sell you one.
Hopefully this doesn't result in (Score:3, Interesting)
removing the BTB entirely. I've seen libraries rip out faster routines or add some nondeterminism to the latency just so that it could mask such a "hot cache" vulnerability. It seems a bit backward to rip out a performance enhancing capability in the architecture just because of ASLR bypass.
Re: (Score:3, Insightful)
Or just make it part of the context of each process that has to be switched out...
Obviously the problem is making it a global resource.
Re: (Score:2)
There are a number of alternatives -- flushing the BTB on ring switch seems a reasonable starting point. It should eliminate most privilege escalations.
Making the address randomization affect bits outside the range seen by the BTB indexing scheme would also make the attack much more difficult. This would require some non-trivial OS kernel changes
The BTBs themselves can be multi-level and pretty large -- they could form part of a process context, but they'd add several kbytes to it. There is no hardware supp
Re: Shitty summary (Score:2)
Uh ok, but then what was the point of ASLR all along?
Re: (Score:3)
Making some kinds of exploits harder to do. Harder - not impossible. Que the "security by obscurity isn't security" crowd that never got that layered security is a thing...
Re: (Score:2)
Obscurity doesn't hurt, but don't count on even several layers of it without some rigorous security design, too.
And there goes Intel SGX down the drain... (Score:1)
...again. Provided this screwup is on Broadwell and Skylake, which is not a far fetched possibility *at all*.
Intel SGX is all about running secret code on untrusted processors, and this kind of side-channel allows one to probe inside the SGX container. One of the useful (read: non-DRM-crap) uses for SGX would be to implement secured data+code areas to run crypto-sensitive portions of SSH, GnuPG, etc. Unfortunately, branch probing is good for a lot more than defeating ALSR, you can actually, when one is
Security is not foolproof (Score:2)
You will never have perfect security. There is no such thing. All you can do is put up sufficient roadblocks that a miscreant will give up before they are successful.
And all the security measures in the world arn't going to make a lick of difference if the user opens the door and waves the bad guy in.
Chicken and egg (Score:2)