Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How effective is ASLR in preventing arbitrary code execution in a buffer overflow type exploit? How hard is it for an attacker to bypass this without simply guessing where the addresses are?

share|improve this question
add comment

3 Answers

up vote 12 down vote accepted

ASLR is a defense-in-depth mechanism. It is effective, but can be bypassed (the 2010 PWN2OWN contest break included an ASLR bypass).

ASLR's primary purpose is to defeat "ret-to-libc" attacks which are a mechanism of bypassing DEP. IMHO ASLR is only really effective when bundled with other protection mechanisms like DEP (ASLR without DEP can typically be trivially bypassed).

share|improve this answer
add comment

ASLR strength also depends on the architecture used. Under x86 your virtual address is limited to 4 bytes, which gives you only 2 possible bytes for randomization (taking into account the memory granularity), while x64 gives you much more freedom to randomize the localization.

Imagine you attack the server 32-bit program, which continues its execution after the crash (restarted by the watchdog, for instance). In this case you could just bruteforce the return address with your exploit, while it is considered impossible for x64-application (to the best of my knowledge).

share|improve this answer
add comment

Mark Dowd and Alex Sotirov - Black Hat 2008 are the experts on defeating ASLR.

Alex Sotirov and I are presenting at BlackHat USA today on bypassing the Windows Vista memory protections in the context of the web browser in a speech titled “How to Impress Girls with Browser Memory Protection Bypasses”. Specifically, we will be discussing how rich browser functionality can be utilized to help lessen the impact of memory protections (and in some cases, completely negate them). Some of the techniques we will be discussing are known ones, whereas others are new approaches that we haven’t seen discussed in public forums before.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.