1

Several software packages on our SOE Windows machines come with DEP and ASLR memory protections off by default. More troubling is that these applications run as SYSTEM and load their own drivers.

Given that these are expected memory protections and these are modern applications, is there any reason why they would/should be disabled for applications?

Am I, as an administrator, able to forcibly enable them without? What is the risk of having such applications in the environment?

0

The risk of such applications being in your environment is trivial escalation of exploitable memory corruption in the application to arbitrary code execution as SYSTEM. This is likely a compile-time fail as there aren't really compelling reasons for modern applications to disable ASLR (particularly if they're loading unmanaged code such as drivers). Furthermore, if they're loading drivers the attack surface for memory corruption is much larger than pure managed code.

I would not allow these applications on security-critical devices in my environment.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.