Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Looking over an overview of the newest published IE exploit, I noticed what I think is assembly. I don't know anything about exploit development, but I know a little about assembly. Seeing that assembly code, does that mean exploits target specific architectures on specific OSs?
As in, does that mean that the IE vulnerability needs to be developed IN ASSEMBLY once for each OS( XP, Vista, 7, 8 ), doubled based on 32/64 bit, then doubled again based on byte order?
Yes, most exploits are platform dependent. There are details.
For instance, if an attacker targets Internet Explorer, then he targets Windows systems. Most Windows systems run on x86. Moreover, on Windows up to 7, the default IE is the 32-bit version, even if the OS is a 64-bit Windows. Also, at the assembly level, XP, Vista and 7 are very similar (indeed, they can run the same applications, so, from the point of view of the applications, things don't change much).
This means that a single exploit version (32-bit x86, for "Windows") will already work for a vast majority of cases. An industrious attacker will also think about a 64-bit version for Windows 8, or the (very few) users with a 64-bit pre-8 OS who run the 64-bit IE. A very industrious attacker will try to make an ARM version for the Surface RT.
All these platforms are little-endian. IE for other CPU has been dead for quite some time (I used the Sparc/Solaris version back in 2000 or so, but it was a 5.x version).
The important point is that attackers don't need to do much quality assurance. It is not a problem for the attacker if what he sends to a target would not work flawlessly on other machines that he is not presently targeting.
Exploits are platform dependent as each platform may have a different way of handling the memory layout and process execution. For example, executing an exploit on WinXP will be relatively easier rather than on other recent versions of Windows. Talking particularly about the IE exploits, it has got more to do with finding vulnerability in some of the browser functions or DLLs and leverage those vulnerabilities to bypass the OS security mechanisms.
Are exploits platform dependent?
Yes.
As in, does that mean that the IE vulnerability needs to be developed IN ASSEMBLY once for each OS( XP, Vista, 7, 8 ), doubled based on 32/64 bit, then doubled again based on byte order?
No.
The use of assembly doesn't make it more platform dependent. It's only just as platform dependent as it would be if written in say, C, (although for most purposes C makes it much easier to target those different platforms).
The page you linked doesn't indicate which platforms the exploit targets, and only shows x86 code. If it also targets x64, that's still only two platforms: x86 Windows and x64 Windows, and even for those two the code would be largely isomorphic (similar). The mere fact that it has assembly in it doesn't suddenly explode the complexity of supporting different editions of Windows which run on the same CPU architecture.
(Just to hammer the point: portable assembly can be written and compiled once, such that the same blob of machine code will then execute under all of Windows, OS X, Linux, and no operating system at all, on the same CPU architecture. In this way, assembly is less platform-dependent than other languages, because it requires less of a platform. The standard executable file formats that house machine code are still OS-specific, though; for example OS X won't know how to load a Windows .exe, even if the machine code inside could run if it were loaded.)
Byte order is not an issue as x86 & x64 are purely little endian.
Also note that the assembly you're seeing there is a disassembly, so it was not necessarily written in assembly; it could have been written in nearly any language. As this is an exploit, and designed to do weird extralinguistic things, the hackish parts of it would have been easiest to write in assembly itself, and some may have been easiest written in C, and some may have been started in C, disassembled, and adapted into the assembly.
So the short answer is, supporting different Windows versions in the exploit is not as difficult as you're imagining it to be.
It is possible to have an exploit be cross-browser or cross platform. It would depend upon libraries, frameworks, and the type of exploit.
Most exploits are going to target a specific platform, a specific version, etc. An exploit is an attack on logic, so it may be possible to write code once that will work across architectures based on the logic, however in some cases you may have to target more specific architectures.
e.g., Is it a matter of exploiting some compiler optimization or making it jump to a different instruction.
