ASLR Makes Vista A Moving Target

Microsoft added new memory technology, Address Space Layout Randomization (ASLR), to Windows Vista Beta 2 that aims to make some types of attacks much harder to accomplish.

Writing in his blog, Michael Howard, senior security program manager at Microsoft, said that ASLR causes Vista to load system code randomly into one of 256 different memory locations, which makes it harder for intruders to launch certain types of exploits that depend on knowing the address location of system calls.

David Litchfield, managing director of Next Generation Security, noticed the inclusion of ASLR in Vista Beta 2 before Microsoft made it own revelation. In a message posted to the Bugtraq mailing list, Litchfield pointed out that in September 2005 he wrote a whitepaper, "Buffer Underruns, DEP, ASLR and improving the Exploitation Prevention Mechanisms (XPMs) on the Windows platform," that discusses ASLR, including some weaknesses of the technology.

Howard said in his blog that ASLR "is not a panacea, it is not a replacement for insecure code, but when used in conjunction with other technologies [...] it is a useful defense because it makes Windows systems look different to malware, making automated attacks harder."

"We added ASLR [to Vista] pretty late in the game, but we decided that adding it to Beta 2 and enabling it by default was important so we can understand how well it performs in the field, [...] what the compatibility implications are, and to give us time to fine tune ASLR before we finally release Windows Vista," said Howard.

He went on to say that the combination of ASLR and Data Execution Prevention (DEP), as well as features found in Visual C++ such as the stack-based buffer overun detection and exception handling options, together raise the security bar in Windows Vista.