The Best Laid Plans in Code Protection...
Sometimes the best laid plans really do go to waste. Peter Varhol over at Redmond Developer News posts a revealing article about the Law of Unintended Consequences when it comes to implementing code protection techniques into modern O/S's.
You see, developers write exception handlers to catch errors and prevent the system from crashing when malware tries to attack it. But, sometimes the way in which they handle the exceptions actually enlightens the attacker into how to further compromise the system.
Peter talks about two examples where this has occurred recently in Windows Server. The first...
...is the recent and highly publicized ANI file bug. The second is in what he now believes to be the flawed implementation of random assignment of memory pages for certain system code elements.
Peter writes,
"If the vulnerable code is wrapped in an exception handler that catches many errors, a failed attempt won't crash the component and the attacker can try again with a different set of addresses," Howard says in a blog posting.So the exception handler did exactly what it was supposed to do -- prevent an error within the code it wrapped to cause an application fault. But that same exception handler also prevented the attack simulation tool used by Microsoft to show that there was a potential vulnerability in the code. The simulated attack should have crashed the code, but the well-written exception handler enabled it to continue running. And, of course, that's exactly what it does when a real attack occurs."
Its a great piece and one to read, even if you don't fancy yourself interested in software development. Check it out at:
http://reddevnews.com/columns/article.aspx?editorialsid=1784
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine