Hackers may exploit holes caused by memory crashes

Sophisticated attackers could soon adopt an innovative technique for bypassing one of the most effective mechanisms for preventing a Windows security breach, researchers say.

The protective technique is called the Address Space Layout Randomization (ASLR). ASLR scrambles the memory positions of key elements of a program, such as the base of the executable and the positions of the stack, heap and libraries. This makes it difficult for an attacker to guess where these elements reside in order to exploit them.

Current trends in malware show attackers moving toward an ASLR bypass technique that takes advantage of common programming errors that lead to memory corruption, which is when the contents of a memory location are unintentionally modified. Nearly 10 percent of application crashes on Windows systems are due to memory corruption.

If the corruption exists, then the attacker's malware tries to guess where an application's library is in memory, researchers with security vendor FireEye said.

"One way they can do that is by reading memory that they're not suppose to," said Dan Caselden, senior malware researcher for FireEye. "Somewhere in memory they'll be a pointer to a library. If they can read that pointer then they can figure out where that library is."

Take advantage of memory leak

To find the pointer, the attacker corrupts a JavaScript Array Object, so address data spills out into memory. The attacker uses the information to find the library needed to compromise the application.

"The corruption vulnerability is the same that they use to get code control or code execution," Caselden said.

In general, any vulnerability that allows an attacker to force an element in memory to expose data outside of its parameter can be exploited through this technique. Such vulnerabilities could exist in Internet Explorer, Microsoft Office, or many other applications.

The most successful hackers would be those who find an unknown vulnerability and are sophisticated                                                                                  enough to mount such a complicated attack.

"We believe that in the future we will see more and more zero-day exploits using similar or more advanced techniques; we may need new mitigations in our OSs (operating systems) and security products to defeat them," Xiaobo Chen, senior security researcher for Fire Eye, said in the company's blog.

The most likely attackers would be those who are paid handsomely to steal sensitive documents from large organizations, defense contractors, and government agencies.

"It's definitely an advanced technique," Caselden said. "Most likely you would see it used in an APT (advanced persistent threat) or by a nation state."