New attack techniques have proven capable of penetrating the state of the art in Windows systemic defenses, specifically DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization). A demonstration was made today at BlackHat in DC and one firm has released a proof of concept to their customers.

Attacks against ASLR and DEP individually have been around for some time, but the two have tended to reinforce each other; a bypass of DEP is usually blocked by ASLR, and a bypass of ASLR is usually blocked by DEP. The new technique works on systems with both defenses in place. DEP has been supported in Windows since Windows XP SP2, although not turned on by default. ASLR was introduced in Windows Vista. In both cases the program or the user has to opt-in to use the feature. Many modern versions of program, like IE8, Acrobat and Flash all opt-in.

The attack is a "JIT Spray," the details of which may have been released at Black Hat today, but they aren't documented well yet. DEP stops attackers from writing executable code to the heap and running it because the heap is marked as non-executable. JIT spraying solves this by spraying pages which are marked as executable.

We first heard of the exploit a few days ago when Dave Aitel of Immunity Inc. revealed on Twitter that they had released a JIT Spray + Aurora demo to their customers that works on IE8 and Windows 7, but we've been hearing for some time that many groups were working on it.

The demo at BlackHat was in a presentation by Dionysus Blazakis (Dion) of Semantiscope. A YouTube video of the exploit can be found here (it's also embedded below—jack up the volume for the full effect). It's somehow unsurprising, but the demo of the attack involves Adobe's Flash. Dion had previously done research into how Flash works, including the fact that it has an embedded virtual machine and a JIT (Just-In-Time compiler) for that VM. JITs originated with Java (and don't be surprised if this technique moves on to Java eventually, although perhaps there are defenses against it).

VMs like Java and Flash take virtual instructions and translate them dynamically execute the appropriate native machine instructions. Large performance advantages can be had by compiling sections of the virtual instructions into executable code and running that code, rather than interpreting them on a one-by-one basis. This is what a JIT does. JITs therefore have to dynamically write code to areas of memory, mark those areas as executable and then execute them. I'm not sure exactly how they're doing it, but Dion may be tricking the Flash VM into generating the attack code (which, in this case, is the standard Windows proof of concept of running CALC.EXE).

There are more details about this in Dion's presentation slides, but they are drenched in sarcasm and allegory. Soon an easier-to-read version should be available.

Aitel's limited writings about Immunity's exploit are harder to follow, but it may not involve Flash. I don't see off-hand how you would do a JIT spray without a JIT, but Aitel has written that the technique should be more generally applicable.

Research like this is always good in the big picture, but in the short term it's rather bad in that it means that the best defenses we have may soon be inadequate. Once again, other platforms are far from immune, and in fact ASLR is only barely available on the Mac. Attackers seeking to exploit non-Windows platforms generally have an easier time of it. The answer is hard to see; perhaps some sort of IPS (Intrusion Prevention Service) for the JIT.