Security Makers Use Adobe Avoiding Attacks on Windows PCs
By Luciana on February 8, 2010 | Vulnerabilities, Security, Adobe, Attact, Computer, Windows, researcher
Recent examples show that researchers failed and have serious issues by making sure the security of Internet Explorer from the attackers. The latest versions of IE seemed to be vulnerable because the attackers demonstrated they can make and use a hole for their own malicious interests.
For that reason researchers tried to use the weakness in Adobe Systems' Flash Player and created two separate attacks that bypass mitigation Microsoft put into IE 7 and 8. Called as ASLR, or address space layout randomization, and DEP, or data execution prevention, the technologies are devised to make troubles for bugs by causing the execution of malicious code.
The main goal of those techniques is to use the so called just-in-time compiler in Flash so that a PC's memory would be blanketed with many chunks of identical shell-code. The "JIT-spray" lets attackers to overcome ASLR.
"With this JIT-spray, it works fairly reliably, so at least nine out of 10 times you'll guess the right position," said researcher Dionysus Blazakis at the Black Hat security conference in Washington, DC.
An attempts to attack IE 8 was quite useless because ASLR and DEP was some of the only defenses preventing crucial exploits of bugs overflow in software running on Windows computers.
With a help by JIT-spraying, Blazakis was able to avoid a cause IE 8 to open the Windows calculator. It was an argument that he could use Adobe bug to kill code by himself.
What is more, it is not the first time attackers trying to threat for Microsoft software by making an attempt to bypass the memory protections. After a so called heap spraying technique was on the board Microsoft added protections to thwart it in IE 8. This time it is not clear at all that Microsoft will be able to avoid the newfangled attacks so easily.
More Vulnerabilities news
Adobe Reader PDF patches the flaw disclosed at Black Hat
As the hole in an Adobe’s Reader was disclosed at the conference of Black Hat security conference, Adobe patched the flaw at last. Today Adobe released security update to patch the hole. At July's Black Hat event in Las Vegas, Charlie Miller found out about the vulnerability where he told about how the open-source BitBlaze toolkit could boost bug-hunting productivity. He also added that the bug was in Reader's and Acrobat's font parsing. Read more.- iPhone OS is not bulletproof
- All your base are belong to us: how to protect your router from DNS rebinding
- Same Skype Vulnerability is Used Again
- Competition Among Browsers: Keep the System Secure
- Apple Released Safari Update
- A Bug Found in OpenSSL
- Google Engineer Disclosed Window's DEP Flaw
- Be Careful With F1!
- Top 10 TLDs Used by Botnets For CnC
- Mistakes to Avoid on Social Networks
