How else does Windows protect its users.
The first mechanism is a cell or the ASML or mechanism is designed to prevent buffer overflow attacks
in particular automated buffer overflow attacks in the future we will speak in more detail about these
attacks.
For now let's remember that in order to carry out an attack of this type the specified library need
be found in the memory.
We need to know which address in the operating memory a certain library is allocated.
We need to know how it works and how it's built to hinder such automation.
Newer Windows systems every time they're launched load the system libraries in a different area of the
memory cells with addresses from 1 to 255 or chosen at random exploits have a one in two hundred and
fifty five chance that this will work.
We can trace such an operation in Process Explorer in a moment.
We will have the opportunity to see it.
Unfortunately the cell or mechanism is not mandatory
system libraries are covered but programs are not covered.
Protection of programs in this way is the decision of the user.
In the past in order for programs to be protected by SLR and other mechanisms such as DGP which we'll
talk about in a moment.
It was necessary to set the corresponding bit in the header of a given program.
It was necessary to have access to the source code or open the file in a hex editor and manually edit
the appropriate bits.
Not many users or administrators wanted to do this.
The solution came again from Microsoft.
We have a tool that allows enabling this protection also for programs that do not require it without
any interference in their privileges.
In a moment we'll see this this tool is called the Enhanced mitigation experienced toolkit or emet.
Let's talk for a moment longer about the DP mechanism.
This is another way to defend against the same threat
E.P. is available on 32 bit platforms.
As long as the hardware supports the mechanism that is if the processor is compatible with a solution
in the case of companies HMD and Intel these solutions are called differently.
But their task is the same.
The point is that in contemporary PC architecture there is no dedicated storage area for data or a memory
area for code.
There is one ram virtual address space memory
what's in it depends on the program which allocated it.
It could be such that when overriding return code from a function call.
Again we're dealing with buffer overflow attacks.
The attacker tries to execute code that's placed in a data area for example by passing it as a parameter
invoking some program function.
The point is that somehow from the outside the manner in which the program runs can be changed without
changing its code the DP function means some areas of memory are data only the attempt to execute code
contained in such a designated memory area results in an error.
The program is automatically stopped by Windows at least in theory because lately there's been increasing
talk that in the case of Intel processors the low level of security was overcome.
And programs are forced to execute code labeled as data only.
Let's see then how Astle are and DGP work and how they protect third party software using the emet program.
Well take a look at only part of the first
run Process Explorer as a privileged process.
Then select the Explorer process and in the bottom window display the library
this way you will see what libraries are used by the Explorer X-C process.
These are shared libraries or shared data areas.
We can see among other things at which address each library is loaded.
We're particularly interested in the NTD library.
This is a kernel system loader.
The library will begin the boot process when we switch to graphics mode.
It means that NTD L-L just launched.
If we have the ACL or a mechanism enabled then after restarting the library the address must be different
with a chance of 1 to 255.
Now let's look at the DP protection displaying the computer's advanced properties we can accidentally
click on the Settings button in the performance section.
In fact DP has nothing to do with performance.
It may only sometimes slow the computer going to these settings.
It appears that data execution prevention is termed done but only for the operating system.
The programs are not protected by IP.
We protect this code fragment which is Anyway's most likely resistant to attack because it is thoroughly
checked in the Microsoft corporation's trustworthy computing group initiative that we mentioned earlier
in order to change this.
We need to select a second option from now all programs are protected by DGP.
If a program does not work because it happens to invoke a code fragment such as ISAPI libraries which
are located in the area of memory that cannot be invoked we should configure the settings as seen above.
This is the default configuration of the server system.
There is no reason not to change it for the client systems as well.
What do we do if we've inherited a program which has been operating in our company for 10 or 15 years.
Its author is completely unknown.
The code was lost long ago with its creator and for some reason we still need to use it.
The best thing we can do is use the enhanced mitigation experience toolkit in order to give the program
some additional security.
Now we'll see how easy it is to use the emet tool.
It allows us to configure the system such as change the DP option which we saw earlier in the system
properties.
These are global options.
We already talked about DTP We also talked about s.l are what in the program.
There's one more option which is called See.
Here it deals with the type of buffer overflow attack that is structured exception handling
if a function reports an error the code handling this exception is in a different area of the memory.
Another possibility is that it reports an exception caused by another code fragment we're dealing with
the hierarchy of a structured exception handler the attacker tends to take advantage of this mechanism
in such a way that the function that handles the air at the end of the action does not return control
to the function that caused the error.
But another memory address is indicated.
This will be a memory address where the attacker probably already managed to place his own code.
We can easily see how that mechanism to protect us from such attacks this mechanism works quite simply
it saves the last address on a list of an exception handling function.
Now when an error handling finishes and the program execution control returns to the main program C-cup
checks to see if it went outside the stored address.
If so it immediately stops the program
in the emet program.
We see a list of certain processes and whether or not they're protected by DP What can we do to protect
an additional program.
We clicked the configure apps button and we indicate a program that we'd like to protect suppose that
we'd like to protect a program from the CIS internal suits series let's select here to proceed XP program
for Prossy XP.
We can enforce IP protection or see what protection we can also enable SLR and additionally protect
the program from the type of attack characteristic for Internet Explorer called heaps brai in a heap
spray attack the attacker tries to multiply as code fragment which is injected for example as a parameter
invoking a function.
The more copies of the attackers many program that are placed on the heat the greater the chance that
when it later overwrites the return address it will indicate its own code to execute
spray allocates memory on the heap for the program in advance and makes sure that jumps in specific
addresses are controlled.
Therefore the question is raised.
How can SLR be forced for a program that it does not support the program always wants to load at the
same address.
That e-mail program allocates memory for a program that we indicate then it makes it available of course.
Emet supports SLR.
So each time a given application starts in our case Prossy XP it will load it under a different operating
memory address.
This actually ends our protection
after running process explorer.
We see it in the emet program
the IP protection is enabled for our process and it is virtualise and protected by emet according to
the options we previously set.
The same application that was previously susceptible to buffer overflow attacks is now resistant to
these attacks without changing even a single line of code.