内存随机化作为应用程序安全增强？
我最近看到一篇 Microsoft 文章，其中宣传了 Windows 7 的新“防御增强功能”。具体来说：
- 地址空间布局随机化 (ASLR)
- 堆随机化
- 堆栈随机化
文章接着说“......其中一些防御位于核心”操作系统和 Microsoft Visual C++ 编译器提供了其他策略”，但没有解释这些策略实际上如何提高安全性。
有人知道为什么内存随机化会提高安全性（如果有的话）吗？其他平台和编译器是否采用类似的策略？
I recently came upon a Microsoft article that touted new "defensive enhancements" of Windows 7. Specifically:
- Address space layout randomization (ASLR)
- Heap randomization
- Stack randomization
The article went on to say that "...some of these defenses are in the core operating system, and the Microsoft Visual C++ compiler offers others" but didn't explain how these strategies would actually increase security.
Anyone know why memory randomization increases security, if at all? Do other platforms and compilers employ similar strategies?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
它使预测某些内容在内存中的位置变得困难，从而提高了安全性。相当多的缓冲区溢出漏洞利用（例如）将已知例程的地址放入堆栈，然后返回它。在不知道相关例程的地址的情况下，做到这一点要困难得多。
据我所知，OpenBSD 是第一个做到这一点的，至少在相当知名的 PC 操作系统中是这样。
It increases security by making it hard to predict where something will be in memory. Quite a few buffer overflow exploits work by putting (for example) the address of a known routine on the stack, and then returning to it. It's much harder to do that without knowing the address of the relevant routine.
As far as I know, OpenBSD was about the first to do this, at least among the reasonably well-known OSes for PCs.
它使诸如返回到libc（或返回到用户提供的数据缓冲区对于后两种情况）要困难得多。是的，它可以在 Linux、BSD 和 Mac OS 中使用。正如您所期望的，详细信息因操作系统而异。请参阅 Wikipedia 了解简介。
It makes attacks like return to libc (or return to user-provided data buffer in the case of the latter two) much harder. And yes, it is available in Linux, BSD, and Mac OS. As you would expect, the details vary by OS. See Wikipedia for an introduction.
通过随机化堆栈，您可以使像 Aleph One 的 Smashing the Stack for Fun Profit 这样的普通缓冲区溢出攻击变得不可能。原因是因为攻击依赖于将少量名为 shellcode 的可执行代码放入内存中可预测的位置。函数堆栈帧已损坏，其返回地址被攻击者选择的值覆盖。当损坏的函数返回时，执行流程将转移到攻击者的 shellcode。传统上，该内存地址是可预测的，因此在运行相同版本软件的所有机器上它都是相同的。
尽管 Windows 7 上实现了高级内存保护，但远程代码执行仍然是可能的。最近，CanSecWest 的一台运行 Windows 7 和 IE 8 的机器在几秒钟内就被黑客入侵。以下是利用悬空指针进行现代内存损坏攻击的技术描述与堆溢出结合在一起。
By randomizing the stack you make vanilla buffer overflow attacks like Aleph One's Smashing the Stack for Fun Profit impossible. The reason why is because the attack is relying on placeing a small ammount of executable code calld shellcode into a predictable location in memory. The function stack frame is corrupted and its return address overwritten with a value that the attacker chooses. When the corrupted function returns the the flow of execution moves to attacker's shellcode. Traditionally this memory address is so predictable that it would be identical on all machines that are running the same version of the software.
Despite advanced memory protection implemented on Windows 7 remote code execution is still possible. Recently at CanSecWest a machine running Windows 7 and IE 8 was hacked within seconds. Here is a technical description of a modern memory corruption attack utilizing a dangling pointer in conjunction with a heap overflow.