often, what buffer overflows are detected, a payload file containing the correct conditions to cause the overflow, and inject the correct machine code into memory are generated.
this payload has to be carefully crafted to cause the correct jump to the correct address.
the problem is, especially with closed source applications, is that every porgram is the same, (same exe for the same porgram version)
so why not run an application similar to pre-link to make each rpograms internal structure slightyl different?
a vunerable software version would still be vunerable, but no 2 computers could be hacked using the same payload, and an attempts o use an incorrectly crafted buffer overflow payload would hopefully crash the server (which is better than getting hacked, and forces the admins to apply the updates / patches)
i stared thinking about this after reading the man page of prelink.
QUOTE
DESCRIPTION
prelink is a program which modifies ELF shared libraries and ELF dynamically linked binaries, so that
the time which dynamic linker needs for their relocation at startup significantly decreases and also
due to fewer relocations the run-time memory consumption decreases too (especially number of unshare-
able pages). Such prelinking information is only used if all its dependant libraries have not changed
since prelinking, otherwise programs are relocated normally.
prelink is a program which modifies ELF shared libraries and ELF dynamically linked binaries, so that
the time which dynamic linker needs for their relocation at startup significantly decreases and also
due to fewer relocations the run-time memory consumption decreases too (especially number of unshare-
able pages). Such prelinking information is only used if all its dependant libraries have not changed
since prelinking, otherwise programs are relocated normally.
QUOTE
OPTIONS:
-R --random
When assigning addresses to libraries, start with random address within architecture dependant
virtual address space range. This can make some buffer overflow attacks slightly harder to
exploit, because libraries are not present on the same addresses accross different machines.
Normally, assigning virtual addresses starts at the bottom of architecture dependant range.
-R --random
When assigning addresses to libraries, start with random address within architecture dependant
virtual address space range. This can make some buffer overflow attacks slightly harder to
exploit, because libraries are not present on the same addresses accross different machines.
Normally, assigning virtual addresses starts at the bottom of architecture dependant range.
this may be useless to manual hacks, but againsed automated virii, this could be a powerfull tool in slowing the damage, and lowering the body count.
Okay, you would first need to port it to win32, but the idea is there.
