Security software can reduce effectiveness of DEP/ASLR

[Hungry Man]

http://www.scriptjunkie.us/2011/06/bypassing-dep-aslr-in-browser-exploits-with-mcafee-symantec/

Vanilla Firefox doesn’t seem to be missing ASLR/DEP protection; the process will have DEP enabled and neither firefox.exe nor the DLL’s seem to be missing ASLR. Headache for an exploit writer. However, many typical users and organizations will install a security suite from typical antivirus vendors like McAfee and Symantec.

I obtained an evaluation copy of McAfee’s premier product, their “Ultimate” “Total Protection” to test out and installed it on a Vista VM.

McAfee injected no fewer than seven DLL’s into Firefox, and no fewer than seven fail to enable ASLR. The attacker is provided megabytes of surface to launch an exploit off of.

It is easy for an attacker to detect if the McAfee extension has been loaded into the browser by referencing a resource in the extension.

In summary, McAfee’s security suite opens a hole through the best defenses of Microsoft and Mozilla against exploitation

 

[Deleted member 178]

everybody here knows that McAfee is a bad product, but not organizations, schools or companies...

 

[Ink]

Umbrapolaris, I think you missed a bit...

Wow. McAfee’s product set the standard for fail, and Symantec just doubled it. It injected thirteen DLL’s into Firefox, and once again, they all fail to enable ASLR. The attacker even more surface to launch an exploit off of.

It would be interesting to see how other vendors would have affected the browser.

Am I correct in saying, if security software(s) didn't add/modify the web browser, it would be less exploitable?

 

[Hungry Man]

I think it's important to note that these security products were merely two of the ones installed. MANY security products do this, lots of them inject .dll's. EMET is an example.

Literally every Windows security application increases the attack surface of the computer, the big products (suites) tend to use tons of gimmicky features that actually make the operating system inherently less secure.

 

[jamescv7]

Surely some vendors will perform more worst performance and other may not of DEP/ASLR.

 

[Hungry Man]

Some may and some may not. I think it's just this issue that security suites have where they add superfluous features in an attempt to make the user feel more secure.