Hacker News Reader

Comment by ghughes | Hacker News Reader

Browser engines are common venues for ROP attacks. ASLR is absolutely intended to provide protection in that context.

ASLR is a mitigation for ROP given certain constraints - the ability to arbitrarily execute code, allocate memory, would break those constraints. This is true of any mitigation technique, there are capabilities an attacker can have that will make it less relevant or irrelevant.

ASLR is still totally viable for defending against an attacker who can not already execute arbitrary code. This article makes it sound like ASLR has been completely defeated, but it's only defeated in a context where the attacker has significant control - even if that's a likely scenario.

You've contradicted yourself. You initially said:

> Nothing about this attack is going to impact the effectiveness of ASLR in the cases it was designed for.

Then you said:

> This article makes it sound like ASLR has been completely defeated, but it's only defeated in a context where the attacker has significant control - even if that's a likely scenario.

That is indeed a highly likely scenario, so it's simply wrong to say "nothing about this attack is going to impact the effectiveness of ASLR".

Not really seeing the contradiction. ASLR is still effective where it was always intended to be effective. ASLR is ineffective given an attacker with more control than ASLR was designed to be useful against.

Reply on news.ycombinator.com