2015年9月22日星期二

Quick post: ASLR in China

The recent XCodeGHost incident tells how insecure it is for Chinese software. Personally I've been long-time aware of the huge problem in Chinese software, but I was still surprised that even the core developers from software giants enjoy such a terrible hobby: downloading 3rd-party development tool (or using p2p-based downloading tool to download development tool) - what business secrets you can hold if you fail to protect your core development environment? IMO the security of Chinese-based software is still in the Stone Age - They have gone so far and are still running so quickly while (unfortunately) there is no serious security review/process taken in place.

Here I'd like to quickly go through the most obvious issue: ASLR. What I have chosen here are the most popular software used in China, I think each of them enjoys hundreds of millions –level users. As you will find, none of them fully enables ASLR in their processes. Even ASLR have been introduced by Microsoft since 2007 and has been proven an effective mitigation to stop exploits and it's quite easy for developers to enable it.

This is what I saw on the latest Tencent QQ 7.6.


And here you go Baidu YuanGuanJia (百度云管家) .


The previous two are relatively good, I’d guess they know ASLR but failed on some of the DLLs. However, the following Xunlei (Thunder, 迅雷) is pretty bad: look at the dlls they shipped, almost all of them are non-ASLR (including 3 main programs), have they even heard of ASLR?


The Alibaba’s AliWangWang (阿里旺旺) (their popular tool for online purchasing and chatting) is also not good.


In the security world, ASLR is now a baseline for software security or in any software development – even Microsoft has started to credit findings of non-ASLR issues in their software. In this quick post we showcased the most obvious non-ASLR ones in the most popular Chinese software, this could be considered as a side view reflecting how bad it is for China's software security. However, their problem is far more than this, hopefully I will be able to contribute more time on them and write something down.

Thanks,
Haifei

58 条评论:

  1. 回复
    1. Haifei'S Random Thoughts: Quick Post: Aslr In China >>>>> Download Now

      >>>>> Download Full

      Haifei'S Random Thoughts: Quick Post: Aslr In China >>>>> Download LINK

      >>>>> Download Now

      Haifei'S Random Thoughts: Quick Post: Aslr In China >>>>> Download Full

      >>>>> Download LINK Dr

      删除
  2. Outlook provides email services to send or read the message from mobile, desktop etc. Outlook is really nice and safe email service provider of Microsoft.

    回复删除
  3. This Blog appears to receive many visitors or customer who is looking for this type of blogs. I guess having something useful or substantial to give info on is the most important thing.

    If you are looking for apple support phone number then contact us on this number (+1)877-771-8477

    Thank You!!!

    回复删除
  4. Great thanks for sharing this blog. We provide Hotmail customer service for the user help. You can visit us for Hotmail account solution.

    回复删除
  5. Hotmail support team always ready for your help with this account. Any problem is always solved by them. Your help is our first motive and you can dial any time Hotmail customer support number 1-844-305-6556. We feel proud if we give you some solution.

    回复删除
  6. Victoria Hearts is a well-known dating site for loners looking to find a future wife/husband. If you want to learn more about this site read these victoria hearts reviews and users feedback.

    回复删除
  7. Thanks for sharing, nice post! Post really provice useful information!

    Công ty vận chuyển hàng nước ngoài FadoExpress hàng đầu chuyên vận chuyển, chuyển phát nhanh siêu tốc đi khắp thế giới, nổi bật là dịch vụ gửi hàng đi mỹ, gửi hàng đi úcgửi hàng đi đài loan và dịch vụ chuyển phát nhanh đi hàn quốc uy tín, giá rẻ

    回复删除
  8. Many Gmail users irritate when they are unable to recover the password of their Gmail account, yet to recover the password is quite simple to achieve. If you, in case, forgot Gmail password and want to recover your account with the new password, you must contact one of our Gmail experts immediately to get your account recovered on time.

    回复删除
  9. Yahoo mail is a popular email platform that allows its users to share messages with other users. However, some of its users are facing the ongoing issue of Yahoo mail not receiving emails into their account inbox. If you are unable to fix this issue on your own, call directly one of our Yahoo experts.

    回复删除
  10. Marketing is the core of any business and thus many of the students doing higher studies in marketing courses due to the high demands of it. Thus if you are also one of the students getting studies in marketing and need marketing segmentation assignment writing services then visit AllAssignmentHelp.co.uk as we have experts having complete marketing knowledge with all the marketing and segmentation concepts clear and recognize the needs of students very deeply.

    回复删除
  11. 24*7 Apple Technical Support is leading Apple support website where you get services provider of Apple remote tech support the USA for third party products and services. Contact Apple Support phone number +1-855-516-8225.

    Macbook Customer Service
    iTunes Customere service
    iPad Customer Service
    Apple Customer Service
    Technical Help Number
    iPhone Customer Service

    回复删除
  12. https://www.uttarakhandescort.com/
    Uttarakhand Escort Service | Uttarakhand Call Girls
    Get Escort Service in Uttarakhand at low price by Miss Kajal 000000000. Our escorts agency offers luxurious and beautiful Uttarakhand female model escorts
    Uttarakhand call girls, call girls in Uttarakhand, young girls, call girl Uttarakhand, escorts in Dehradun, escort service in dehradun, dehradun call girls, dehradun escort, escort in dehradun, dehradun escort service, hariyana escorts service, dehradun independent Escorts , dehradun escorts, escort service in dehradun, dehradun escorts agency.
    https://www.uttarakhandescort.com/hello-world/
    https://www.uttarakhandescort.com/interview-meet/
    https://www.uttarakhandescort.com/business-news/
    https://www.uttarakhandescort.com/coffee-time/
    https://www.uttarakhandescort.com/woman-meeting/
    https://www.uttarakhandescort.com/category/uncategorized/
    https://www.uttarakhandescort.com/category/relax/
    https://www.uttarakhandescort.com/category/meeting/
    https://www.uttarakhandescort.com/category/business/

    回复删除
  13. If you are looking for yahoo help page then you can simply visit our yahoo help website, our yahoo mail help page will not only resolve the problem but make sure to eradicate it permanently. Our site is one of the best site which provides instant yahoo mail help. you can contact us regarding any yahoo mail problems you are facing. for yahoo technical support or VISIT OUR WEBSITE

    回复删除
  14. This article is out of the roof. Wow! Wonderful. Great Post!
    https://www.aarinkaur.com/
    https://www.aarinkaur.com/Contact-Mumbai-Escorts-Aarin.html
    https://www.aarinkaur.com/Mumbai-Escorts-Rate-Card.html
    https://www.aarinkaur.com/Mumbai-Escorts-Location.html
    https://www.aarinkaur.com/Mumbai-Escorts-Location.html

    回复删除
  15. I am new here but they are offering exactly what I am looking for. I want an Economics assignment help. I am in the United States, and therefore, I don’t know whether they offer the service here. If you do, let me know how much it will cost me for Economics homework help. I am waiting for their response.

    回复删除
  16. My schedule is so tight and therefore I want someone to be a Matlab homework help solver who can help me complete my control systems assignment from time to time. I will be ready to give this Matlab assignment help
    expert the login details to my class so that I don’t have to check whether there are pending assignments. If there is an assignment you will just be emailing me the quotation of having the work done and then you complete it and submit it in the class portal.

    回复删除
  17. I'm very grateful for the free corrections that you did on my Excel assignment. The corrections we're demanding, so I thought that the company was going to ask for some amount to get them done. Luckily, I learned that they do corrections without charging clients, which is very generous of you. I've worked with several Statistics Assignment Help providers, and none of them ever offered to do me corrections without a tip. I highly recommend the Statistics Homework Help

    回复删除
  18. The Programming Homework Help expert that they gave me was honest and free. He went on and asked if I could extend the deadline for the best grades, which I did. Food for me, he delivered what he promised; the best grade. It was a straight "A!" What was good about this was the prices. I didn't have to break the bank for the "A" like any other assignment helper would want. This time around, I'll come back to try their tutoring services, too. For now, much thanks for the C++ Homework Help

    回复删除
  19. Do yourself a favor and order this company's Programming Homework Help services so that they smile all the way to success. That's what happened to me a few months ago when a friend recommended it to me. I'm honestly not very good at C despite attending its classes every week. When I resorted to the company'sC Homework Helpservices, I experienced immediate changes in my academic account.

    回复删除
  20. Their services seem perfect. The Statistics Assignment Help expert who completed my assignment was fast and ardent. He was also very communicative throughout the period he was undertaking the order. Moreover, he followed all my instructions to the letter. I used the Statistics Homework Help after a friend told me about it. He had used it before and was very successful. Thanks for the unmatched services and marks.

    回复删除
  21. I have sent them an email to the Matlab assignment help team. It just details my assignment requirements. I need a very good Matlab homework help tutor to be handling my numerical methods assignments. This is just the start because I just enrolled in a Matlab class. I, therefore, want someone who will be available and ready to deliver my work on time. If they have one very good Matlab expert then link me with them so that we can start the work immediately.

    回复删除
  22. I have tried hiring them on their website and the process of hiring is indeed quite simple. What has surprised me is that they have many Economics assignment help
    professors, so I was even confused about which one to choose. I have submitted all the requirements and made the payment. I hope that I will get good Economics homework help

    回复删除
  23. There can be various possible causes for Gmail's common errors and problems. It can be due to multiple issues like server problems, Internet problems, browser problems, etc. However, you can fix all your common Gmail problems by following few simple troubleshooting steps.

    回复删除
  24. The Programming Homework Help service providers don't need a lot from them to get the job done, not even a lot of cash. Their order placement process is concise and straightforward, and their Java Homework Help experts are very swift with emergency orders. I ordered in a few minutes and got back the solutions within the shortest time possible. I wholeheartedly recommend this service to other budding programmers like me.

    回复删除
  25. My online research for the best website that provides top-ranking Statistics Assignment Help has settled on statisticshomeworkhelper.com. Despite a few negative reviews, I was convinced that it's the best Statistics Homework Help provider that I should work with. After my first order, I proved that my research results were accurate. I've been using the service for three semesters now, and this is one of the experts that has helped me get my order done. I appreciate it.

    回复删除
  26. I've discovered that they're fully reliable with all Matlab assignments. I passed my test! I wanted an expert that could help me score the best marks in my class, and one of Matlab Assignment Help experts with a Master's Degree in Software Engineering did it! He even exceeded my expectations by getting almost everything right. I'll use him for all my remaining Matlab Homework Help.

    回复删除
  27. This is the only Economics Assignment Help service website that I've seen with real experts' profiles that reflect true qualifications and experience. The other ones only show off fake high qualifications to lure unsuspecting clients into their fraud scheme. I received stellar-grade solutions that earned me a round of applause from my classmates and lecturer alike. Meanwhile, thank you for their fast service and overall professional treatment. I'll indubitably come again for your unmatched Economics Homework Help.

    回复删除
  28. The company's good-grade guarantee makes me feel satisfied and relaxed. Indeed, they go out of the way to deliver the best Programming Homework Help grades. I got the best of their Python Programming assignments. My grades shocked everyone in my class, including the lecturer, who praised the way the solutions were arranged in a genius way. Asking for a hand in Python Homework Help up to the end of my course will always make me the best student, and that's what I must do.

    回复删除
  29. I didn't understand why the customer service officials awarded my order to a rookie R programmer. The lady was fast but not accurate. She didn't fail but got me only 51 marks. I don't want to complain a lot because this is the first time you've done this to me. However, I must let Statistics Homework Help know that I'll choose my favorite R Homework Help expert next time. Meanwhile, thanks for the assistance.

    回复删除
  30. I needed a flawless paper but the one Matlab Homework Help sent needed a bit of fixing. What made me forget the mistakes was the score I managed; it was 91%! Thanks a lot and please keep the Matlab Assignment Help expert that worked on this assignment for me. Each time, I'll go for her help so that I keep scoring top grades.

    回复删除
  31. I tried to find all the things that indicate an untrustworthy assignment help website on this platform in vain. Then, I decided to try out their Economics Homework Help to see if it could turn out great. Guess what? It was great, and I have every reason to praise the organization so that its Economics Assignment Help services can reach more students. Thanks a lot, anyway.

    回复删除
  32. Thanks for sharing this type of information. I am hunting for this information and find the key aspect of this work effective and trustworthy for a valuable answer. Being a USA scholar, I am always in the search of Online Assignment Help USA for a better answer. So, you do not lose passion and do the mandatory change in its work. our service is available to you at the most reasonable. Do not stress anymore and take our help.

    回复删除
  33. It is good to hear that your store is now expanding to new locations. I have been a patron of Fantastic Eyes because of all the wonderful work that you guys do. marketing assignment uk I hope that this expansion move of yours will turn out to be successful. I will definitely go and see this new store of yours

    回复删除
  34. Ignou Synopsis is a private firm that deals in Ignou projects. We offer Ignou PGDPPED Project to all the students of Ignou university. PGDPPED is a post-graduation Pre-Primary Education course important for each and every student. If you are looking for help in composing projects then you can completely depend on us. We offer the best assignments as well as Ignou PGDUPDL Project support. We have been in this industry for more than 10 years.

    回复删除
  35. As there are several websites offering help services to students worldwide who can offer you similar samples as well they have even done for their various clients within in your country. These online assignmnet helper providers also offer you the various guideline and templates that may guide you in doing your homework comfortably.

    回复删除

  36. Nice Blog for Qatar Student. It may take some time at first but then you can enjoy the services of the best agency throughout the year. Great Assignment Help provides the best service for other company.

    回复删除
  37. Great Nice post keep writing. What should be included while doing language analysis, here are the point conclusion or final words are the same so you can analyze language only on one condition is that first, you must know basic core knowledge of that language. You have information on its numerous aspects, different characteristics, and its techniques too. And take a look at my blog post.

    回复删除
  38. Vi blev fortalt om buffeten samt hvad den indeholdt, som vi endte med at vælge. indisk mad frederiksberg Buffeten bestod af 2 velsmagende forretter, samt hele 9 forskellige hovedretter, med både vegansk, stærkt og mildt. Maden var noget af det bedste indiske mad jeg har smagt i Danmark. Kan helt klart anbefales.

    回复删除


  39. We are assisting thousands of businesses to provide inspirational Custom boxes custom packaging. An array of add on and finishing options are available to make your custom boxes worth noticing. customboxesbulk.com is an ardent supporter of green sustainable packaging; all our boxes are made from 100% recyclable materials.

    回复删除
  40. Thanks for sharing this best stuff with us! Keep sharing! I am new in the blog writing. All types blogs and posts are not helpful for the readers. Here the author is giving good thoughts and suggestions to each and every reader through this article. Quality of the content is the main element assignment writing companies of the blog and this is the way of writing and presenting.

    回复删除
  41. Assignment help services in Australia help students to complete their assignments within a given timeframe. Your writing skills will gradually improve if you follow and apply the expert's style in your assignment writing. You should practice regularly in order to improve them.



    回复删除
  42. This is a good idea for people who actually have some questions or inquiries about this topic. I am so excited to see the discussions that will be made on this thread regarding taxes. I have to say that this kind of topic should really be discussed thoroughly to people who finds it helpful so that help with assignment crux there won't be no confusions anymore.

    回复删除
  43. Once we receive the information about your packaging needs, t boxes the customer representative will specifically call you and share the potential quote.

    What Is the Turnaround Time for Placed an Order? To begin with, t boxes the turnaround time differs for every project because it depends on the number of boxes you’ve ordered and your unique needs.

    回复删除
  44. I believe this will help your website become more organized because you have decided to set a part on this site for the inquiries regarding tax and as well as the helpful discussions. To be honest, this is one of the few sites that are doing this kind of strategy. Also, I think that this will not only benefit your clients or the potential ones but you most especially write my dissertation because you will be able to see the questions easier.

    回复删除
  45. Thanks for the lovely health benefit you bring to the viewers. Its cool and supper knowledgeable. I appreciate your so much for sharing this inspiring piece. Meanwhile, visit past questions for waec english pdf

    回复删除
  46. Haifei'S Random Thoughts: Quick Post: Aslr In China >>>>> Download Now

    >>>>> Download Full

    Haifei'S Random Thoughts: Quick Post: Aslr In China >>>>> Download LINK

    >>>>> Download Now

    Haifei'S Random Thoughts: Quick Post: Aslr In China >>>>> Download Full

    >>>>> Download LINK Zn

    回复删除
  47. Quality tips on how to write a poetry analysis essay are waiting for you here! Welcome to a professional website with various writing services to get online in a very short time!

    回复删除