The recent XCodeGHost incident tells how insecure it is for Chinese software. Personally I've been long-time aware of the huge problem in Chinese software, but I was still surprised that even the core developers from software giants enjoy such a terrible hobby: downloading 3rd-party development tool (or using p2p-based downloading tool to download development tool) - what business secrets you can hold if you fail to protect your core development environment? IMO the security of Chinese-based software is still in the Stone Age - They have gone so far and are still running so quickly while (unfortunately) there is no serious security review/process taken in place.
Here I'd like to quickly go through the most obvious issue: ASLR. What I have chosen here are the most popular software used in China, I think each of them enjoys hundreds of millions –level users. As you will find, none of them fully enables ASLR in their processes. Even ASLR have been introduced by Microsoft since 2007 and has been proven an effective mitigation to stop exploits and it's quite easy for developers to enable it.
This is what I saw on the latest Tencent QQ 7.6.

Here I'd like to quickly go through the most obvious issue: ASLR. What I have chosen here are the most popular software used in China, I think each of them enjoys hundreds of millions –level users. As you will find, none of them fully enables ASLR in their processes. Even ASLR have been introduced by Microsoft since 2007 and has been proven an effective mitigation to stop exploits and it's quite easy for developers to enable it.
This is what I saw on the latest Tencent QQ 7.6.

The previous two are relatively good, I’d guess they know ASLR but failed on some of the DLLs. However, the following Xunlei (Thunder, 迅雷) is pretty bad: look at the dlls they shipped, almost all of them are non-ASLR (including 3 main programs), have they even heard of ASLR?


The Alibaba’s AliWangWang (阿里旺旺) (their popular tool for online purchasing and chatting) is also not good.


In the security world, ASLR is now a baseline for software security or in any software development – even Microsoft has started to credit findings of non-ASLR issues in their software. In this quick post we showcased the most obvious non-ASLR ones in the most popular Chinese software, this could be considered as a side view reflecting how bad it is for China's software security. However, their problem is far more than this, hopefully I will be able to contribute more time on them and write something down.
Thanks,
Haifei
Haifei
回复删除I am so grateful for your article.
Dell Notebook repairs & Hp Notebook repairs & HP Laptop repairs
Great post so thanks for this.
回复删除Internet explorer customer service
Email support service is available 24x7. Contact Email Toll-Free number + 1855-558-1999 and get help quickly. If you have any queries related to Email account or you are unable to login. Our technical team contacts to you and resolve your issue in a minimal time.
回复删除Gmail tech support number
Gmail Toll-Free number
Gmail help support number
Gmail customer Service Number
Gmail customer care phone number
Yahoo email password reset
Yahoo email password recovery tool
Yahoo mail customer service number
Yahoo mail help support number
Yahoo mail customer Support Number
Outlook password reset
Outlook password Recovery tool
Outlook customer Service Number
Outlook customer Support Number
Outlook Toll-free Number
Outlook provides email services to send or read the message from mobile, desktop etc. Outlook is really nice and safe email service provider of Microsoft.
回复删除This Blog appears to receive many visitors or customer who is looking for this type of blogs. I guess having something useful or substantial to give info on is the most important thing.
回复删除If you are looking for apple support phone number then contact us on this number (+1)877-771-8477
Thank You!!!
All these are for apple technical support queries given below
回复删除apple store phone number
call apple support number
call apple support
apple support iphone
apple support phone number usa
apple support number usa
apple support phone
apple phone support
contact apple support phone number
contact apple phone number
apple support contact number
apple contact number
apple help phone number
apple help number
apple phone number
apple tech support phone number
apple tech support number
apple tech support
apple customer service phone number
apple customer service number
apple customer service
apple customer support phone number
apple customer support number
apple customer support
apple technical support phone number
apple technical support number
apple technical support
apple support phone number
apple support number
Great thanks for sharing this blog. We provide Hotmail customer service for the user help. You can visit us for Hotmail account solution.
回复删除Hotmail support team always ready for your help with this account. Any problem is always solved by them. Your help is our first motive and you can dial any time Hotmail customer support number 1-844-305-6556. We feel proud if we give you some solution.
回复删除Victoria Hearts is a well-known dating site for loners looking to find a future wife/husband. If you want to learn more about this site read these victoria hearts reviews and users feedback.
回复删除SEO Company in Almora.
回复删除Digital Marketing Service Almora Uttarakhand.
Website Promotion Company Almora uttarakhand.
PPC Service in ALmora Uttarakhand
Thanks for sharing, nice post! Post really provice useful information!
回复删除Công ty vận chuyển hàng nước ngoài FadoExpress hàng đầu chuyên vận chuyển, chuyển phát nhanh siêu tốc đi khắp thế giới, nổi bật là dịch vụ gửi hàng đi mỹ, gửi hàng đi úc và gửi hàng đi đài loan và dịch vụ chuyển phát nhanh đi hàn quốc uy tín, giá rẻ
Many Gmail users irritate when they are unable to recover the password of their Gmail account, yet to recover the password is quite simple to achieve. If you, in case, forgot Gmail password and want to recover your account with the new password, you must contact one of our Gmail experts immediately to get your account recovered on time.
回复删除Yahoo mail is a popular email platform that allows its users to share messages with other users. However, some of its users are facing the ongoing issue of Yahoo mail not receiving emails into their account inbox. If you are unable to fix this issue on your own, call directly one of our Yahoo experts.
回复删除Marketing is the core of any business and thus many of the students doing higher studies in marketing courses due to the high demands of it. Thus if you are also one of the students getting studies in marketing and need marketing segmentation assignment writing services then visit AllAssignmentHelp.co.uk as we have experts having complete marketing knowledge with all the marketing and segmentation concepts clear and recognize the needs of students very deeply.
回复删除24*7 Apple Technical Support is leading Apple support website where you get services provider of Apple remote tech support the USA for third party products and services. Contact Apple Support phone number +1-855-516-8225.
回复删除Macbook Customer Service
iTunes Customere service
iPad Customer Service
Apple Customer Service
Technical Help Number
iPhone Customer Service
https://www.uttarakhandescort.com/
回复删除Uttarakhand Escort Service | Uttarakhand Call Girls
Get Escort Service in Uttarakhand at low price by Miss Kajal 000000000. Our escorts agency offers luxurious and beautiful Uttarakhand female model escorts
Uttarakhand call girls, call girls in Uttarakhand, young girls, call girl Uttarakhand, escorts in Dehradun, escort service in dehradun, dehradun call girls, dehradun escort, escort in dehradun, dehradun escort service, hariyana escorts service, dehradun independent Escorts , dehradun escorts, escort service in dehradun, dehradun escorts agency.
https://www.uttarakhandescort.com/hello-world/
https://www.uttarakhandescort.com/interview-meet/
https://www.uttarakhandescort.com/business-news/
https://www.uttarakhandescort.com/coffee-time/
https://www.uttarakhandescort.com/woman-meeting/
https://www.uttarakhandescort.com/category/uncategorized/
https://www.uttarakhandescort.com/category/relax/
https://www.uttarakhandescort.com/category/meeting/
https://www.uttarakhandescort.com/category/business/
If you are looking for yahoo help page then you can simply visit our yahoo help website, our yahoo mail help page will not only resolve the problem but make sure to eradicate it permanently. Our site is one of the best site which provides instant yahoo mail help. you can contact us regarding any yahoo mail problems you are facing. for yahoo technical support or VISIT OUR WEBSITE
回复删除
回复删除outlook set folders cannot be opened
outlook information store could not be opened
cannot start microsoft office outlook
cannot start microsoft office outlook error
outlook set folders cannot be opened
if you want to fix all the issue i have mention blow, you can click and solveyourissue
回复删除suddenlink email settings for outlook
reset icloud email password
yahoo mail not receiving emails
cancel icloud membership
outlook not connect to server