Windows 10: Should I enable "Force randomization for images mandatory ASLR"?

jaygourley · Nov 18, 2020

I just deployed a Lenovo M90n. Windows self-installed with the "Force randomization for images mandatory ASLR" disabled. That suggests someone smarter than me thought there was some problem with enabling the setting by default. Can someone explain why that security setting should or should not be enabled? On the surface, it sounds like risk-free good idea to enable it. So I assume there's more involved.

:)

advsrch · Nov 18, 2020

ASLR in GPU-Z

Hello,

Is there a reason why GPU-Z does not use ASLR (Address Space Layout Randomization, Address space layout randomization - Wikipedia ) ? When I force its use thorugh group policy, everything appears to be working fine.

Brink · Nov 18, 2020

Key Windows 10 defense is 'worthless' and dates back to Windows 8

Tweet

— Twitter API (@user) View on Twitter
Click to expand...

Microsoft has been telling users to upgrade to Windows 10 because of its superior in-built defenses against attacks, compared with Windows 7. That advice would be true if it properly implemented the defense known as Address Space Layout Randomization (ASLR).

ASLR is used by Android, Windows, Linux, iOS and macOS to prevent attacks that rely on code executing at predictable memory locations by loading programs at random addresses.

It's been used by Microsoft since Windows Vista to counter memory-based attacks. However, Microsoft introduced an error in Windows 8 when implementing a feature known as Force ASLR or system-wide mandatory ASLR.

This feature is meant to randomize executables even if an application hasn't enabled support for ASLR. It can be switched on through Microsoft's Enhanced Mitigation Experience Toolkit (EMET). As of the Windows 10 Fall Creators Update, EMET became part of Windows Defender Exploit Guard (WDEG).

But as Will Dormann of Carnegie Mellon University's CERT/CC discovered, enabling system-wide ASLR in Windows 8 and newer only does half the job it's meant to, resulting in programs being relocated but to the same address every time.

"Starting with Windows 8.0, system-wide mandatory ASLR (enabled via EMET) has zero entropy, essentially making it worthless. Windows Defender Exploit Guard for Windows 10 is in the same boat," Dormann wrote on Twitter...
Click to expand...

Read more: Key Windows 10 defense is 'worthless' and bug dates back to Windows 8 | ZDNet

See also: Clarifying the behavior of mandatory ASLR - Defense

Brink · Nov 18, 2020

Key Windows 10 defense is 'worthless' and dates back to Windows 8

Tweet

— Twitter API (@user) View on Twiiter[/quote]

Microsoft has been telling users to upgrade to Windows 10 because of its superior in-built defenses against attacks, compared with Windows 7. That advice would be true if it properly implemented the defense known as Address Space Layout Randomization (ASLR).

ASLR is used by Android, Windows, Linux, iOS and macOS to prevent attacks that rely on code executing at predictable memory locations by loading programs at random addresses.

It's been used by Microsoft since Windows Vista to counter memory-based attacks. However, Microsoft introduced an error in Windows 8 when implementing a feature known as Force ASLR or system-wide mandatory ASLR.

This feature is meant to randomize executables even if an application hasn't enabled support for ASLR. It can be switched on through Microsoft's Enhanced Mitigation Experience Toolkit (EMET). As of the Windows 10 Fall Creators Update, EMET became part of Windows Defender Exploit Guard (WDEG).

But as Will Dormann of Carnegie Mellon University's CERT/CC discovered, enabling system-wide ASLR in Windows 8 and newer only does half the job it's meant to, resulting in programs being relocated but to the same address every time.

"Starting with Windows 8.0, system-wide mandatory ASLR (enabled via EMET) has zero entropy, essentially making it worthless. Windows Defender Exploit Guard for Windows 10 is in the same boat," Dormann wrote on Twitter...
Click to expand...

Windows 10: Should I enable "Force randomization for images mandatory ASLR"?

Should I enable "Force randomization for images mandatory ASLR"?

Should I enable "Force randomization for images mandatory ASLR"?

Should I enable "Force randomization for images mandatory ASLR"?

Should I enable "Force randomization for images mandatory ASLR"? - Similar Threads - Should enable Force

Should I enable this feature?

Should I enable this feature?

Should I enable bitlocker or not

Should I force an update?

Should I force an update?

Should I enable IPV6 ?

Should I Disable or Enable 8dot3name?

Installation has forced a mandatory password

Should I enable hyperthreading?

Users found this page by searching for:

www.windowsphoneinfo.com

forced randimization for images

should force randomization for image.be on or.off