Spybot S&D and lack of ASLR support [Archive]

View Full Version : Spybot S&D and lack of ASLR support

m00nbl00d

2011-09-06, 13:01

I was checking Spybot S&D in Process Explorer, and it lacks ASLR support. This obviously includes the dll file SDHelper.dll, which is loaded to IE and Explorer.

Is there any technical reason why Spybot lacks ASLR?

thanks

BoerenkoolMetWorst

2011-10-06, 21:51

No reply from Safer-Networking?
Do you know that you're making the system vulnerable by loading DLL's that don't support ASLR into processes that are exploited like explorer.exe and browsers?
http://blog.didierstevens.com/2011/01/17/quickpost-it-does-no-harm-or-does-it/
http://www.scriptjunkie.us/2011/06/bypassing-dep-aslr-in-browser-exploits-with-mcafee-symantec/
I did a quick test with the latest beta and checked IE and explorer.exe, the DLL in explorer.exe doesn't support ASLR.

ght1

2011-10-16, 15:39

No reply from Safer-Networking?

What's the news? :wink:

lewisje

2011-10-24, 01:45

Is it just that Spybot doesn't use ASLR by default (like most apps) or that it (like Safari) fails to work when EMET or a similar tool is used to force Spybot to use ASLR?

Also it might be a good idea to see whether the beta of Spybot 2 does support ASLR; perhaps it was only added in this time because of increased support across the operating systems in the user-base.