> But attackers have already invented new techniques for circumventing ASLR, such as return-to-plt, GOT overwrite or GOT dereferencing. Again making it more inconvenient for script kiddies to write exploits, but again no problem for an attacker who can throw lots of money and people at the problem.
Helmets and bulletproof vests is no match for powerful rifles.
I'm a bit tired of this reasoning here on HN: If it isn't perfect it is worthless.
I think I can see reasons why a vendor might want to avoid ASLR in safety critical systems.
But we shouldn't talk down decent protection tecniques that will often save us.
Helmets and bulletproof vests is no match for powerful rifles.
I'm a bit tired of this reasoning here on HN: If it isn't perfect it is worthless.
I think I can see reasons why a vendor might want to avoid ASLR in safety critical systems.
But we shouldn't talk down decent protection tecniques that will often save us.