More DEP

I wrote about DEP and its benefits in detail here.

A security researcher has released an exploit that uses a new technique to defeat DEP on Windows operating systems. For more details, visit his blog . He says in his blog that " I am releasing this because I feel it helps explain why ASLR+DEP are not a mitigation to put a lot of faith in, especially on x86 platforms."


Even though there is no available exploit for the current versions of IE or any other software which utilizes the ASLR + DEP features, it is good to know that organizations cannot use this alone as primary defense, rather as I mentioned in my post, it should be looked at as an another layer in the defense-in-depth.  

At the 2008 Black Hat conference, another method to get around DEP restriction using Java, ActiveX controls, and .NET was released. The presentation is available here.