IE 10 features new high entropy ASLR and ForceASLR mitigation techniques
After the recently concluded pwn2own an pwnium contest, the security of your web browser is once again a hot topic. Vulnerabilities within browsers are certainly not new, however, it is the mitigation techniques - the methods used by folks like Microsoft, Mozilla and Google to defeat exploit writers - that has researchers more interested.
In a recently published blog post, Microsoft talks about the new mitigation techniques that will be used in Internet Explorer 10. Things like a much improved version of ASLR (address space layout randomisation) and DEP (data execution prevention) which you'll see in Windows 8.
Microsoft says that 64-bit processes will be able to opt in to what Microsoft calls a "High Entropy ASLR" which greatly increases the amount of randomness in the address space and will also make use of a new feature called ForceASLR - which can 'force all DLLs to use ASLR' even if they don't tell the system that they are safe to use that way. While Internet Explorer 10 will certainly be more secure, don't expect the features above to suddenly make it “unhackable", because there's simply no such thing ;)
