Microsoft adds Enhanced Memory Protections in IE10

Mar 14, 2012Mohit Kumar

Internet Explorer 10, the next version of the popular browser from Microsoft will incorporate new protections in terms of memory management. French security firm VUPEN has managed to hack Microsoft's Internet Explorer 9 on a fully patched Windows 7 SP1 machine. Internet Explorer 10 introduces significant improvements in memory protections to help make vulnerabilities harder to exploit, helping to keep users safe on the sometimes-hostile Web. These improvements will increase the difficulty and development cost of exploits, making life harder for the bad guys.

As VUPEN founder Chaouki Bekrar claims, the memory corruption bug they used to do that is one of many they found, but he also admitted that the new IE 10 will be much harder to break into as Microsoft has added new protection mechanisms.

Internet Explorer 10 will include two major new features:

HEASLR (High Entropy Address Space Layout Randomization): functionality addressing random memory areas (ASLR) is improved for 64-bit process. This feature will be available only in Windows 8.
ForceASLR: This feature will allow Internet Explorer to force 10 support ASLR, including the normally non-compatible modules. Thus, the security vulnerabilities affecting older modules or extensions installed will be much more difficult to exploit. This feature will be available on Windows 7.

Memory protection technologies provide a front line of defense to block attackers from achieving their goals. These technologies exist to make exploiting vulnerabilities more difficult, less reliable, and in some cases impossible. Memory protections aim to safely terminate a browser process under attack before a vulnerability can be successfully exploited to run the attacker's code.