Sometimes names just do not reflect the nature of things. Sometimes it is our fault to attribute a wrong meaning to a nams. I do not know which of the above holds for Windows ASLR. After Alex Sotirov and Mark Dowd's https://www.blackhat.com/html/bh-usa-08/bh-usa-08-speakers.html
The http://en.wikipedia.org/wiki/Address_space_layout_randomization ASLR abbreviation contains "randomization", which is enough (at least for me) to deduce that EXEs and DLLs get loaded at randomly chosen addresses. I was wrong to think that this makes it hard for the attacker to guess the loaded addresses. As it turns out, binaries get loaded to somehow predictable addresses.
While I understand that there were some technical difficulties and compatibility issues, the implementation choices made for ASLR effectively weakened it a lot to the point that it failed to deliver the promised.
Another revelation of this talk was that IE happily loads any .NET DLL provided by the web server using the plain old LoadLibrary function. The ramifications of this are enormous because the system is essentially accepting raw binary data (a file of the PE file format) and runs it on the user's computer. No need to talk about GS, SafeSEH and any other protections mechanisms after this.
The outcome of these two choices is also predictable, as Alex and Mark demonstrated to us: anyone visiting a malicious web site with IE can be easily owned.
There were other interesting talks at Blackhat, no way I can mention all of them here. Just one more pointer: I was amused and amazed by Hovav Scacham's https://www.blackhat.com/html/bh-usa-08/bh-usa-08-speakers.html
My http://www.hex-rays.com/idapro/ppt/decompilers_and_beyond.ppt talk on decompilers was received well. If you missed it, find the http://www.hex-rays.com/idapro/ppt/decompilers_and_beyond_white_paper.pdf white paper here.
Heading to DEFCON now, for more interesting talks!
http://hexblog.com/2008/08/blackhat_usa_2008.html
