Abusing Performance Optimization Weaknesses to Bypass ASLR
summary
Shows that performance-driven choices leak pointer-sized identifiers so ASLR can be defeated. Empirical survey of Python, Ruby, PHP, Java(DVM/JVM) and JS hash table implementations finds direct ID exposure or inferrable keys via timing, and a working Safari JavaScript timing attack that reads object addresses. Analyzes Android’s Zygote fork identical layouts and demonstrates two coordinated bypasses (Chrome → launch VLC ROP) and a local native-scanner app; prototypes work on tested targets and vendors issue patches.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:33(Rough) System Attack Trends
- 1:51A Brief History of ASLR
- 2:37Bypassing ASLR
- 8:25Hash Table and ASLR?
- 11:43Address Information in Script Languages
- 13:42Attacking ASLR with Hash Tables
- 16:03Examples - Directly Reading a key
- 18:18How to Infer a key in WebKit Javascript
- 19:53Abusing Collision Resolution
- 27:12DEMO
- 31:39Countermeasures
- 35:27History of ASLR adoption in Android
- 36:48Performance Prioritized Designs of Android
- 37:24Zygote: the process creation module
- 39:00Zygote weakens ASLR effectiveness
- 40:18Attacking the ASLR weakness
- 42:06Remote Coordinated Attack
- 43:43Local Trojan Attack
- 44:51References
related talks
58mExploiting Linux and Pax ASLR's Weaknesses on 32-Bit and 64-Bit Systems
35mOn Securing Legacy Software Against Code-Reuse Attacks
51mExploiting Hardware Glitches And Side Channels In Perfect Software
41mA General Approach to Bypassing Many Kernel Protections and its Mitigation
22mThinking Outside the JIT Compiler
53mAndroid: He protec, but he also attac
41mUsing Microarchitectural Design to Break KASLR and More
01h 16mClassic Vulnerabilities