Keynote: Code-Reuse Attacks and Beyond
summary
Code-reuse research shows that many defenses fail against practical techniques that reuse existing functions or manipulate object layouts rather than code pointers, demonstrated by an automated counterfeit object-oriented programming (COOP) exploit generator for C++/Objective‑C and fully automated data-only attacks that stitch data-oriented gadgets. An info‑leak detection system uses a dual-process randomized lockstep (master/tryn) to catch leaks early, running with ~1.3× startup, ~17% browsing overhead and ~50% extra memory, finding real leaks across Alexa 100 with no false positives.
AI-written summary · about
chapters (4)
- 0:00Start
- 1:33THORSTEN HOLZ CODE-REUSE ATTACKS AND BEYOND
- 35:11TOWARDS CODE- REUSE ATTACKS WITHOUT MODIFYING CODE POINTERS Dynamic Hooks. Data-only Attacks. COOP...
- 41:45Generalize to data-only attacks
related talks
01h 06mHacking and Securing C++
45mAbusing Performance Optimization Weaknesses to Bypass ASLR
20mKeynote: Outsmarting IoT Defense: The Hacker's Perspective
22mThinking Outside the JIT Compiler
01h 06mHow hacking works
37mKeynote - Hacking AI How to Survive the AI Uprising
23mSecure Code, Safe Future: Mastering Security in Critical Software Development
35mKeynote: Think Like a Hacker