On Securing Legacy Software Against Code-Reuse Attacks
summary
Overview of concrete findings and defenses: fine-grained ASLR is undermined by a JIT-ROP that discloses about ~200 pages disclosed on average in IE/Firefox/Chrome, letting attackers assemble gadgets despite instruction-level randomization; commercial and research CFI variants still allow a Turing-complete gadget set from a single 1 MB library (kernel32.dll) and are evaded with crafted long-nop gadgets; a hardware-assisted CFI prototype yields 1–2% overhead on test boards; page-table randomization is implemented for Debian 8.2 / Linux 4.2 with negligible runtime cost.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:33Motivating Problem
- 1:34Attack Idea
- 3:10Return-Oriented Programming (ROP)
- 6:48Basics of Code Randomization
- 7:19Basics of Memory Randomization
- 7:49Fine-Grained ASLR
- 11:05Code Randomization: Lessons Learned
- 12:51Label Granularity: Trade-offs (2/2)
- 14:04Label Problem for Returns
- 15:12Shadow Stack / Return Address Stack
- 17:59Main Coarse-Grained CFI Policies
- 21:07Bypassing Heuristics
- 22:37Coarse-Grained CFI: Lessons Learned
- 24:48HAFIX Example
- 28:31Data-Only Attacks Against Page Tables
- 32:52Selected Challenges
- 33:30Implementation Notes
related talks
27mWhat Cannot Be Read, Cannot Be Leveraged? Revisiting Assumptions of JIT-ROP...
45mAbusing Performance Optimization Weaknesses to Bypass ASLR
33mOver the Edge: Silently Owning Windows 10's Secure Browser
58mExploiting Linux and Pax ASLR's Weaknesses on 32-Bit and 64-Bit Systems
01h 34mA Little Introduction to Control Flow Integrity in C++
01h 46mA little Introduction to Control Flow Integrity
51mWindows 10 Mitigation Improvements
51mExploiting Hardware Glitches And Side Channels In Perfect Software