ASLR on the Line Ben Gras, Kaveh Razavi, Erik Bosman , Herbert Bos, - PowerPoint PPT Presentation

Aug 24, 2023 •374 likes •1.75k views

ASLR on the Line Ben Gras, Kaveh Razavi, Erik Bosman , Herbert Bos, Cris ano Giu ff rida VUSec Erik Bosman @brainsmoke Kaveh Razavi @gober Ben Gras @bjg Stephan van Schaik ASLR Address Space Layout Randomiza on Widely deployed

7 F 8 3 B 6 3 7 3 0 4 0 7F83B6372040 virtual address lookup (x86_64)
TLB miss!
CR3
511 512 entries 0 CR3
255 511 512 entries 0 CR3
255 512 entries CR3
255 14 512 entries CR3
255 14 512 entries CR3
255 14 433 512 entries CR3
255 14 433 512 entries CR3
255 14 433 370 512 entries CR3
255 14 433 370 actual data CR3
255 14 433 370 64 actual data CR3
255 14 433 370 64 actual data CR3 4K page
255 14 433 370 64 CR3 4K page
255 14 433 370 64 CR3 4K page
Observa � on: address informa � on is directly encoded into the page table lookups, and page tables are pages themselves.
255 14 433 370 64 CR3 4K page
255 14 433 370 64 CR3 4K page 4K page 4K page 4K page 4K page
255 14 433 370 64 CR3 4K page 4K page 4K page 4K page 4K page
CR3
255 ... 256 255 254 253 252 251 250 249 248 ... 247
255 ... 256 255 254 253 ? 1 Cache line = 252 64 bytes = 251 8 possible 250 page table 249 entries 248 ... 247
255 ... 256 255 254 253 ? 1 Cache line = 252 64 bytes = 251 8 possible 250 page table 249 entries 248 ... 247
255 ... 256 255 254 253 ? 1 Cache line = 252 64 bytes = 251 8 possible 250 page table 249 entries 248 ... 247 cache line reveals 6 address bits
255 14 433 370 64

Recommend

Jump Over ASLR: Attacking Branch Predictors to Bypass ASLR Presentation by Eric Newberry and

Jump Over ASLR: Attacking Branch Predictors to Bypass ASLR Presentation by Eric Newberry and Youssef Tobah Paper by Dmitry Evtyushkin, Dmitry Ponomarev, and Nael Abu-Ghazaleh 1 Motivation Buffer overflow attacks modify the control flow of a

1.6k views • 17 slides

ASLR / NX / Bounds Checking 1 last time stack canaries less-compatible alternative: shadow

ASLR / NX / Bounds Checking 1 last time stack canaries less-compatible alternative: shadow stacks page-level protection RELRO protect global ofgset table guard pages around memory allocations/etc. start ASLR choose random addresses

1.1k views • 73 slides

On the effectiveness of Full-ASLR on 64-bit Linux Hector Marco-Gisbert , Ismael Ripoll Universit`

On the effectiveness of Full-ASLR on 64-bit Linux Hector Marco On the effectiveness of Full-ASLR on 64-bit Linux Hector Marco-Gisbert , Ismael Ripoll Universit` at Polit` ecnica de Val` encia (Spain) In-Depth Security Conference (DeepSec)

1.05k views • 62 slides

On the effectiveness of NX, SSP, RenewSSP and ASLR against stack buffer overflows Hector

On the effectiveness of NX, SSP, RenewSSP and ASLR against stack buffer overflows Hector Marco On the effectiveness of NX, SSP, RenewSSP and ASLR against stack buffer overflows Hector Marco-Gisbert , Ismael Ripoll Universit` at Polit` ecnica

528 views • 35 slides

From Zygote to Morula: For0fying Weakened ASLR on Android

From Zygote to Morula: For0fying Weakened ASLR on Android Byoungyoung Lee Long Lu Tielei Wang Taesoo Kim Wenke Lee Georgia Tech,

635 views • 30 slides

Lec06: DEP and ASLR Taesoo Kim 2 Scoreboard 3 Administrivia Due: Lab04 is extended for

1 Lec06: DEP and ASLR Taesoo Kim 2 Scoreboard 3 Administrivia Due: Lab04 is extended for one week! Due: Lab05 is out and its due on Oct 5 at midnight Lab10: NSA Codebreaker Challenge Due: Nov 29 Offline CTF (Nov

880 views • 19 slides

String Oriented Programming: When ASLR is not enough Mathias Payer* and Thomas R. Gross

String Oriented Programming: When ASLR is not enough Mathias Payer* and Thomas R. Gross Department of Computer Science ETH Zrich, Switzerland * now at UC Berkeley Current protection is not complete http://creoflick.net 2 Motivation:

639 views • 33 slides

ASLR-Guard: Stopping Address Space Leakage for Code Reuse

ASLR-Guard: Stopping Address Space Leakage for Code Reuse A9acks Kangjie Lu, Chengyu Song, Byoungyoung Lee, Simon P. Chung, Taesoo Kim, Wenke Lee

605 views • 45 slides

Lec06: DEP and ASLR Taesoo Kim 2 Scoreboard 3 NSA Codebreaker Challenges 4 Administrivia

1 Lec06: DEP and ASLR Taesoo Kim 2 Scoreboard 3 NSA Codebreaker Challenges 4 Administrivia Congrats!! We've completed the half of labs! Due: Lab06 is out and its due on Oct 5 at midnight NSA Codebreaker Challenge Due:

1.13k views • 43 slides

How to Make ASLR Win the Clone Wars: Runtime Re-Randomization Kangjie Lu , Stefan Nrnberger,

How to Make ASLR Win the Clone Wars: Runtime Re-Randomization Kangjie Lu , Stefan Nrnberger, Michael Backes, and Wenke Lee Georgia Tech, CISPA, Saarland University, MPI-SWS, DFKI RuntimeASLR 1 What did we do? We re-randomize the memory

833 views • 44 slides

String Oriented Programming Circumventing ASLR, DEP, and other Guards Mathias Payer, ETH Zrich

String Oriented Programming Circumventing ASLR, DEP, and other Guards Mathias Payer, ETH Zrich Motivation Additional protection mechanisms prevent many existing attack vectors Format string exploits are often overlooked Drawback: hard to

640 views • 26 slides

Abusing Performance Optimization Weaknesses to Bypass ASLR Byoungyoung Lee Yeongjin Jang Tielei

Abusing Performance Optimization Weaknesses to Bypass ASLR Byoungyoung Lee Yeongjin Jang Tielei Wang Chengyu Song Long Lu Taesoo Kim Wenke Lee Georgia Tech Information Security Center (Rough) System Attack Trends Executing existing code

661 views • 50 slides

Binary Exploitation 1 Buffer Overflows (return-to-libc, ROP, Canaries, W^X, ASLR) Chester

Binary Exploitation 1 Buffer Overflows (return-to-libc, ROP, Canaries, W^X, ASLR) Chester Rebeiro Indian Institute of Technology Madras Parts of Malware Two parts Subvert execution: change the normal execution behavior of the program

1.25k views • 102 slides

Outline Return address protections ASLR and counterattacks CSci 5271 Introduction to Computer

Outline Return address protections ASLR and counterattacks CSci 5271 Introduction to Computer Security W X (DEP) Low-level defenses and counterattacks Announcements (combined lecture) Return-oriented programming (ROP) Stephen McCamant

699 views • 12 slides

ASLR & DEP DAVID HEAVERN Problem Statement Security Issues Buffer Overflows

ASLR & DEP DAVID HEAVERN Problem Statement Security Issues Buffer Overflows Buffer overflows are the source of many of the common vulnerabilities in modern software Caused by not checking the source length when writing to a

1.88k views • 130 slides

Control Flow Integrity Behavior-based detection Stack canaries, non-executable data, and ASLR

Control Flow Integrity Behavior-based detection Stack canaries, non-executable data, and ASLR aim to complicate various steps in a standard attack But they still may not stop it Idea: observe the programs behavior is it doing

314 views • 17 slides

Consider a line ST with its line bisector below. U S T O From the definition of a line

D AY 66 P ROPERTIES OF BISECTED LINE I NTRODUCTION A farm owner may want to construct a path that passes exactly through the middle of his farm so enable access to various parts of the farm. The problem will be how to identify a line that

291 views • 9 slides

X-Line 101 June 2019 X-Line 101 X-Line Unit Overview What makes X-Line unique X-Line 101

X-Line 101 June 2019 X-Line 101 X-Line Unit Overview What makes X-Line unique X-Line 101 Technology Changes, The Function Stays The Same Old Technology New Technology Carburetor Fuel Injection Distributor Electronic

767 views • 58 slides

Line Segments and Triangles A line drawing = set of line segments + set of faces. We need to

Chapter 6 Hidden-Line Elimination Line Segments and Triangles Tests for Visibility Input Format of 3D Objects Holes and Invisible Line Segments Individual Faces and Line Segments Automatic Generation of Input Files HP-GL

511 views • 30 slides

Practical taint analysis for protecting buggy binaries So your exploit beats ASLR/DEP? I don't

Practical taint analysis for protecting buggy binaries So your exploit beats ASLR/DEP? I don't care Erik Bosman <erik@minemu.org> Traditional Stack Smashing buf[16] GET / HTTP/1.1 00baseretnarg1arg2 Traditional Stack Smashing buf[16]

1.29k views • 100 slides

Title Slide Math 696 Class July 19, 2002 Line 1 Line 2 Line 3 Line 4 Line 5 Line 6 Line 7

Title Slide Math 696 Class July 19, 2002 Line 1 Line 2 Line 3 Line 4 Line 5 Line 6 Line 7 1 0 sin( x ) =?

312 views • 3 slides

Hudson Line Investments and Capacity Constraints Pascack Valley Line The Pascack Valley

Pascack Valley Line Hudson Line Investments and Capacity Constraints Pascack Valley Line The Pascack Valley Line is a single track line (with recently added passing sidings) jointly operated and controlled by New Jersey Transit with

189 views • 4 slides

starting point of two or more rays or lines. Bisect To divide something, in this case, a line

D AY 36 C OPYING AND BISECTING A LINE SEGMENT AND AN ANGLE I NTRODUCTION We are familiar with the terms line segment and angle, having defined and discussed their properties in our previous lessons. In the real world, angles and line

629 views • 34 slides

Example 1 1. Find the equation of the line joining P = (1 , 1 , 1) to Q = (1 , 0 , 1) in vector

Lines and Planes in R 3 1.3 P. Danziger Lines in R 3 We wish to represent lines in R 3 . Note that a line may be described in two different ways: By specifying two points on the line. By specifying one point on the line and a vector

472 views • 13 slides