Presented at
Black Hat Asia 2018,
March 22, 2018, 11:45 a.m.
(60 minutes).
In this talk, we will present "return-to-csu" - a new method to bypass the ASLR in 64-bit Linux systems. The method is generic, since it does not use the compiled code from the target application but code that is always "silently attached" to it. This, in practice, means that our attack can be applied to any application. We will present our analysis, which reveals who is attaching this "extra code" to the executable memory (not to the shared libraries memory region) and why this code can not be easily protected/removed by application developers.
Although the idea of incremental compilation to do less work sounds generally good, it could raise some security issues. Having code which is not re-compiled could result in old or less protected code that can be abused by attackers. As a proof of that, we will present an attack abusing this extra code to bypass the ASLR in 64-bit Linux systems.
We will briefly describe the code that is out of the developers control, showing why it is "unsafe" and how it can be abused finding that there are enough assembler instructions that can be used to created what we named "return-to-csu" - a method to bypass the full Linux ASLR in 64-bit systems in a reliable, fast and generic way.
We will disclose the exploit and a live proof of concept using the return-to-csu method to obtain a shell in less than 1 second. The attack works on PIE and non-PIE applications as well as on hardened (PaX) systems. To make it more realistic, in the demonstration we will also bypass the NX, SSP, RELRO and other protections. To illustrate the method we will exploit, we will use a classic stack buffer overflow showing that a stack buffer overflow is synonymous of having a remote shell even in current 64-bit full protected application in most of the cases.
Finally, we will discuss the root cause and provide some recommendations to prevent the return-to-csu attack.
Presenters:
-
Dr. Hector Marco-Gisbert
- Dr., University of the West of Scotland
as Hector Marco-Gisbert
Dr. Hector Marco-Gisbert, BSc (Hons) in Computer Engineering, MSc in Industrial Computing and Control Systems and PhD in Engineering in Computer Science, Cybersecurity. Initially, he participated in several research projects where the main goal was to develop an hypervisor for the next generation of space crafts for the ESA (European Space Agency). He extend the scope of the projects by including security aspects. After more than 6 years of experience in virtualisation, he shifted deeper to Cybersecurity making substantial contributions to the Linux kernel, Glibc, GRUB and other open software projects. Since then, he has accumulated more than 5 years of experience in low level Cybersecurity receiving awards and recognitions from Google, Packet Storm Security and IBM for his security contributions. Currently, he is lecturer in Cybersecurity and Virtualisation at the University of the West of Scotland, Glasgow, UK.
-
Ismael Ripoll
- Dr., Universidad Politécnica de Valencia
Ismael Ripoll received a PhD in computer science from the Universitat Politecnica de Valencia in 1996, where he is professor of several cybersecurity subjects in the Department of Computing Engineering. In reverse chronological order: before working on security, he participated in multiple research projects related to hypervisor solutions for European spacecrafts; dynamic memory allocation algorithms; Real-Time Linux; and hard real-time scheduling theory. Currently, he is applying all this background to the security field. His current research interests include memory error defense/attacks techniques (SSP and ASLR) and software diversification. Ismael Ripoll is a Cybersecurity researcher at UPV Cybersecurity group.
Links:
Similar Presentations: