Presented at
DeepSec 2014 „Do you want to know more?“,
Unknown date/time
(Unknown duration).
Address-Space Layout Randomization (ASLR) is a technique used to thwart attacks which relies on knowing the location of the target code or data. The effectiveness of ASLR hinges on the entirety of the address space layout remaining unknown to the attacker. Only executables compiled as Position Independent Executable (PIE) can
obtain the maximum protection from the ASLR technique since all the sections are loaded at random locations.
We have identified a security weakness on the implementation of the ASLR in GNU/Linux when the executable is PIE compiled. A PoC attack
is described to illustrate how the weakness can be exploited. Our attack bypasses the three most widely adopted and effective protection techniques: No-eXecutable bit (NX), address space layout randomization (ASLR) and stack smashing protector (SSP). A remote shell is got in less than one second.
Finally, after analyzing different mitigation alternatives we
conclude that a new ASLR design is needed. We propose an alternative to the current ASLR implementation which increases the effective entropy and removes the discovered weakness.
Presenters:
-
Hector Marco
- Departamento de Informática de Sistemas y Computadores - Universitat Politècnica de València
Hector Marco-Gisbert - http://hmarco.org
Ismael Ripoll Ripoll - http://personales.upv.es/~iripoll/ Cyber-security research group at http://cybersecurity.upv.es/
Links:
Similar Presentations: