Smart contracts are computer programs that execute on the blockchain, receive and send transactions, and maintain a balance of cryptocurrency. In the recent past, we have witnessed a variety of attacks against smart contracts with cryptocurrency loses up to 50 million US Dollars. These attacks were possible due to errors in the smart contract logic. In this talk we investigate dynamic analysis approaches to secure smart contracts and discuss patching and hardening strategies.

Smart contracts are computer programs that execute on the blockchain, receive and send transactions, and maintain a balance of cryptocurrency. In the recent past, we have witnessed a variety of attacks against smart contracts with cryptocurrency loses up to 50 million US Dollars. These attacks were possible due to errors in the smart contract logic. In this talk we investigate dynamic analysis approaches to secure smart contracts and discuss patching and hardening strategies.

Trusted execution environments such as Intel Software Guard Extensions (SGX) enforce strong isolation of security-critical code and data. While previous work has focused on side-channel attacks, this talk will investigate memory corruption attacks such as return-oriented programming in the context of SGX. We will demonstrate how an attacker can exploit the Intel SDK libraries to compromise enclaves and steal secret information. In addition, we will investigate the host-to-enclave boundary and its susceptibility to memory corruption attacks and how we can develop analysis approaches to detect vulnerable enclave code.

Presentation video available here

The Intel Software Guard Extensions (SGX) technology allows an application developer to isolate security-critical code and data inside a protected memory area called enclave. While most research has studied side-channel attacks against SGX this talk will investigate memory corruption attacks such as return-oriented programming in the context of SGX. We will demonstrate how an attacker can exploit the Intel SDK libraries to compromise enclaves and steal secret information. In addition we will investigate the host-to-enclave boundary and its susceptibility to memory corruption attacks.

Seminar Homepage: dcaps.info/2019-12-05.html

The Intel Software Guard Extensions (SGX) technology allows an application developer to isolate security-critical code and data inside a protected memory area called enclave. While most research has studied side-channel attacks against SGX this talk will investigate memory corruption attacks such as return-oriented programming in the context of SGX. We will demonstrate how an attacker can exploit the Intel SDK libraries to compromise enclaves and steal secret information. In addition we will investigate the host-to-enclave boundary and its susceptibility to memory corruption attacks.

Seminar Homepage: dcaps.info/2019-12-05.html

ARM TrustZone and Intel Software Guard Extensions (SGX) offer hardware-assisted trusted execution environments (TEEs) to enable strong isolation of security-critical code and data. They also allow systems to perform remote attestation, where a device challenges another device to report its current state. In this talk, we elaborate on remote attestation schemes that do not only attest static properties, but also cover run-time control-flow behavior of applications based on ARM TrustZone. While TEEs enable secure attestation of control-flow behavior, memory corruption attacks (e.g., return-oriented programming) inside TEEs can undermine remote attestation schemes. This talk will elaborate on memory corruption attacks for the use-case of SGX and how we can develop analysis approaches to detect vulnerable TEE code.

Presentation Video: https://videos-rennes.inria.fr/video/BksfYbigI 

Smart contracts are computer programs that execute on the blockchain, receive and send transactions, and maintain a balance of cryptocurrency. In the recent past, we have witnessed a variety of attacks against smart contracts with cryptocurrency loses up to 50 million US Dollars. These attacks were possible due to errors in the smart contract logic. To tackle such attacks, a large number of mitigation technologies have been proposed. In this talk, we provide an overview of static and dynamic analysis techniques to tackle smart contract errors.

Software attacks exploit vulnerabilities in programs to trigger malicious operations and steal sensitive data. In this context, memory corruption attacks play a vital role as they allow an attacker to perform arbitrary reads and writes to main memory. While traditional attacks required the attacker to directly inject malicious code into the memory space of an application, modern attacks either only induce malicious execution by means of a combination of existing code (return-oriented programming) or only manipulate variables without violating the program’s control flow (data-oriented exploits). For the case of real-world crypto schemes, these attacks are capable of stealing and altering cryptographic material.

In this tutorial, we provide an overview of the state-of-the-art memory exploitation techniques and defenses. We start with the main principles of memory exploitation covering stack smashing, return-oriented programming, and data-oriented programming. Next, we present modern defense techniques such as control-flow integrity and memory randomization.

In the second part of this tutorial, we continue with a hands-on lab where attendees will have the opportunity to construct proof-of-concept memory exploits that undermine cryptographic schemes deployed by the target application.

More information on the summer school here

Software attacks exploit vulnerabilities in programs to trigger malicious operations and steal sensitive data. In this context, memory corruption attacks play a vital role as they allow an attacker to perform arbitrary reads and writes to main memory. While traditional attacks required the attacker to directly inject malicious code into the memory space of an application, modern attacks either only induce malicious execution by means of a combination of existing code (return-oriented programming) or only manipulate variables without violating the program’s control flow (data-oriented exploits). For the case of real-world crypto schemes, these attacks are capable of stealing and altering cryptographic material.

In this tutorial, we provide an overview of the state-of-the-art memory exploitation techniques and defenses. We start with the main principles of memory exploitation covering stack smashing, return-oriented programming, and data-oriented programming. Next, we present modern defense techniques such as control-flow integrity and memory randomization.

In the second part of this tutorial, we continue with a hands-on lab where attendees will have the opportunity to construct proof-of-concept memory exploits that undermine cryptographic schemes deployed by the target application.

More information on the summer school here

Recently, a number of existing blockchain systems have witnessed major bugs and vulnerabilities within smart contracts. Although the literature features a number of proposals for securing smart contracts, these proposals mostly focus on proving the correctness or absence of a certain type of vulnerability within a contract, but cannot protect deployed (legacy) contracts from being exploited. In this talk, we present Sereum (Secure Ethereum) which protects deployed contracts in a backwards compatible way based on run-time monitoring and validation. We also study new re-entrancy attack patterns that have been overlooked by previous on smart contract bug detection.

Recently, a number of existing blockchain systems have witnessed major bugs and vulnerabilities within smart contracts. Although the literature features a number of proposals for securing smart contracts, these proposals mostly focus on proving the correctness or absence of a certain type of vulnerability within a contract, but cannot protect deployed (legacy) contracts from being exploited. In this talk, we present Sereum (Secure Ethereum) which protects deployed contracts in a backwards compatible way based on run-time monitoring and validation. We also study new re-entrancy attack patterns that have been overlooked by previous on smart contract bug detection.

Recently, a number of existing blockchain systems have witnessed major bugs and vulnerabilities within smart contracts. Existing proposals mostly focus on proving the correctness or absence of a certain type of vulnerability within a contract, but cannot protect deployed (legacy) contracts from being exploited. We address this problem and develop a novel smart contract security technology, called Sereum (Secure Ethereum), which protects existing, deployed contracts in a backwards compatible way based on run-time monitoring and validation. By means of implementation and evaluation using the Ethereum blockchain, we show that Sereum covers the actual execution flow of a smart contract to accurately detect and prevent re-entrancy attacks with a low false positive rate and negligible run-time overhead.

Recently, a number of existing blockchain systems have witnessed major bugs and vulnerabilities within smart contracts. Existing proposals mostly focus on proving the correctness or absence of a certain type of vulnerability within a contract, but cannot protect deployed (legacy) contracts from being exploited. We address this problem and develop a novel smart contract security technology, called Sereum (Secure Ethereum), which protects existing, deployed contracts in a backwards compatible way based on run-time monitoring and validation. By means of implementation and evaluation using the Ethereum blockchain, we show that Sereum covers the actual execution flow of a smart contract to accurately detect and prevent re-entrancy attacks with a low false positive rate and negligible run-time overhead.

Blockchain-basierte Systeme wie Ethereum erlauben das Ausführen von Programmen, sogenannten Smart Contracts, auf der Blockchain. Smart Contracts sind dabei in der Lage Kryptowährungen zu besitzen und autonom zu transferieren. Damit werden Smart Contracts ein attraktives Ziel für Cyberkriminelle. Neue Angriffstechniken wie beispielsweise die sogenannten Re-Entrancy Angriffe erlauben es Angreifern große Mengen an Kryptowährungen zu stehlen. So wurden im berüchtigten DAO Angriff Kryptowährung im Umfang von circa 50 Millionen US-Dollar abgegriffen. Existierende Schutzmechanismen beruhen darauf Entwickler mittels statische Programmanalysewerkzeugen vorab vor sicherheitsanfälligen Programmcode zu warnen. Allerdings können einmal veröffentlichte Smart Contracts nur mit sehr viel Aufwand aktualisiert werden. In diesem Vortrag beschreiben wir einen neuen Forschungsansatz, um existierende, bereits veröffentlichte Smart Contracts vor Re-Entrancy Angriffen zu schützen. Dabei gehen wir auch auf neuartige Angriffstechniken ein, die von existierenden statischen Programmanalysewerkzeugen nur unzureichend abgedeckt werden.

Cybersicherheit, Cyberspionage, Wahlmaschinen-Hacks, Exploits sind Begriffe mit denen wir immer häufiger in den Nachrichten konfrontiert werden. Der Aufbruch ins digitale Zeitalter, das Wachstum des Internets und die Vernetzung kleiner Mikro-Computer zum Internet der Dinge bringen neue und hohe Herausforderungen an die Cybersicherheit mit sich. Insbesondere steigt die Zahl der Angriffe auf Computer und Smartphones rapide an und betrifft zunehmend kritische Infrastrukturen wie Stromnetze, Industrieanlagen und sicherheitskritische Technologien wie das autonome Fahren. In diesem Vortrag wollen wir einen Blick auf die Angriffstechniken werfen, die Hacker dazu verwenden, um Kontrolle über Software zu gewinnen. Dabei werden wir moderne Angriffstechniken betrachten, die es einem Angreifer erlauben ein Computersystem zu manipulieren ohne bösartigen Programmcode einzuschleusen. Ferner diskutieren wir Hardwarebasierte Angriffe, die Sicherheitsmechanismen in Software auf clevere Weise aushebeln.

Software attacks exploit vulnerabilities in programs to trigger malicious operations and steal sensitive data. While existing attacks have mainly focused on classic desktop PCs and mobile systems, they are increasingly applied to modern software systems such as smart contracts. In this talk, we investigate two prevalent software attack techniques, namely return-oriented programming and re-entrancy attacks. The former attack technique leverages a malicious combination of benign code sequences to compromise web browsers and document viewers, whereas the latter exploits state inconsistencies to drain money out of a smart contract. For both, we discuss their evolution and investigate the challenges when building defenses against these attacks. 

Zero-Day Exploits nutzen Programmierfehler aus, um beliebiges Schadverhalten auf einem Computersystem zu verursachen. Moderne Angriffe gegen Web-Browser benutzen dabei eine ausgeklügelte Technik, die sich Return-Oriented Programming (ROP) nennt. Im Gegensatz zu klassischen Angriffstechniken, können ROP Angriffe allein über das Zusammensetzen von vorhandenen, gutartigen Browser-Code Schadverhalten erzeugen. Weil hierbei kein neuer Schadcode explizit eingeschleust wird, umgehen ROP Angriffe weit verbreitete Abwehrmechanismen. In diesem Vortrag werden wir die ROP Angriffstechnik einführen und deren Anwendung auf Web-Browser erläutern. Ferner werden wir besprechen welche Abwehrmethoden eingesetzt werden können, um sich gegen diese Angriffe zu schützen.

Video Mitschnitt und Folien stehen auf der ECSM Seite zum Download bereit

Intel Software Guard Extensions (SGX) is a recent hardware-based trusted execution environment that provides strong isolation of security-critical code and data by allocating them in dedicated, encrypted memory regions called enclaves. Until today, the threat of memory corruption attacks such as return-oriented programming and its impact on SGX protected program code and data is not yet well understood. In this talk, we provide an in-depth investigation of the Intel SGX internals regarding how untrusted host applications interact with trusted enclaves. Based on this analysis, we present novel memory corruption techniques allowing an attacker to undermine SGX to steal private information or bypass remote attestation protocols.

Intel Software Guard Extensions (SGX) is a recent hardware-based trusted execution environment that provides strong isolation of security-critical code and data by allocating them in dedicated, encrypted memory regions called enclaves. Until today, the threat of memory corruption attacks such as return-oriented programming and its impact on SGX protected program code and data is not yet well understood. In this talk, we provide an in-depth investigation of the Intel SGX internals regarding how untrusted host applications interact with trusted enclaves. Based on this analysis, we present novel memory corruption techniques allowing an attacker to undermine SGX to steal private information or bypass remote attestation protocols.

Memory corruption attacks such as return-oriented programming are a powerful exploitation technique to compromise software on a wide range of architectures. These attacks generate malicious computation based on existing code (so-called gadgets) residing in linked libraries. Both academia and industry have recently proposed defense techniques to mitigate return-oriented programming attacks. However, a continuous arms race has evolved between attacks and defenses. In this talk, we will elaborate on the evolution of memory corruption attacks. In particular, we explore prominent defense techniques such as control-flow integrity (CFI) enforcement, code randomization, and remote attestation. In addition, we investigate memory corruption attacks that exploit hardware faults to induce dangerous bit flips in memory. These attacks undermine memory access control mechanisms without requiring any software vulnerability. Specifically, we elaborate on the evolution of Rowhammer attacks and defenses.

With the immense popularity of smart phones, people now have devices that make large-scale sensing possible using internal sensors and the Internet connection. This allows to perform a large number of measurements with little cost, covering a large area and a long time span, because the sensor hardware is provided by the participants. This opens possibilities for use cases where traditional sensor networks are not applicable.

While dedicated sensor nodes can have a certain accuracy, participants of crowd sensing are unreliable or even malicious. Consequently, individual measurements are unreliable. But the combination of many measurements makes it possible to identify false data and increase accuracy.

We investigate this issue using the example measuring noise pollution caused by trains or planes. These typically produce specific noise patterns, so that using multiple sensor nodes these can be differentiated from other noise.  Typically, smart phones can measure the noise level using the internal microphone, and determine their precise location and the exact time using GPS. There have been several approaches to measure noise pollution using crowdsensing, which have shown the practical applicability of this method for this use-case. But the measurements depend on the reliability and accuracy of every participating node.

By means of simulations, we analyze how the quality of information can be increased by combining the measurements of different participants or introducing reliable and accurate sensor nodes, in order to reduce the measurement error and identify unreliable nodes.

With the immense popularity of smart phones, people now have devices that make large-scale sensing possible using internal sensors and the Internet connection. This allows to perform a large number of measurements with little cost, covering a large area and a long time span, because the sensor hardware is provided by the participants. This opens possibilities for use cases where traditional sensor networks are not applicable.

While dedicated sensor nodes can have a certain accuracy, participants of crowd sensing are unreliable or even malicious. Consequently, individual measurements are unreliable. But the combination of many measurements makes it possible to identify false data and increase accuracy.

We investigate this issue using the example measuring noise pollution caused by trains or planes. These typically produce specific noise patterns, so that using multiple sensor nodes these can be differentiated from other noise.  Typically, smart phones can measure the noise level using the internal microphone, and determine their precise location and the exact time using GPS. There have been several approaches to measure noise pollution using crowdsensing, which have shown the practical applicability of this method for this use-case. But the measurements depend on the reliability and accuracy of every participating node.

By means of simulations, we analyze how the quality of information can be increased by combining the measurements of different participants or introducing reliable and accurate sensor nodes, in order to reduce the measurement error and identify unreliable nodes.

Exploiting software vulnerabilities on IoT devices is becoming increasingly prevalent. These exploits corrupt program state information maintained in application memory to induce unauthorized program actions. In particular, return-oriented programming attacks allow an attacker to hijack IoT devices without requiring injection of malicious code. In this talk, we elaborate on the different classes of software exploitation techniques in the IoT space and present recent research on control-flow attestation and control-flow integrity to detect and prevent these attacks.

Cybersicherheit, Cyberspionage, Wahlmaschinen-Hacks, Exploits, Computerviren sind Begriffe mit denen wir immer häufiger in den Nachrichten konfrontiert werden. Der Aufbruch ins digitale Zeitalter, das Wachstum des Internets und die Vernetzung kleiner Mikro-Computer zum „Internet der Dinge“ haben neue und hohe Herausforderungen an die Cybersicherheit mit sich gebracht. Insbesondere steigt die Zahl der Cyberangriffe auf Computer und Smartphones rapide an und betrifft zunehmend kritische Infrastrukturen wie Stromnetze, Industrieanlagen und sicherheitskritische Technologien wie das autonome Fahren. In diesem Vortrag wollen wir uns Angriffstechniken ansehen, die Hacker dazu verwenden, um Kontrolle über Software gewinnen können. Dabei werden wir Angriffstechniken betrachten, wie ein Angreifer ein Computersystem manipulieren kann ohne ein bösartiges Programm einzuschleusen.

Cybersicherheit, Cyberespionage, Wahlmaschinen-Hacks, Exploits, Computerviren sind Begriffe mit denen wir immer häufiger in den Nachrichten konfrontiert werden. Der Aufbruch ins digitale Zeitalter, das Wachstum des Internets und die Vernetzung kleiner Mikro-Computer zum „Internet der Dinge“ haben neue und hohe Herausforderungen an die Cybersicherheit mit sich gebracht. Insbesondere steigt die Zahl der Cyberangriffe auf Computer und Smartphones rapide an und betrifft zunehmend kritische Infrastrukturen wie Stromnetze, Industrieanlagen und sicherheitskritische Technologien wie das autonome Fahren. In diesem Vortrag wollen wir uns Angriffstechniken ansehen, die Hacker dazu verwenden, um Kontrolle über Software wie zum Beispiel dem Internet Explorer und Microsoft Word gewinnen können. Dabei werden wir uns anschauen wie ein Angreifer ein Computersystem manipulieren kann ohne ein bösartiges Programm einzuschleusen.

Attacks targeting software on embedded systems are becoming increasingly prevalent. In particular, software exploits based on return-oriented programming are challenging to prevent as they perform malicious operations without requiring the attacker to inject any malicious code. Both academia and industry have recently proposed defense techniques to mitigate these attacks. However, a continuous arms race has evolved between new attacks and improved defenses. In this talk, we elaborate on the different classes of software exploits and present recent research on mitigation technologies such as control-flow integrity and attestation targeting embedded systems software.

Control-flow attacks targeting software on embedded systems are becoming increasingly prevalent. In particular, return-oriented programming attacks exploit software vulnerabilities of embedded software to induce malicious program actions without requiring the attacker to inject any malicious code. Remote attestation is a mechanism that allows establishing trust in embedded devices. Unfortunately, most existing attestation schemes are static. That is, they only report the state of the software that was initially loaded thereby missing detection of control-flow attacks. In this talk, we elaborate on the different classes of control-flow attacks and present recent research on control-flow attestation for embedded systems software to detect these attacks. We discuss the application of control-flow attestation in the context of cyber-physical applications such as an open syringe pump. Lastly, we elaborate on open challenges and hardware support for control-flow attestation.

Code-Reuse attacks such as return-oriented programming constitute a powerful exploitation  technique that is frequently leveraged to compromise software on a wide range of architectures. These attacks generate malicious computation based on existing code (so-called gadgets) residing in linked  libraries. Both academia and industry have recently proposed defense techniques to mitigate code-reuse attacks. However, a continuous arms race has evolved between attacks and defenses. In this talk, we  will elaborate on the evolution of code-reuse attacks. In particular, we explore prominent defense  techniques that are based on control-flow integrity (CFI) enforcement and code randomization. Further, we discuss promising research directions such as hardware-assisted defenses and protection against  these attacks at the kernel layer.

Code-Reuse attacks such as return-oriented programming constitute a powerful exploitation  technique that is frequently leveraged to compromise software on a wide range of architectures. These attacks generate malicious computation based on existing code (so-called gadgets) residing in linked  libraries. Both academia and industry have recently proposed defense techniques to mitigate code-reuse attacks. However, a continuous arms race has evolved between attacks and defenses. In this talk, we  will elaborate on the evolution of code-reuse attacks. In particular, we explore prominent defense  techniques that are based on control-flow integrity (CFI) enforcement and code randomization. Further, we discuss promising research directions such as hardware-assisted defenses and protection against  these attacks at the kernel layer.

Code-reuse attacks such as return-oriented programming constitute a powerful zero-day exploitation technique that is frequently leveraged to compromise software on a wide range of architectures. These attacks generate malicious computation based on existing code (so-called gadgets) residing in linked libraries. The good news is that both academia and industry have proposed defense techniques to mitigate code-reuse attacks. On the other hand, a continuous arms race has evolved between attacks and defenses. In this talk, we will elaborate on the evolution of code-reuse attacks. In particular, we explore two prominent defense techniques: control-flow integrity (CFI) and code randomization. We demonstrate that existing defenses, including Microsoft’s Enhanced Mitigation Experience Toolkit (EMET), can be bypassed with advanced code-reuse attack techniques. Further, we discuss promising research directions such as hardware-assisted defenses, attestation of a program’s control flows, and protection against these attacks at the kernel layer.

Code-reuse attacks such as return-oriented programming constitute a powerful zero-day exploitation technique that is frequently leveraged to compromise software on a wide range of architectures. These attacks generate malicious computation based on existing code (so-called gadgets) residing in linked libraries. The good news is that both academia and industry have proposed defense techniques to mitigate code-reuse attacks. On the other hand, a continuous arms race has evolved between attacks and defenses. In this talk, we will elaborate on the evolution of code-reuse attacks. In particular, we explore two prominent defense techniques: control-flow integrity (CFI) and code randomization. We demonstrate that existing defenses, including Microsoft’s Enhanced Mitigation Experience Toolkit (EMET), can be bypassed with advanced code-reuse attack techniques. Further, we discuss promising research directions such as hardware-assisted defenses, attestation of a program’s control flows, and protection against these attacks at the kernel layer.

Memory corruption attacks belong to the most-widely deployed attacks since almost three decades. These attacks have been already applied in the first famous Internet worm (the Morris worm in 1988). Today, they are used to compromise web browsers, launch iOS jailbreaks, and partially in zero day issues exploited in large-scale cyberattacks such as Stuxnet and Duqu. In particular, code-reuse techniques such as return-oriented programming undermine the security model of non-executable memory (the No-Execute Bit) and memory randomization. Defending against these attacks is a hot topic of research. In this tutorial, the attendees will be introduced to the state-of-the-art memory exploitation techniques and defenses. We give an overview of the main principles of memory exploitation covering stack smashing, return-into-libc, and return-oriented programming. We also elaborate on modern defenses such as control-flow integrity and memory randomization. In a hands-on lab, the attendees will construct proof-ofconcept exploits targeting mobile platforms (based on ARM).

Memory corruption attacks belong to the most-widely deployed attacks since almost three decades. These attacks have been already applied in the first famous Internet worm (the Morris worm in 1988). Today, they are used to compromise web browsers, launch iOS jailbreaks, and partially in zero day issues exploited in large-scale cyberattacks such as Stuxnet and Duqu. In particular, code-reuse techniques such as return-oriented programming undermine the security model of non-executable memory (the No-Execute Bit) and memory randomization. Defending against these attacks is a hot topic of research. In this tutorial, the attendees will be introduced to the state-of-the-art memory exploitation techniques and defenses. We give an overview of the main principles of memory exploitation covering stack smashing, return-into-libc, and return-oriented programming. We also elaborate on modern defenses such as control-flow integrity and memory randomization. In a hands-on lab, the attendees will construct proof-ofconcept exploits targeting mobile platforms (based on ARM).

Memory corruption attacks exploit program bugs in modern software programs to compromise computing platforms. Although these attacks are known for several decades, they still pose a severe threat today’s software programs. These attacks can be applied to a variety of architectures starting from Desktop PCs and mobile devices to tiny embedded devices employed in sensors. In particular, code-reuse attacks such as return-oriented programming have significantly raised the sophistication of memory corruption attacks since they induce malicious actions based on only existing benign code. Fortunately, the security community including industrial efforts by Google and Microsoft have recently introduced a variety of defenses. On the other hand, attackers quickly adapted and proposed new attack techniques leading to a continuing arms race. In this lecture, we will provide an overview on state-of-the-art exploitation techniques and defenses against these attacks. In addition, the students will learn the practical concepts of runtime exploitation based on a hands-on lab

Memory corruption attacks exploit program bugs in modern software programs to compromise computing platforms. Although these attacks are known for several decades, they still pose a severe threat today’s software programs. These attacks can be applied to a variety of architectures starting from Desktop PCs and mobile devices to tiny embedded devices employed in sensors. In particular, code-reuse attacks such as return-oriented programming have significantly raised the sophistication of memory corruption attacks since they induce malicious actions based on only existing benign code. Fortunately, the security community including industrial efforts by Google and Microsoft have recently introduced a variety of defenses. On the other hand, attackers quickly adapted and proposed new attack techniques leading to a continuing arms race. In this lecture, we will provide an overview on state-of-the-art exploitation techniques and defenses against these attacks. In addition, the students will learn the practical concepts of runtime exploitation based on a hands-on lab

Code reuse attacks pose a severe threat to modern software, silently breaching and infecting various systems ranging from desktop PCs to mobile and embedded systems. They can bypass many deployed defenses including data execution prevention and memory randomization (ASLR). The design and development of practical and effective defenses against code reuse attacks is extremely challenging and has recently become a hot research topic. Code-reuse with its most prominent instantiation return-oriented programming (ROP) may seem like a solved problem given the high scores of papers on possible defenses recently published on established security conferences. Unfortunately, many proposed defenses make assumptions that a sufficiently determined and resourced attacker can skirt, or require system changes that are highly challenging to transfer into practice; and frequently both.

This seminar will bring together researchers and practitioners to analyze the state-of-the-art in code reuse attacks and mitigations, to devise improved approaches, and to establish a roadmap for future research and practice.

https://www.dagstuhl.de/15294

Recorded Talk available on YouTube

Fine-grained address space layout randomization (ASLR) has recently been proposed as a method of efficiently mitigating runtime attacks. In this presentation, we introduce the design and implementation of a framework based on a novel attack strategy, dubbed just-in-time code reuse, which both undermines the benefits of fine-grained ASLR and greatly enhances the ease of exploit development on today's platforms that combine standard ASLR and DEP (e.g. Windows 8). Specifically, we derail the assumptions embodied in fine-grained ASLR by exploiting the ability to repeatedly abuse a memory disclosure to map an application's memory layout on-the-fly, dynamically discover API functions and gadgets, and JIT-compile a target program using those gadgets-- all within a script environment at the time an exploit is launched. We demonstrate the power of our framework by using it in conjunction with a real-world exploit against Internet Explorer, show its effectiveness in Windows 8, and also provide extensive evaluations that demonstrate the practicality of just-in-time code reuse attacks. Our findings suggest that fine-grained ASLR may not be as promising as first thought.

Recorded Talk available on YouTube

Fine-grained address space layout randomization (ASLR) has recently been proposed as a method of efficiently mitigating runtime attacks. In this presentation, we introduce the design and implementation of a framework based on a novel attack strategy, dubbed just-in-time code reuse, which both undermines the benefits of fine-grained ASLR and greatly enhances the ease of exploit development on today's platforms that combine standard ASLR and DEP (e.g. Windows 8). Specifically, we derail the assumptions embodied in fine-grained ASLR by exploiting the ability to repeatedly abuse a memory disclosure to map an application's memory layout on-the-fly, dynamically discover API functions and gadgets, and JIT-compile a target program using those gadgets-- all within a script environment at the time an exploit is launched. We demonstrate the power of our framework by using it in conjunction with a real-world exploit against Internet Explorer, show its effectiveness in Windows 8, and also provide extensive evaluations that demonstrate the practicality of just-in-time code reuse attacks. Our findings suggest that fine-grained ASLR may not be as promising as first thought.

Runtime attacks on software aim at subverting the control-flow of an application by redirecting execution to injected malicious code. Trusted Computing technologies such as IBM's integrity measurement architecture (IMA) cannot prevent such attacks, because they mainly ensure the load-time integrity of applications. Many runtime attacks, however, are based on corrupting functions' return addresses so that the affected function does not return to its original caller, but to the adversary's injected code.

On the other hand, new attacks induce malicious behavior by only using existing code of linked libraries instead of injecting codes (particularly because the recently proposed memory protection mechanisms prevent the execution of injected code). These attacks are generally referred to as "return-oriented" attacks, since they return to code of already linked libraries. A particular powerful attack of this category are based on "return-oriented programming (ROP)". They combine various small instruction sequences of different functions to constitute arbitrary program behavior. The attack method has shown to be Turing-complete and has been deployed to a broad range of architectures: Intel x86, SPARC, Atmel AVR, ARM, etc. In this lecture we provide an overview on ROP for different hardware architectures and present recently available exploits which are built upon the principles of ROP. Finally, we will discuss possible countermeasures.

Runtime attacks on software aim at subverting the control-flow of an application by redirecting execution to injected malicious code. Trusted Computing technologies such as IBM's integrity measurement architecture (IMA) cannot prevent such attacks, because they mainly ensure the load-time integrity of applications. Many runtime attacks, however, are based on corrupting functions' return addresses so that the affected function does not return to its original caller, but to the adversary's injected code.

On the other hand, new attacks induce malicious behavior by only using existing code of linked libraries instead of injecting codes (particularly because the recently proposed memory protection mechanisms prevent the execution of injected code). These attacks are generally referred to as "return-oriented" attacks, since they return to code of already linked libraries. A particular powerful attack of this category are based on "return-oriented programming (ROP)". They combine various small instruction sequences of different functions to constitute arbitrary program behavior. The attack method has shown to be Turing-complete and has been deployed to a broad range of architectures: Intel x86, SPARC, Atmel AVR, ARM, etc. In this lecture we provide an overview on ROP for different hardware architectures and present recently available exploits which are built upon the principles of ROP. Finally, we will discuss possible countermeasures.