Return and Re-Enter: Modern Software Attack Techniques and Defenses - Invited Talk

Autor(en):

Davi, Lucas

Name der Veranstaltung:

Cybersecurity Speaker Series at Northeastern University

Ort:

Boston, USA

Datum:

31.10.2018

Abstract

Software attacks exploit vulnerabilities in programs to trigger malicious operations and steal sensitive data. While existing attacks have mainly focused on classic desktop PCs and mobile systems, they are increasingly applied to modern software systems such as smart contracts. In this talk, we investigate two prevalent software attack techniques, namely return-oriented programming and re-entrancy attacks. The former attack technique leverages a malicious combination of benign code sequences to compromise web browsers and document viewers, whereas the latter exploits state inconsistencies to drain money out of a smart contract. For both, we discuss their evolution and investigate the challenges when building defenses against these attacks.