ASLR on the Line Ben Gras, Kaveh Razavi, Erik Bosman , Herbert Bos, - PowerPoint PPT Presentation

Aug 24, 2023 •374 likes •1.75k views

ASLR on the Line Ben Gras, Kaveh Razavi, Erik Bosman , Herbert Bos, Cris ano Giu ff rida VUSec Erik Bosman @brainsmoke Kaveh Razavi @gober Ben Gras @bjg Stephan van Schaik ASLR Address Space Layout Randomiza on Widely deployed

7 F 8 3 B 6 3 7 3 0 4 0 7F83B6372040 virtual address lookup (x86_64)
TLB miss!
CR3
511 512 entries 0 CR3
255 511 512 entries 0 CR3
255 512 entries CR3
255 14 512 entries CR3
255 14 512 entries CR3
255 14 433 512 entries CR3
255 14 433 512 entries CR3
255 14 433 370 512 entries CR3
255 14 433 370 actual data CR3
255 14 433 370 64 actual data CR3
255 14 433 370 64 actual data CR3 4K page
255 14 433 370 64 CR3 4K page
255 14 433 370 64 CR3 4K page
Observa � on: address informa � on is directly encoded into the page table lookups, and page tables are pages themselves.
255 14 433 370 64 CR3 4K page
255 14 433 370 64 CR3 4K page 4K page 4K page 4K page 4K page
255 14 433 370 64 CR3 4K page 4K page 4K page 4K page 4K page
CR3
255 ... 256 255 254 253 252 251 250 249 248 ... 247
255 ... 256 255 254 253 ? 1 Cache line = 252 64 bytes = 251 8 possible 250 page table 249 entries 248 ... 247
255 ... 256 255 254 253 ? 1 Cache line = 252 64 bytes = 251 8 possible 250 page table 249 entries 248 ... 247
255 ... 256 255 254 253 ? 1 Cache line = 252 64 bytes = 251 8 possible 250 page table 249 entries 248 ... 247 cache line reveals 6 address bits
255 14 433 370 64

Download Presentation

Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Jump Over ASLR: Attacking Branch Predictors to Bypass ASLR Presentation by Eric Newberry and

Jump Over ASLR: Attacking Branch Predictors to Bypass ASLR Presentation by Eric Newberry and Youssef Tobah Paper by Dmitry Evtyushkin, Dmitry Ponomarev, and Nael Abu-Ghazaleh 1 Motivation Buffer overflow attacks modify the control flow of a

1.6k views • 17 slides

ASLR / NX / Bounds Checking 1 last time stack canaries less-compatible alternative: shadow

ASLR / NX / Bounds Checking 1 last time stack canaries less-compatible alternative: shadow stacks page-level protection RELRO protect global ofgset table guard pages around memory allocations/etc. start ASLR choose random addresses

1.1k views • 73 slides

On the effectiveness of Full-ASLR on 64-bit Linux Hector Marco-Gisbert , Ismael Ripoll Universit`

On the effectiveness of Full-ASLR on 64-bit Linux Hector Marco On the effectiveness of Full-ASLR on 64-bit Linux Hector Marco-Gisbert , Ismael Ripoll Universit` at Polit` ecnica de Val` encia (Spain) In-Depth Security Conference (DeepSec)

1.05k views • 62 slides

On the effectiveness of NX, SSP, RenewSSP and ASLR against stack buffer overflows Hector

On the effectiveness of NX, SSP, RenewSSP and ASLR against stack buffer overflows Hector Marco On the effectiveness of NX, SSP, RenewSSP and ASLR against stack buffer overflows Hector Marco-Gisbert , Ismael Ripoll Universit` at Polit` ecnica

528 views • 35 slides

From Zygote to Morula: For0fying Weakened ASLR on Android

From Zygote to Morula: For0fying Weakened ASLR on Android Byoungyoung Lee Long Lu Tielei Wang Taesoo Kim Wenke Lee Georgia Tech,

635 views • 30 slides

Lec06: DEP and ASLR Taesoo Kim 2 Scoreboard 3 Administrivia Due: Lab04 is extended for

1 Lec06: DEP and ASLR Taesoo Kim 2 Scoreboard 3 Administrivia Due: Lab04 is extended for one week! Due: Lab05 is out and its due on Oct 5 at midnight Lab10: NSA Codebreaker Challenge Due: Nov 29 Offline CTF (Nov

880 views • 19 slides

String Oriented Programming: When ASLR is not enough Mathias Payer* and Thomas R. Gross

String Oriented Programming: When ASLR is not enough Mathias Payer* and Thomas R. Gross Department of Computer Science ETH Zrich, Switzerland * now at UC Berkeley Current protection is not complete http://creoflick.net 2 Motivation:

639 views • 33 slides

ASLR-Guard: Stopping Address Space Leakage for Code Reuse

ASLR-Guard: Stopping Address Space Leakage for Code Reuse A9acks Kangjie Lu, Chengyu Song, Byoungyoung Lee, Simon P. Chung, Taesoo Kim, Wenke Lee

605 views • 45 slides

Lec06: DEP and ASLR Taesoo Kim 2 Scoreboard 3 NSA Codebreaker Challenges 4 Administrivia

1 Lec06: DEP and ASLR Taesoo Kim 2 Scoreboard 3 NSA Codebreaker Challenges 4 Administrivia Congrats!! We've completed the half of labs! Due: Lab06 is out and its due on Oct 5 at midnight NSA Codebreaker Challenge Due:

1.13k views • 43 slides

How to Make ASLR Win the Clone Wars: Runtime Re-Randomization Kangjie Lu , Stefan Nrnberger,

How to Make ASLR Win the Clone Wars: Runtime Re-Randomization Kangjie Lu , Stefan Nrnberger, Michael Backes, and Wenke Lee Georgia Tech, CISPA, Saarland University, MPI-SWS, DFKI RuntimeASLR 1 What did we do? We re-randomize the memory

833 views • 44 slides

String Oriented Programming Circumventing ASLR, DEP, and other Guards Mathias Payer, ETH Zrich

String Oriented Programming Circumventing ASLR, DEP, and other Guards Mathias Payer, ETH Zrich Motivation Additional protection mechanisms prevent many existing attack vectors Format string exploits are often overlooked Drawback: hard to

640 views • 26 slides

Abusing Performance Optimization Weaknesses to Bypass ASLR Byoungyoung Lee Yeongjin Jang Tielei

Abusing Performance Optimization Weaknesses to Bypass ASLR Byoungyoung Lee Yeongjin Jang Tielei Wang Chengyu Song Long Lu Taesoo Kim Wenke Lee Georgia Tech Information Security Center (Rough) System Attack Trends Executing existing code

661 views • 50 slides

Binary Exploitation 1 Buffer Overflows (return-to-libc, ROP, Canaries, W^X, ASLR) Chester

Binary Exploitation 1 Buffer Overflows (return-to-libc, ROP, Canaries, W^X, ASLR) Chester Rebeiro Indian Institute of Technology Madras Parts of Malware Two parts Subvert execution: change the normal execution behavior of the program

1.25k views • 102 slides

Outline Return address protections ASLR and counterattacks CSci 5271 Introduction to Computer

Outline Return address protections ASLR and counterattacks CSci 5271 Introduction to Computer Security W X (DEP) Low-level defenses and counterattacks Announcements (combined lecture) Return-oriented programming (ROP) Stephen McCamant

699 views • 12 slides

ASLR & DEP DAVID HEAVERN Problem Statement Security Issues Buffer Overflows

ASLR & DEP DAVID HEAVERN Problem Statement Security Issues Buffer Overflows Buffer overflows are the source of many of the common vulnerabilities in modern software Caused by not checking the source length when writing to a

1.88k views • 130 slides

Control Flow Integrity Behavior-based detection Stack canaries, non-executable data, and ASLR

Control Flow Integrity Behavior-based detection Stack canaries, non-executable data, and ASLR aim to complicate various steps in a standard attack But they still may not stop it Idea: observe the programs behavior is it doing

314 views • 17 slides

Memory Management ! Logical vs. physical address space ! Fragmentation ! Paging !

CPSC 410/611 : Operating Systems Memory Management ! Logical vs. physical address space ! Fragmentation ! Paging ! Segmentation ! Reading: Doeppner 7.1, 7.2 ! Memory Management ! Observations: ! Process needs at least CPU

158 views • 12 slides

TOS Arno Puder 1 Objective Explain the x86 segmentation model Explain how a virtual

TOS Arno Puder 1 Objective Explain the x86 segmentation model Explain how a virtual address is translated by the x86 to a physical address Explain the various x86 datastructures and hardware registers 2 Loading of Programs (1)

607 views • 21 slides

Main Memory - II Tevfik Ko ar Louisiana State University March 27 th , 2008 1 Paging Example

CSC 4103 - Operating Systems Spring 2008 Lecture - XIV Main Memory - II Tevfik Ko ar Louisiana State University March 27 th , 2008 1 Paging Example 20 Users View of a Program 24 Segmentation Memory-management scheme that

279 views • 8 slides

Module 8: Memory Management Background Logical versus Physical Address Space Swapping

Module 8: Memory Management Background Logical versus Physical Address Space Swapping Contiguous Allocation Paging Segmentation Segmentation with Paging Operating System Concepts 8.1 Silberschatz and Galvin 1999

913 views • 41 slides

Virtual Memory 2 Schedule Please note that HW #14

Computer Systems and Networks ECPE 170 Jeff Shafer University of the Pacific Virtual Memory 2 Schedule Please note that HW #14

877 views • 39 slides

CS 31: Intro to Systems Virtual Memory Martin Gagne Swarthmore College April 6, 2017 Recap

CS 31: Intro to Systems Virtual Memory Martin Gagne Swarthmore College April 6, 2017 Recap We cant load processes into memory on every context switch like we do with CPU state. Finding a place to put processes when we allocate

854 views • 56 slides

Address Binding For a program to execute it must be copied into main memory at a particular

Address Binding For a program to execute it must be copied into main memory at a particular location. Many instructions use 'fixed' addresses which must be bound to 'fixed' locations in the memory. This binding of instructions and data to

461 views • 4 slides

Physical Layer Physical Layer Transfers bits through signals overs links Wires etc. carry

Physical Layer Physical Layer Transfers bits through signals overs links Wires etc. carry analog signals We want to send digital bits 10110 10110 Signal CSE 461 University of Washington 2 Topics 1. Coding and Modulation

1.02k views • 53 slides