The Experts below are selected from a list of 33702 Experts worldwide ranked by ideXlab platform
Ahmad-reza Sadeghi - One of the best experts on this subject based on the ideXlab platform.
-
Counterfeit Object-oriented Programming: On the Difficulty of Preventing Code Reuse Attacks in C++ Applications
2015 IEEE Symposium on Security and Privacy, 2015Co-Authors: Felix Schuster, Ahmad-reza Sadeghi, Lucas Davi, Thomas Tendyck, Christopher Liebchen, Thorsten HolzAbstract:Code reuse Attacks such as return-oriented programming (ROP) have become prevalent Techniques to exploit memory corruption vulnerabilities in software programs. A variety of corresponding defenses has been proposed, of which some have already been successfully bypassed -- and the arms race continues. In this paper, we perform a systematic assessment of recently proposed CFI solutions and other defenses against code reuse Attacks in the context of C++. We demonstrate that many of these defenses that do not consider object-oriented C++ semantics precisely can be generically bypassed in practice. Our novel Attack Technique, denoted as counterfeit object-oriented programming (COOP), induces malicious program behavior by only invoking chains of existing C++ virtual functions in a program through corresponding existing call sites. COOP is Turing complete in realistic Attack scenarios and we show its viability by developing sophisticated, real-world exploits for Internet Explorer 10 on Windows and Fire fox 36 on Linux. Moreover, we show that even recently proposed defenses (CPS, T-VIP, vfGuard, and VTint) that specifically target C++ are vulnerable to COOP. We observe that constructing defenses resilient to COOP that do not require access to source code seems to be challenging. We believe that our investigation and results are helpful contributions to the design and implementation of future defenses against control flow hijacking Attacks.
-
counterfeit object oriented programming on the difficulty of preventing code reuse Attacks in c applications
IEEE Symposium on Security and Privacy, 2015Co-Authors: Felix Schuster, Ahmad-reza Sadeghi, Lucas Davi, Thomas Tendyck, Christopher Liebchen, Thorsten HolzAbstract:Code reuse Attacks such as return-oriented programming (ROP) have become prevalent Techniques to exploit memory corruption vulnerabilities in software programs. A variety of corresponding defenses has been proposed, of which some have already been successfully bypassed -- and the arms race continues. In this paper, we perform a systematic assessment of recently proposed CFI solutions and other defenses against code reuse Attacks in the context of C++. We demonstrate that many of these defenses that do not consider object-oriented C++ semantics precisely can be generically bypassed in practice. Our novel Attack Technique, denoted as counterfeit object-oriented programming (COOP), induces malicious program behavior by only invoking chains of existing C++ virtual functions in a program through corresponding existing call sites. COOP is Turing complete in realistic Attack scenarios and we show its viability by developing sophisticated, real-world exploits for Internet Explorer 10 on Windows and Fire fox 36 on Linux. Moreover, we show that even recently proposed defenses (CPS, T-VIP, vfGuard, and VTint) that specifically target C++ are vulnerable to COOP. We observe that constructing defenses resilient to COOP that do not require access to source code seems to be challenging. We believe that our investigation and results are helpful contributions to the design and implementation of future defenses against control flow hijacking Attacks.
-
stitching the gadgets on the ineffectiveness of coarse grained control flow integrity protection
USENIX Security Symposium, 2014Co-Authors: Lucas Davi, Ahmad-reza Sadeghi, Daniel Lehmann, Fabian MonroseAbstract:Return-oriented programming (ROP) offers a robust Attack Technique that has, not surprisingly, been extensively used to exploit bugs in modern software programs (e.g., web browsers and PDF readers). ROP Attacks require no code injection, and have already been shown to be powerful enough to bypass fine-grained memory randomization (ASLR) defenses. To counter this ingenious Attack strategy, several proposals for enforcement of (coarse-grained) control-flow integrity (CFI) have emerged. The key argument put forth by these works is that coarse-grained CFI policies are sufficient to prevent ROP Attacks. As this reasoning has gained traction, ideas put forth in these proposals have even been incorporated into coarse-grained CFI defenses in widely adopted tools (e.g., Microsoft's EMET framework). In this paper, we provide the first comprehensive security analysis of various CFI solutions (covering kBouncer, ROPecker, CFI for COTS binaries, ROP-Guard, and Microsoft EMET 4.1). A key contribution is in demonstrating that these Techniques can be effectively undermined, even under weak adversarial assumptions. More specifically, we show that with bare minimum assumptions, turing-complete and real-world ROP Attacks can still be launched even when the strictest of enforcement policies is in use. To do so, we introduce several new ROP Attack primitives, and demonstrate the practicality of our approach by transforming existing real-world exploits into more stealthy Attacks that bypass coarse-grained CFI defenses.
-
Mobile security and privacy: the quest for the mighty access control
… of the 18th ACM symposium on Access control models …, 2013Co-Authors: Ahmad-reza Sadeghi, Ar SadeghiAbstract:Mobile smart devices are changing our lives and are the emerging dominant computing platform for end-users. Mobile applications (apps) provide flexible access to critical services such as online banking, health records, enterprise applications, or social networks. The increasing computing and storage capabilities, new interfaces such as near field communication technology (NFC) or integration of hardware-based secure execution environments as well as rich context sensing capabilities have turned these devices to enablers for many useful (and fancy) applications. In particular, we consider two emerging trends with high commercial interest: smart devices as access tokens (e.g., in conjunction with NFC), and smart devices as powerful sensors for context-aware access control to resources. We elaborate on the functional, security, and privacy challenges to realizing these applications in practice. To tackle these challenges (and depending on the underlying use-case) we clearly need security and privacy protecting measures at different system abstraction layers (applications, operating system, and hardware) and we may need them simultaneously. Although mobile operating systems have been designed with security in mind from their infancy, they fail to resist sophisticated Attacks as shown recently. We observe diverse Attack vectors from application-level privilege escalation Attacks and sensory malware to runtime Attacks that hijack the execution flow of apps, in particular the recently proposed just-in-time return-oriented programming Attack Technique which circumvents fine-grained address space layout randomization. Moreover, runtime Attacks can be leveraged to compromise the underlying operating system through kernel based Attacks (e.g., root exploits) allowing an Attacker to get full control over the mobile device. In the recent years, researchers have presented many proposals to enhance the security and privacy at different abstraction layers with the strong focus on the Android operating system for obvious reasons (open-source and popularity). Investigating the large body of literature on Android security we observe that almost all proposals for security extensions to Android constitute mandatory access control (MAC) mechanisms that are tailored to the specific semantics of the addressed problem, for instance, establishing fine-grained access control to the user's private data or protecting the platform integrity. Moreover, these solutions consider protection mechanisms that operate only at a specific system abstraction layer, i.e., either at the middleware (and/or application) layer, or at the kernel-layer. In addition, security and privacy policy management itself would need to be made more context-aware and user-centric. We elaborate on security solutions (including our work) that aim to mitigate Attacks at application-level including control flow integrity (CFI) against runtime Attacks on mobile devices, and discuss their trade-offs. We then present a generic security architecture - inspired by concepts of the Flask architecture - for the Android OS which covers mandatory access control (MAC) on both the kernel- and middleware layers. It aims to serve as a flexible and effective ecosystem to instantiate different security solutions. Moreover, it aims at enforcing sensing- and context-based policies, e.g., using sensed contexts and their security-relevant properties to grant and deny access to device resources dynamically, in a truly context-aware manner. We then discuss further challenges in particular for deployment in practice Last but not least we leave the question open, how mighty the access control mechanisms should be on mobile smart devices to have an appropriate and reasonable trade-off of security, privacy and usability in practice.
-
return oriented programming without returns on arm
2010Co-Authors: Lucas Davi, Ahmad-reza Sadeghi, Alexandra Dmitrienko, Marcel WinandyAbstract:In this paper we present a novel and general memory-related Attack method on ARM-based computing platforms. Our Attack deploys the principles of return-oriented programming (ROP), however, in contrast to conventional ROP, it exploits jumps instead of returns, and hence it can not be detected by return address checkers. Although a similar Attack has been recently proposed for Intel x86, it was unclear if the Attack Technique can be deployed to ARM-based computing platforms as well. Developing a jump-based Attack on ARM is more involved, because ARM is based on a RSIC architecture which differs in many aspects from Intel’s x86 architecture. Nevertheless, we show a Turing-complete Attack that can induce arbitrary change of behavior in running programs without requiring code injection. As proof of concept, we instantiate our Attack method on the Android platform.
Lucas Davi - One of the best experts on this subject based on the ideXlab platform.
-
Counterfeit Object-oriented Programming: On the Difficulty of Preventing Code Reuse Attacks in C++ Applications
2015 IEEE Symposium on Security and Privacy, 2015Co-Authors: Felix Schuster, Ahmad-reza Sadeghi, Lucas Davi, Thomas Tendyck, Christopher Liebchen, Thorsten HolzAbstract:Code reuse Attacks such as return-oriented programming (ROP) have become prevalent Techniques to exploit memory corruption vulnerabilities in software programs. A variety of corresponding defenses has been proposed, of which some have already been successfully bypassed -- and the arms race continues. In this paper, we perform a systematic assessment of recently proposed CFI solutions and other defenses against code reuse Attacks in the context of C++. We demonstrate that many of these defenses that do not consider object-oriented C++ semantics precisely can be generically bypassed in practice. Our novel Attack Technique, denoted as counterfeit object-oriented programming (COOP), induces malicious program behavior by only invoking chains of existing C++ virtual functions in a program through corresponding existing call sites. COOP is Turing complete in realistic Attack scenarios and we show its viability by developing sophisticated, real-world exploits for Internet Explorer 10 on Windows and Fire fox 36 on Linux. Moreover, we show that even recently proposed defenses (CPS, T-VIP, vfGuard, and VTint) that specifically target C++ are vulnerable to COOP. We observe that constructing defenses resilient to COOP that do not require access to source code seems to be challenging. We believe that our investigation and results are helpful contributions to the design and implementation of future defenses against control flow hijacking Attacks.
-
counterfeit object oriented programming on the difficulty of preventing code reuse Attacks in c applications
IEEE Symposium on Security and Privacy, 2015Co-Authors: Felix Schuster, Ahmad-reza Sadeghi, Lucas Davi, Thomas Tendyck, Christopher Liebchen, Thorsten HolzAbstract:Code reuse Attacks such as return-oriented programming (ROP) have become prevalent Techniques to exploit memory corruption vulnerabilities in software programs. A variety of corresponding defenses has been proposed, of which some have already been successfully bypassed -- and the arms race continues. In this paper, we perform a systematic assessment of recently proposed CFI solutions and other defenses against code reuse Attacks in the context of C++. We demonstrate that many of these defenses that do not consider object-oriented C++ semantics precisely can be generically bypassed in practice. Our novel Attack Technique, denoted as counterfeit object-oriented programming (COOP), induces malicious program behavior by only invoking chains of existing C++ virtual functions in a program through corresponding existing call sites. COOP is Turing complete in realistic Attack scenarios and we show its viability by developing sophisticated, real-world exploits for Internet Explorer 10 on Windows and Fire fox 36 on Linux. Moreover, we show that even recently proposed defenses (CPS, T-VIP, vfGuard, and VTint) that specifically target C++ are vulnerable to COOP. We observe that constructing defenses resilient to COOP that do not require access to source code seems to be challenging. We believe that our investigation and results are helpful contributions to the design and implementation of future defenses against control flow hijacking Attacks.
-
stitching the gadgets on the ineffectiveness of coarse grained control flow integrity protection
USENIX Security Symposium, 2014Co-Authors: Lucas Davi, Ahmad-reza Sadeghi, Daniel Lehmann, Fabian MonroseAbstract:Return-oriented programming (ROP) offers a robust Attack Technique that has, not surprisingly, been extensively used to exploit bugs in modern software programs (e.g., web browsers and PDF readers). ROP Attacks require no code injection, and have already been shown to be powerful enough to bypass fine-grained memory randomization (ASLR) defenses. To counter this ingenious Attack strategy, several proposals for enforcement of (coarse-grained) control-flow integrity (CFI) have emerged. The key argument put forth by these works is that coarse-grained CFI policies are sufficient to prevent ROP Attacks. As this reasoning has gained traction, ideas put forth in these proposals have even been incorporated into coarse-grained CFI defenses in widely adopted tools (e.g., Microsoft's EMET framework). In this paper, we provide the first comprehensive security analysis of various CFI solutions (covering kBouncer, ROPecker, CFI for COTS binaries, ROP-Guard, and Microsoft EMET 4.1). A key contribution is in demonstrating that these Techniques can be effectively undermined, even under weak adversarial assumptions. More specifically, we show that with bare minimum assumptions, turing-complete and real-world ROP Attacks can still be launched even when the strictest of enforcement policies is in use. To do so, we introduce several new ROP Attack primitives, and demonstrate the practicality of our approach by transforming existing real-world exploits into more stealthy Attacks that bypass coarse-grained CFI defenses.
-
return oriented programming without returns on arm
2010Co-Authors: Lucas Davi, Ahmad-reza Sadeghi, Alexandra Dmitrienko, Marcel WinandyAbstract:In this paper we present a novel and general memory-related Attack method on ARM-based computing platforms. Our Attack deploys the principles of return-oriented programming (ROP), however, in contrast to conventional ROP, it exploits jumps instead of returns, and hence it can not be detected by return address checkers. Although a similar Attack has been recently proposed for Intel x86, it was unclear if the Attack Technique can be deployed to ARM-based computing platforms as well. Developing a jump-based Attack on ARM is more involved, because ARM is based on a RSIC architecture which differs in many aspects from Intel’s x86 architecture. Nevertheless, we show a Turing-complete Attack that can induce arbitrary change of behavior in running programs without requiring code injection. As proof of concept, we instantiate our Attack method on the Android platform.
Dan Meng - One of the best experts on this subject based on the ideXlab platform.
-
zipper stack shadow stacks without shadow
European Symposium on Research in Computer Security, 2020Co-Authors: Liwei Chen, Linan Tian, Gang Shi, Kai Chen, Dan MengAbstract:Return-Oriented Programming (ROP) is a typical Attack Technique that exploits return addresses to abuse existing code repeatedly. Most of the current return address protecting mechanisms (also known as the Backward-Edge Control-Flow Integrity) work only in limited threat models. For example, the Attacker cannot break memory isolation, or the Attacker has no knowledge of a secret key or random values.
-
zipper stack shadow stacks without shadow
arXiv: Cryptography and Security, 2019Co-Authors: Liwei Chen, Linan Tian, Gang Shi, Kai Chen, Dan MengAbstract:Return-Oriented Programming (ROP) is a typical Attack Technique that exploits return addresses to abuse existing code repeatedly. Most of the current return address protecting mechanisms (also known as the Backward-Edge Control-Flow Integrity) work only in limited threat models. For example, the Attacker cannot break memory isolation, or the Attacker has no knowledge of a secret key or random values. This paper presents a novel, lightweight mechanism protecting return addresses, Zipper Stack, which authenticates all return addresses by a chain structure using cryptographic message authentication codes (MACs). This innovative design can defend against the most powerful Attackers who have full control over the program's memory and even know the secret key of the MAC function. This threat model is stronger than the one used in related work. At the same time, it produces low-performance overhead. We implemented Zipper Stack by extending the RISC-V instruction set architecture, and the evaluation on FPGA shows that the performance overhead of Zipper Stack is only 1.86%. Thus, we think Zipper Stack is suitable for actual deployment.
Liwei Chen - One of the best experts on this subject based on the ideXlab platform.
-
zipper stack shadow stacks without shadow
European Symposium on Research in Computer Security, 2020Co-Authors: Liwei Chen, Linan Tian, Gang Shi, Kai Chen, Dan MengAbstract:Return-Oriented Programming (ROP) is a typical Attack Technique that exploits return addresses to abuse existing code repeatedly. Most of the current return address protecting mechanisms (also known as the Backward-Edge Control-Flow Integrity) work only in limited threat models. For example, the Attacker cannot break memory isolation, or the Attacker has no knowledge of a secret key or random values.
-
zipper stack shadow stacks without shadow
arXiv: Cryptography and Security, 2019Co-Authors: Liwei Chen, Linan Tian, Gang Shi, Kai Chen, Dan MengAbstract:Return-Oriented Programming (ROP) is a typical Attack Technique that exploits return addresses to abuse existing code repeatedly. Most of the current return address protecting mechanisms (also known as the Backward-Edge Control-Flow Integrity) work only in limited threat models. For example, the Attacker cannot break memory isolation, or the Attacker has no knowledge of a secret key or random values. This paper presents a novel, lightweight mechanism protecting return addresses, Zipper Stack, which authenticates all return addresses by a chain structure using cryptographic message authentication codes (MACs). This innovative design can defend against the most powerful Attackers who have full control over the program's memory and even know the secret key of the MAC function. This threat model is stronger than the one used in related work. At the same time, it produces low-performance overhead. We implemented Zipper Stack by extending the RISC-V instruction set architecture, and the evaluation on FPGA shows that the performance overhead of Zipper Stack is only 1.86%. Thus, we think Zipper Stack is suitable for actual deployment.
Thorsten Holz - One of the best experts on this subject based on the ideXlab platform.
-
Counterfeit Object-oriented Programming: On the Difficulty of Preventing Code Reuse Attacks in C++ Applications
2015 IEEE Symposium on Security and Privacy, 2015Co-Authors: Felix Schuster, Ahmad-reza Sadeghi, Lucas Davi, Thomas Tendyck, Christopher Liebchen, Thorsten HolzAbstract:Code reuse Attacks such as return-oriented programming (ROP) have become prevalent Techniques to exploit memory corruption vulnerabilities in software programs. A variety of corresponding defenses has been proposed, of which some have already been successfully bypassed -- and the arms race continues. In this paper, we perform a systematic assessment of recently proposed CFI solutions and other defenses against code reuse Attacks in the context of C++. We demonstrate that many of these defenses that do not consider object-oriented C++ semantics precisely can be generically bypassed in practice. Our novel Attack Technique, denoted as counterfeit object-oriented programming (COOP), induces malicious program behavior by only invoking chains of existing C++ virtual functions in a program through corresponding existing call sites. COOP is Turing complete in realistic Attack scenarios and we show its viability by developing sophisticated, real-world exploits for Internet Explorer 10 on Windows and Fire fox 36 on Linux. Moreover, we show that even recently proposed defenses (CPS, T-VIP, vfGuard, and VTint) that specifically target C++ are vulnerable to COOP. We observe that constructing defenses resilient to COOP that do not require access to source code seems to be challenging. We believe that our investigation and results are helpful contributions to the design and implementation of future defenses against control flow hijacking Attacks.
-
counterfeit object oriented programming on the difficulty of preventing code reuse Attacks in c applications
IEEE Symposium on Security and Privacy, 2015Co-Authors: Felix Schuster, Ahmad-reza Sadeghi, Lucas Davi, Thomas Tendyck, Christopher Liebchen, Thorsten HolzAbstract:Code reuse Attacks such as return-oriented programming (ROP) have become prevalent Techniques to exploit memory corruption vulnerabilities in software programs. A variety of corresponding defenses has been proposed, of which some have already been successfully bypassed -- and the arms race continues. In this paper, we perform a systematic assessment of recently proposed CFI solutions and other defenses against code reuse Attacks in the context of C++. We demonstrate that many of these defenses that do not consider object-oriented C++ semantics precisely can be generically bypassed in practice. Our novel Attack Technique, denoted as counterfeit object-oriented programming (COOP), induces malicious program behavior by only invoking chains of existing C++ virtual functions in a program through corresponding existing call sites. COOP is Turing complete in realistic Attack scenarios and we show its viability by developing sophisticated, real-world exploits for Internet Explorer 10 on Windows and Fire fox 36 on Linux. Moreover, we show that even recently proposed defenses (CPS, T-VIP, vfGuard, and VTint) that specifically target C++ are vulnerable to COOP. We observe that constructing defenses resilient to COOP that do not require access to source code seems to be challenging. We believe that our investigation and results are helpful contributions to the design and implementation of future defenses against control flow hijacking Attacks.
-
on the fragility and limitations of current browser provided clickjacking protection schemes
WOOT'12 Proceedings of the 6th USENIX conference on Offensive Technologies, 2012Co-Authors: Sebastian Lekies, Mario Heiderich, Dennis Appelt, Thorsten Holz, Martin JohnsAbstract:An important and timely Attack Technique on the Web is Clickjacking (also called UI redressing), in which an Attacker tricks the unsuspicious victim into clicking on a specific element without his explicit knowledge about where he is actually clicking. In order to protect their websites from being exploitable, many web masters deployed different countermeasures to this kind of Attack. In this paper, we explore the limitations and shortcomings of current anti-clickjacking approaches and present several bypasses of state-of-the-art tools, including an Attack we call Nested Clickjacking that enables us to perform Clickjacking against the social network Google+. Furthermore, we present the results of a large scale empirical study on the usage of current anti-clickjacking mechanisms on about 2 million web pages. The results of our analysis show that about 15% of the analyzed web sites protect themselves against Clickjacking.