The Beast is in Your Memory
summary
Claims that coarse-grained CFI (kBouncer, ROPGuard, ROPecker and EMET) stop ROP are false: researchers transform publicly available Windows exploits to bypass combined defenses and EMET 4.1, requiring no special assumptions. Attack uses two concrete gadget types—a function call gadget and a long no-op gadget—and shows a 1MB kernel32.dll yields a Turing-complete gadget set. Heuristics thresholds (example N=8, S=20) and LBR-based checks are evaded; demos against Adobe Reader succeed.
AI-written summary · about
chapters (26)
- 0:00Intro
- 1:08Outline
- 2:55Motivation
- 4:18Runtime Attacks
- 6:13Return-Oriented Programming (ROP) - Basic Idea
- 6:49ROP Adversary Model/Assumptions
- 8:23ROP Attack Technique: Overview
- 9:28ROP Attack History - Selected
- 12:50CFI Implementation based on Labels
- 13:41Original CFI Proposal: Cons & Pros
- 14:39Solution Proposals: "Coarse-Grained CFI" Making of practical for real-world deployment
- 15:51General Idea
- 16:55Heuristics: Reducing False Negatives
- 17:16"Coarse-Grained" CFI Proposals
- 20:29Policy 1: Call-Preceded Return Address
- 22:39Policy 2: Chain of Short Sequences
- 24:42Contribution
- 26:01Taking the Most Restrictive Setting in Coarse Grained CFI
- 27:49Our Methodology and Workflow
- 31:07Turing-Complete Gadget Set in kernel32.dll
- 32:06Turing-Complete Gadget Set (contd.)
- 34:25Long NOP Gadget
- 38:40EMET'S ROP Mitigations
- 40:03Related Attacks
- 41:36Real-World Exploitation
- 46:44Conclusion and Future Work
related talks
35mOn Securing Legacy Software Against Code-Reuse Attacks
52mUsing EMET to Disable EMET
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
48mCapturing 0Day Exploits With Perfectly Placed Hardware Traps
33mOver the Edge: Silently Owning Windows 10's Secure Browser
50mThe Beast Within - Evading Dynamic Malware Analysis Using Microsoft COM
40mBeyond Living-Off-the-Land: Why XP Exploits Still Matter
01h 00mIntroduction to memory exploitation