Poking Holes in Information Hiding
summary
Shows an allocation oracle attack that infers the sizes of unmapped address-space holes by repeatedly triggering large allocations and observing success or failure, using an ephemeral allocation primitive to binary-search a hole (reducing entropy to one bit) and a persistent allocation primitive to fill it, then an arbitrary read to distinguish hidden-page data from zeros. Works on 32/64-bit Linux, verified against nginx, lighty, bind and mysql, and needs as few as 37 probes in worst-case tests.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:07Teaser
- 1:39ASLR today
- 4:22Ideal information hiding
- 8:44So look for the holes
- 9:50Ephemeral Allocation Primitive
- 11:47Algorithm to find L
- 13:52Persistent Allocation Primitive
- 15:10Ephemeral + persistent yields final bit
- 17:02Here is what we do
- 21:04Examples
- 23:11How fast is it?
- 24:27Assumption
- 25:21Conclusion
- 27:20Discovered primitives
related talks
37mHouse of Einherjar — Yet Another Heap Exploitation Technique on GLIBC
37mHeap Layout Optimisation for Exploitation
41mUsing Microarchitectural Design to Break KASLR and More
37mDerandomizing Kernel Object Locations w Software Hardware-Induced Side Channels
44mHands Off and Putting SLAB/SLUB Feng Shui in a Blackbox
22mHeapHopper: Bringing Bounded Model Checking to Heap Implementation Security
51mAutomation Techniques in C++ Reverse Engineering
15mTAILCHECK: A Lightweight Heap Overflow Detection Mechanism with Page Protection and...