Undermining Information Hiding (and What to Do about It)
summary
Demonstrates that thread spraying forces many per-thread safe regions and reduces SafeStack entropy so an attacker locates a SafeStack found in 3 seconds against a Firefox proof-of-concept; Chrome and MySQL exploits raise thread counts from ~50–60 to hundreds and from 150 to 1k respectively. Builds an Authenticating Page Mapper that uses a userland page-fault handler to authenticate first accesses to guarded pages, hardening hiding while costing negligible runtime and reporting APM increases overhead 0.3% on SPEC.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:27Overview
- 2:51Code Reuse Attack
- 4:43Code Pointers
- 7:30Safe Areas
- 8:31Information Hiding
- 9:40Entropy
- 15:59PageMapper
- 17:03Authentication
- 19:53Performance Overhead
- 20:33Inflation Factor
- 22:16Limitations
- 22:52Conclusion
related talks
45mAbusing Performance Optimization Weaknesses to Bypass ASLR
15mUnsafe LLM-Based Search: Quantitative Analysis and Mitigation of Safety...
33mHacking The Front-End
46mBreaking Out HSTS (and HPKP) On Firefox, IE/Edge and (Possibly) Chrome
35mOn Securing Legacy Software Against Code-Reuse Attacks
41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways
52mSecuring The Unseen: Vulnerability Research In Confidential Computing
51mExploiting Hardware Glitches And Side Channels In Perfect Software