0

I have been studying up on the concept of Just-in-Time (JIT) ROP attack (https://cs.unc.edu/~fabian/papers/oakland2013.pdf), and came across this question which I have not been able to find the definite answer.

In the above paper, the authors state that their attack is not related to JIT compilers, and the term JIT is simply used to denote that the payload is generated during the runtime.

However, in their JIT-ROP architecture, they uses LLVM (which has JIT compilation) and from reading this SoK regarding JIT attacks (https://www.usenix.org/conference/woot18/presentation/gawlik), the authors state

we surveyed the affected targets on the x86 and ARM architecture and established a connection to code-reuse attacks which abuse JIT compilers

which makes me believe that the JIT-compilers are indeed needed in order to successfully launch JIT-ROP attack (personally I think JIT is needed, since you need to be able to recompile victim's source code with found API pointers + necessary gadgets during runtime with escalated privilege). Also alot of JIT-related attacks are launched in the web browsers such as Chrome (V8), Firefox (IonMonkey) and Microsoft Edge (Chakra).

Could someone please clarify whether JIT-compiler is required to launch JIT-ROP attack?

  • Are you asking if the attacker needs a JIT compiler, or if the target browser does? – forest Apr 9 at 20:21
  • Sorry, I should've been cleared on that regard. I meant the attacker (regardless of the target). – zzang3 Apr 9 at 20:24
  • What is your definition of required? You can write bytecode without a compiler. – forest Apr 9 at 20:28
  • In this case, I believe my definition of required is whether the JIT compiler is required in order to compile the ROP payload. From my understanding of bytecode, it is a low-level code (intermediate representation?) which is useful in a different kind of JIT attack that do not leverage ROP payload. For the case of JIT-ROP attack, the adversaries are basically constructing a payload after dynamically finding the necessary gadgets during the runtime. Therefore, I was wondering whether JIT-ROP attack requires JIT-compiler, or any kind of compiler (such as gcc) is okay – zzang3 Apr 9 at 20:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.