As I was reading about the advanced exploits such as Return Oriented Programming (ROP), Retun-to-libc, etc., I came across many defenses to these attacks including techniques like ASLR, kBouncer, ROP Defender, etc. But when I went into details of each of these techniques, I found out that each of these defenses can be overcome by making some changes to our approach.

I'm very curious to know how actually modern operating systems are taking care of these kind of advanced exploits. Anyone with expert insights on this topic?


I believe the standard anti-exploit setup is (on Windows and Linux at least): DEP, Stack Guard, hardened heap, and ASLR (sorry, I don't have a reference for this). As you point out, all these techniques can be circumvented, with varying degrees of difficulty, and ROP is one of the main techniques. ASLR provides some defence against ROP but I believe all the other ROP defences you mention are experimental and not used as standard. They may exist in certain anti-virus and host hardening products.

I work with a very skilled exploit developer, and he is usually able to create a reliable exploit for a memory corruption flaw, even with these defences in place. Bear in mind that many attacks these days are Java/JavaScript sandbox escapes where a large attack surface is exposed compared to a network buffer overrun. Also, a lot of exploits are use-after-free flaws which bypass Stack Guard and the hardened heap.

|improve this answer|||||

You are correct that techniques like DEP or ASLR can be circumvented with enough effort.

However, you are missing the point that this techniques serve to mitigate whatever damage has already occurred. It does so by making it difficult for an attacker to achieve code execution. The root cause of the problems that you listed are bad code. For example, a buffer overflow is caused by a piece of code trying to write more data into a buffer than it has been allocated. The proper way to solve this issues are to make sure that such events never occur at all. Obviously, this is rather difficult to do in a large codebase. You can however fix this by coding in a languages which protects you from such memory issues like Java, Python or Ruby. Don't use C or C++ unless you absolutely know what you are doing.

|improve this answer|||||
  • I'd recommend changing that to "don't write code unless you absolutely know what you're doing." A fool with a tool can produce vulnerabilities in any language - managed languages just hide their incompetence a bit longer. – John Deters Oct 21 '13 at 3:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.