At IEEE Security & Privacy, the blind return-oriented programming attack (blind ROP) was just introduced. In some sense, this is just another variation on ROP attacks -- but the blind ROP attack is notable because it does not require any knowledge of the source code or the binary of the program you are attacking; you can attack "blind". Also, their attack is entirely automated, so it is very easy for attackers to use, and it defeats ASLR and DEP. Thus, this seems like a new kind of threat that might become attractive to attackers and is worth defending against.
How should we defend against blind ROP? What are the best available defenses that we can deploy today? How can/should we harden our servers and applications against blind ROP attacks?
- Hacking Blind, Andrea Bittau, Adam Belay, Ali Mashtizadeh, David Mazieres, Dan Boneh, IEEE Security & Privacy 2014.