Abstract:Heap spraying is an attack technique commonly used in hijacking browsers to download and execute malicious code. In this attack, attackers first fill a large portion of the victim process's heap with malicious code. Then they exploit a vulnerability to redirect the victim process's control to attackers' code on the heap. Because the location of the injected code is not exactly predictable, traditional heap-spraying attacks need to inject a huge amount of executable code to increase the chance of success. Injected executable code usually includes lots of NOP-like instructions leading to attackers' shellcode. Targeting this attack characteristic, previous solutions detect heap-spraying attacks by searching for the existence of such large amount of NOP sled and other shellcode. In this paper, we analyze the implication of modern operating systems' memory allocation granularity and present Heap Taichi, a new heap spraying technique exploiting the weakness in memory alignment. We describe four new heap object structures that can evade existing detection tools, as well as proof-of-concept heap-spraying code implementing our technique. Our research reveals that a large amount of NOP sleds is not necessary for a reliable heap-spraying attack. In our experiments, we showed that our heap-spraying attacks are a realistic threat by evading existing detection mechanisms. To detect and prevent the new heap-spraying attacks, we propose enhancement to existing approaches and propose to use finer memory allocation granularity at memory managers of all levels. We also studied the impact of our solution on system performance.

Research on Detection of Vulnerability-Exploiting Technology Heap Spray

Heap Taichi: exploiting memory allocation granularity in heap-spraying attacks

Progress in Research on Buffer Overflow Vulnerability Analysis Technologies

Test Method on Code Injection Vulnerabilities of Web Application

AutoPwn: Artifact-Assisted Heap Exploit Generation for CTF PWN Competitions

Research and Development of Worm Detection Technologies

Evolution of Exploitation and Exploit Mitigation

HeapTherapy: An Efficient End-to-End Solution against Heap Buffer Overflows

Buffer Overflow Attacks Analysis and Real-time Detection

An Empirical Study on Detecting and Fixing Buffer Overflow Bugs

Towards Efficient Heap Overflow Discovery

Research on Principle and Defense of Buffer Overflow Attacks

Take a Step Further: Understanding Page Spray in Linux Kernel Exploitation

JIT-spraying prevention mechanism based on instruction padding randomization

Detecting heap smashing attacks through fault containment wrappers

Defense Buffer Overflow in Code Writing

JIT Spraying and Mitigations

IE Browser the Attack Key Technology Research

Automatically Assessing Crashes from Heap Overflows

Exploit-oriented Automated Information Leakage

Technology to Prevent Buffer Overflow Attacks Based on CPU Hardware