Abstract:The wide-spread adoption of system defenses such as the randomization of code, stack, and heap raises the bar for code-reuse attacks. Thus, attackers utilize a scripting engine in target programs like a web browser to prepare the code-reuse chain, e.g., relocate gadget addresses or perform a just-in-time gadget search. However, many types of programs do not provide such an execution context that an attacker can use. Recent advances in data-oriented programming (DOP) explored an orthogonal way to abuse memory corruption vulnerabilities and demonstrated that an attacker can achieve Turing-complete computations without modifying code pointers in applications. As of now, constructing DOP exploits requires a lot of manual work. In this paper, we present novel techniques to automate the process of generating DOP exploits. We implemented a compiler called Steroids that compiles our high-level language SLANG into low-level DOP data structures driving malicious computations at run time. This enables an attacker to specify her intent in an application- and vulnerability-independent manner to maximize reusability. We demonstrate the effectiveness of our techniques and prototype implementation by specifying four programs of varying complexity in SLANG that calculate the Levenshtein distance, traverse a pointer chain to steal a private key, relocate a ROP chain, and perform a JIT-ROP attack. Steroids compiles each of those programs to low-level DOP data structures targeted at five different applications including GStreamer, Wireshark, and ProFTPd, which have vastly different vulnerabilities and DOP instances. Ultimately, this shows that our compiler is versatile, can be used for both 32- and 64-bit applications, works across bug classes, and enables highly expressive attacks without conventional code-injection or code-reuse techniques in applications lacking a scripting engine.

DSLR–: A Low-Overhead Data Structure Layout Randomization for Defending Data-Oriented Programming

Feedback Control Can Make Data Structure Layout Randomization More Cost-Effective under Zero-Day Attacks

A Practical Approach for Adaptive Data Structure Layout Randomization.

Defending ROP Attacks Using Basic Block Level Randomization

ROP Defense Using Trie Graph for System Security.

Steroids for DOPed Applications: A Compiler for Automated Data-Oriented Programming

Program Attack and Protection Based on Return-Oriented Programming

Loop-Oriented Programming: A New Code Reuse Attack to Bypass Modern Defenses

Key-area Cyberspace Mimic Defense Against Data-Oriented Attacks

What You See is Not What You Get! Thwarting Just-in-Time ROP with Chameleon

LoadLord: Loading on the Fly to Defend Against Code-Reuse Attacks

A Dynamic Detection Method Against ROP and JOP

Instantly Obsoleting the Address-code Associations: A New Principle for Defending Advanced Code Reuse Attack

Runtime Code Reuse Attacks: A Dynamic Framework Bypassing Fine-Grained Address Space Layout Randomization.

Breaking and Fixing Destructive Code Read Defenses

Layered Object-Oriented Programming: Advanced VTable Reuse Attacks on Binary-Level Defense

HRPDF: A Software-Based Heterogeneous Redundant Proactive Defense Framework for Programmable Logic Controller.

An Effective Approach of Detecting Return-Oriented-Programming Attacks

ROPSentry: Runtime Defense Against ROP Attacks Using Hardware Performance Counters.

De-randomizing the Code Segment with Timing Function Attack

IDROP: Intelligently Detecting Return-Oriented Programming Using Real-Time Execution Flow and LSTM