Abstract:—Many mechanisms have been proposed and de-ployed to prevent exploits against software vulnerabilities. Amongthem, W X is one of the most effective and efﬁcient. W Xprevents memory pages from being simultaneously writableand executable, rendering the decades old shellcode injectiontechnique infeasible.In this paper, we demonstrate that the traditional shellcodeinjection attack can be revived through a code cache injectiontechnique. Speciﬁcally, dynamic code generation, a techniquewidely used in just-in-time (JIT) compilation and dynamic binarytranslation (DBT), generates and modiﬁes code on the ﬂy in orderto promote performance or security. The dynamically generatedcode fragments are stored in a code cache, which is writableand executable either at the same time or alternately, resultingin an opportunity for exploitation. This threat is especiallyrealistic when the generated code is multi-threaded, becauseswitching between writable and executable leaves a time windowfor exploitation. To illustrate this threat, we have crafted a proof-of-concept exploit against modern browsers that support WebWorkers.To mitigate this code cache injection threat, we propose anew dynamic code generation architecture. This new architecturerelocates the dynamic code generator to a separate process,in which the code cache is writable. In the original processwhere the generated code executes, the code cache remains read-only. The code cache is synchronized across the writing processand the execution process through shared memory. Interactionbetween the code generator and the generated code is handledtransparently through remote procedure calls (RPC). We haveported the Google V8 JavaScript engine and the Strata DBTto this new architecture. Our implementation experience showedthat the engineering effort for porting to this new architectureis minimal. Evaluation of our prototype implementation showedthat this new architecture can defeat the code cache injectionattack with small performance overhead.

A vulnerability in Google AdSense: Automatic extraction of links to ads

Abusing Browser Address Bar for Fun and Profit - An Empirical Investigation of Add-On Cross Site Scripting Attacks.

XSS Peeker: A Systematic Analysis of Cross-site Scripting Vulnerability Scanners

Understanding In-App Ads and Detecting Hidden Attacks Through the Mobile App-Web Interface

TRAP: Using Targeted ads to unveil Google personal profiles

Off-Path Attacking the Web

A Robust Server-Side JavaScript Feature Injection-Based Design for JSP Web Applications Against XSS Vulnerabilities

Twenty-two years since revealing cross-site scripting attacks: a systematic mapping and a comprehensive survey

A Hybrid Dynamic Testing technology source code XSS vulnerability detection method

Cross Channel Scripting and Code Injection Attacks on Web and Cloud-Based Applications: A Comprehensive Review

Measuring Abuse in Web Push Advertising

All Your App Links Are Belong to Us: Understanding the Threats of Instant Apps Based Attacks

Boosting Big Brother: Attacking Search Engines with Encodings

The Devil is in the Details: Analyzing the Lucrative Ad Fraud Patterns of the Online Ad Ecosystem

Exposing and Addressing Security Vulnerabilities in Browser Text Input Fields

The Master and Parasite Attack

Android Malicious AD Threat Analysis and Detection Techniques

Accessibility Issues in Ad-Driven Web Applications

Exploiting and Protecting Dynamic Code Generation.

Automatic Web Security Unit Testing: XSS Vulnerability Detection

AdverSPAM: Adversarial SPam Account Manipulation in Online Social Networks