6 ms·
Does this mean that it will no longer be possible to do things like return-oriented programming? LE: indeed, it's quite clear from the mentioned article (http
by ekr 11y ago
Does this mean that it will no longer be possible to do things like return-oriented programming?
LE: indeed, it's quite clear from the mentioned article (http://dslab.epfl.ch/pubs/cpi.pdf http://dslab.epfl.ch/pubs/cpi.pdf). So this provides great exploit protection.
- agumonkey 11y agoAccidentally downvoted you. My apologies.
- viraptor 11y agoUpvoted for you.
- VMG 11y agoIf only there was a way to space those two tiny arrows further apart. Let's hope science comes up with a way some day..
- agumonkey 11y agoHN is a mind hack to exercise your jquery skills.
- kbenson 11y agoThe best explanation I've heard for HN's lack of some features is that any HN power user is expected to find a solution for these problems. That doesn't necessarily mean making a solution, it may just entail searching for a third party solution, or discovering a bit of specific HN behavior that isn't well documented. I imagine any user with over 1000 karma probably has at least a few tricks, and could mention off the top of their head a few things that help quite a bit when using the site. At the same time, I think it's best they aren't mentioned too often, as they offer a sort of natural advantage to those that have been around an while and contributed to discussions (it's the nature of many of these helpers that they actually help discussion), and putting those tools into the hands of a novice user may actually be detrimental to the site as a whole.
- bloodorange 11y agoThis sounds a lot like rationalising poor UI.
- pvdebbe 11y agoWhat is return-oriented programming? Recursion?
- garblegarble 11y agoIt looks like it's an exploit technique where the stack is modified to set up malicious calls to functions: https://en.wikipedia.org/wiki/Return-oriented_programming https://en.wikipedia.org/wiki/Return-oriented_programming
- mafribe 11y agoThat's not really the essence of ROP because other attack techniques often also need to manipulate the stack. The key novel idea in ROP is to use data in unintended ways. This is based on the insight that the memory often contains short sequences of bytes (e.g. a .jpg image) that can be interpreted as machine instructions. For example an mp3 file might contain the sequence 99 19933, 16 which translates to increment register 16 return in the ambient machine language. Call that "dual use data". ROP searches the memory for sufficient "dual use data" and then builds an ac-hoc compiler with "dual use data" as target language. Then the attack software compiles to "dual use data" and then runs the compiled code. Of course one may ask: can we always find enough "dual use data" to build a Turing-complete set of instructions as a compilation target. Turns out that with high probability that is the case.
- Dylan16807 11y agoNone of that should be marked executable, though. The real risk in ROP is using little bits of legitimate functions to bypass DEP.
- mafribe 11y agoThat is true, I should have been more clear about this but you don't use the "legitimate function"'s intended functionality, you only use the fact that it can be execute (and the byte-string that is it's code). I used mp3s and jpgs as extreme examples of data that was never intended to be executed, but still can be interpreted as code. In ROP, you don't care about the intended meaning of the bytes that make up "legitimate functions" (or any other data you may use) for it's unlikely to have the sought functionality. Instead you use you search for "dual use code" too, and piece together the functionality you need.
- masklinn 11y agoAccording to https://github.com/Microsoft/clang/blob/master/docs/SafeStack.rst#known-security-limitations https://github.com/Microsoft/clang/blob/master/docs/SafeStac... safestack alone doesn't fully protect against ROP: > With SafeStack alone, an attacker can overwrite a function pointer on the heap or the unsafe stack and cause a program to call arbitrary location, which in turn might enable stack pivoting and return-oriented programming. And you need additional features (such as CPI from the paper you and the commit message link to) for full protection.
- deleted 11y ago[deleted]
- deleted 11y ago[deleted]
- tptacek 11y agoROP is an exploit technique. Stack corruption is a class of vulnerabilities. There are other memory corruption techniques that can be exploited with ROP.
- thisismyhaendel 11y agoIt is NOT clear from that article. ROP can occur on the heap and CPI is bypassable (although safestack is a great contribution, and frankly it's about time). There is great literature on this issue already (see many forms of the Control Flow Integrity defense), and many solutions that exist come close to full security without providing it (CPI only protects code pointers, and side-channel attacks that work through data pointers can still achieve arbitrary memory reads and writes). In particular, use-after-free vulnerabilities still exist. Without full memory safety, exploits of these types will always be possible.