1. Yu Ding, Tao Wei, TieLei Wang Peking University Zhenkai Liang National University of Singapore Wei Zou Peking University 26 th ACSAC (December, 2010)

2. Outline Introduction Research Approaches Heap Spraying with Little Surface Area Experiment and Evaluation 2A Seminar at Advanced Defense Lab

3. Introduction A news from Microsoft Security Research & Defense 2010/12/20 http://blogs.technet.com/b/srd/archive/2010/12/22/new -internet-explorer-vulnerability-affecting-all-versions- of-ie.aspx http://blogs.technet.com/b/srd/archive/2010/12/22/new -internet-explorer-vulnerability-affecting-all-versions- of-ie.aspx A Seminar at Advanced Defense Lab3

4. Heap Heap Spray A Seminar at Advanced Defense Lab4 Memory Corruption Heap is less predictable, and some mechanism for randomizing the heap layout NOP Sled Shellcode NOP Sled Shellcode NOP Sled Shellcode NOP Sled Shellcode shellcode = unescape("%u4343%u4343%...''); oneblock = unescape("%u0C0C%u0C0C"); var fullblock = oneblock; while (fullblock.length<0x40000) { fullblock += fullblock; } sprayContainer = new Array(); for (i=0; i<1000; i++) { sprayContainer[i] = fullblock + shellcode; }

5. Heap spraying (cont.) Why spraying? We need to jump into the object. Why NOP-sled? We need to execute first instruction in the shellcode. A Seminar at Advanced Defense Lab5

6. Research Approaches Shellcode-oriented But … “English Shellcode”? (my opinion) Sled-oriented NOZZLE A Seminar at Advanced Defense Lab6

7. The Design of NOZZLE NOZZLE attempts to discover objects in which control flow through the object (the NOP sled) frequently reaches the same basic block(s) (the shellcode.) Advanced Defense Lab7 object disassemble Control Flow Graph

8. The Design of NOZZLE (cont.) Compute the attack surface area of object o as: The attack surface area of heap containing n objects is defined as follows: The normalized attack surface area of heap Advanced Defense Lab8

9. Limitation (In The Paper of NOZZLE) Jump into Page Attacker allocates page-size chunk of memory Advanced Defense Lab9 Page-size Shellcode Page-size Shellcode Page-size Shellcode Page alignment Fixed offset!! The goal of this paper!!

10. Heap Spraying with Little Surface Area Memory Allocation Granularity Linux: 4KB Windows: 64KB When a heap object is bigger than a certain threshold, 512K in our experiment, Windows always allocates a separate heap block for this object. A Seminar at Advanced Defense Lab10

11. Observation If an EIP assigned by an attacker have few possible locations in a large heap object, the attacker only need to put jump-equivalent instructions at those locations. In fact, an EIP assigned by an attacker can only point to EIGHT possible locations in a 512K-byte heap object A Seminar at Advanced Defense Lab11

12. A Seminar at Advanced Defense Lab12

13. Malicious Heap Object A Seminar at Advanced Defense Lab13

14. If the alignment is small A Seminar at Advanced Defense Lab14

15. Detecting Heap Taichi Attacks NOZZLE can be enhanced to detect some of the new attacks by considering the effect of memory allocation granularity. A Seminar at Advanced Defense Lab15

16. Detecting Heap Taichi Attacks(cont.) A natural solution to prevent Heap Taichi attacks and similar attacks is to aligning memory allocation at a smaller-sized boundary. But … there are many heap managers on different levels of a program, each of which has its own heap management strategy. A Seminar at Advanced Defense Lab16

17. Experiment and Evaluation Case study: A Seminar at Advanced Defense Lab17

18. A Seminar at Advanced Defense Lab18

19. Result A Seminar at Advanced Defense Lab19

20. Thank You A Seminar at Advanced Defense Lab20