MIT PATEL
CS 4337.003
MHP190002
Introduction
“This research paper addresses the analysis of the paper “ROP is Still Dangerous: Breaking Modern
Defences” by “Nicholas Carlini and David Wagner”. The exploitation technique of choice for modern
memory-safety vulnerability attacks is called Return Oriented Programming (ROP). In the paper, three
new attack methods that break many existing ROP defences are introduced. And they are examined
by many new and recent ROP attacks seen in and demonstrates that these techniques successfully
work with them so that these defences are not detected. So that future defences can to take our
attacks into consideration. And the future attacks can be avoided from memory-safety vulnerability
attacks. The paper makes three contributions: Introducing three novel ROP attacks methods that
demonstrates weaknesses in multiple defences. Second one, demonstrates these attacks on bouncer
and ROPecker, the two state-of the art ROP defences. And they change real-world examples and
issues, which these defences were to skip, to avoid them. And the third one is the attacks provide a
baseline set of attacks that can be used to evaluate future ROP defences. Our paper includes the
analysis of these three contributions which break the present ROP defences.”
Summary
"The Main places of the exploration paper incorporate with regards to the Return Oriented
Programming, speculation of return-into-libc assaults where an assailant makes the program return
to self-assertive focuses in the program's code. It has been shown that ROP can perform Turing
complete calculation. Every device plays out some little calculation, like stacking a worth from memory
into a register or adding two registers. In a ROP assault, the aggressor tracks down devices inside the
first program text and makes them be executed in grouping to play out an undertaking other than
whatever was expected. A large portion of ROP assaults utilize accidental guidance successions. Since
x86 guidelines are variable-width, it is conceivable that a possibly helpful device succession exists
when beginning at an offset that was not expected to be the start of a guidance. Our assaults don't
depend on accidental directions."
"One normal guards for ROP assaults is ASLR which works by arbitrarily moving the fragments of a
program around in memory, keeping the assailant from foreseeing the location of helpful devices.
Notwithstanding ASLR, ROP assaults are as yet normal in the wild for two reasons. To start with,
assuming even a solitary module has ASLR debilitated, a ROP assault might be conformed to just the
code in that module. Second, an assailant might utilize a data exposure weakness to de-randomize
some module."
"The paper basically incorporates the three structure ROP guards assaults Call-Preceded ROP.
Ordinarily, in a very much organized program, each ret guidance gets once again to a guidance that
promptly follows a comparing call. ROP assaults veer off from this example. Thusly, numerous ROP
safeguards guarantee that each ret guidance consistently focuses on a guidance that promptly follows
some call. Our assault exhibits that this approach isn't adequate: ROP assaults are as yet conceivable
in any event, when returns are limited thusly. Avoidance Attacks. It is normal for protections that
screen program execution at runtime to have a technique for ordering execution as either «normal
execution» or «gadget». Avoidance assaults include utilizing contraptions that the safeguard orders
as «normal». History Flushing. A few guards keep up with just a restricted measure of history about
execution and investigate this set of experiences intermittently. We can sidestep protections with this
property by flushing the genuine history and afterward introducing a new, counterfeit perspective on
history that the safeguard won't order as an assault."
Critique
“ROP defenses are still dangerous so to handle the new or future attacks the three new building
blocks are introduced in the research paper. The call preceded policy in many ROP defenses are very
helpful for defending the attacks. In some programs like in well-structured programs, call and
returns come together in such cases the almost the call instruction is pushed previously. In attacks,
the call preceded policy is not in much use. In a evaluation it was stated that almost 6% of the
gadgets which use this policy are good enough to avoid the ROP attacks. And increase the chances of
catching the ROP attacks. Using the Call-preceded policy can increase the chances of mounting the
ROP attacks. But on the same time, they make the gadgets very complex that they are long and
contain direct jumps.”
“Other ROP defenses are monitored by runtime of a process and they try to find out the attacks by
classifying the segment execution. It more likely like a classification base defense. The general
classification defense is length based one. The existing ROP attacks have short gadgets with long
sequences which will be used to classify the gadgets. These approach separates the segments of the
execution traces of ordinary instructions by indirect instructions. A length based defense identifies
each segment as gadget or non and then according to the length classifier short segment is
considered as gadget and long one is considered as non-gadget. If the defense reports many short
segments it reports as a ROP attack. Even when the gadgets are mixture of short and long gadgets
still it would be possible evading the ROP attacks. But length based a easy to evade so in some cases
if the classification goes wrong or it is not properly done then it would be difficult to handle the ROP
attack.”
“In many runtime defenses inspecting the program execution at different points at the time
execution. Mostly this defenses have limited amount of history, so when an attack occurs we should
decide if the attack is occurring with the saved past information or present information. Once it says
the attack is occurring based on the past history then history flushing is concept which helps
avoiding the attack based on the history. But if the gadgets are not able to hide history or unable to
flush the past then avoiding the ROP attack is difficult.”
Conclusion
“In this paper, three building blocks for ROP attacks are introduced that allow us to break two stateof-the art ROP defenses. Here we demonstrated the practicality of our attacks by modifying real-world
exploits to bypass these defenses. More broadly, our research contradicts two pieces of conventional
wisdom: that ROP attacks only consist of short gadgets, and that ROP attacks cannot be effectively
mounted in call-preceded manner. In this we can believe that an important open research question is
to determine what properties are truly fundamental about ROP attacks that are different than typical
program execution. The analysis of these three contributions and their examples in the real world
defenses. And the strengths and the weakness of the three building blocks of the ROP attack
defenses.”
Reference:
[1] https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-carlini.pdf