Automatic Exploit Generation for Cross-Language Attacks
Memory corruption is an essential component of most computer exploits. At the same time, a significant portion of legacy system software is written in C/C++, which are known to be memory-unsafe. This has led to an arms race between attackers devising ever clever ways to execute memory corruption and...
| Main Author: | |
|---|---|
| Other Authors: | |
| Format: | Thesis |
| Published: |
Massachusetts Institute of Technology
2023
|
| Online Access: | https://hdl.handle.net/1721.1/147544 |
| _version_ | 1826205543252885504 |
|---|---|
| author | Mihretie, Yosef E. |
| author2 | Burow, Nathan |
| author_facet | Burow, Nathan Mihretie, Yosef E. |
| author_sort | Mihretie, Yosef E. |
| collection | MIT |
| description | Memory corruption is an essential component of most computer exploits. At the same time, a significant portion of legacy system software is written in C/C++, which are known to be memory-unsafe. This has led to an arms race between attackers devising ever clever ways to execute memory corruption and developers engineering mitigation techniques to either prevent or raise the alarm when memory is corrupted. This has come to be known as “The Eternal War in Memory”. Recently, however, software programmers have shifted to using programming languages that are memory-safe by design like Go and Rust. These languages are specially favorable because they provide an easy interface that allows them to interact with the widely established C/C++ based infrastructure. Underlying this design approach is the assumption that replacing parts of a largely memory-unsafe software program with memory safe code will raise the overall security of the program. Recent work has however showed this assumption is flawed. In fact, mixing sections with different threat models into one program can lead to attacks that would not have been possible in the two sections individually. These attacks are called Cross-Language Attacks (CLA). On the other hand, analyzing large binary programs to construct CLA exploits is a tedious process. In this thesis, we present ACLEG which automatically generates CLA for the case of double-free exploits. ACLEG can help researchers and engineers understand the extent of CLA vulnerabilities in commercially deployed software programs. Moreover, it can help find bugs in software programs before they are deployed as part of the debugging toolset. |
| first_indexed | 2024-09-23T13:14:49Z |
| format | Thesis |
| id | mit-1721.1/147544 |
| institution | Massachusetts Institute of Technology |
| last_indexed | 2024-09-23T13:14:49Z |
| publishDate | 2023 |
| publisher | Massachusetts Institute of Technology |
| record_format | dspace |
| spelling | mit-1721.1/1475442023-01-20T03:29:22Z Automatic Exploit Generation for Cross-Language Attacks Mihretie, Yosef E. Burow, Nathan Okhravi, Hamed Shrobe, Howard Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science Memory corruption is an essential component of most computer exploits. At the same time, a significant portion of legacy system software is written in C/C++, which are known to be memory-unsafe. This has led to an arms race between attackers devising ever clever ways to execute memory corruption and developers engineering mitigation techniques to either prevent or raise the alarm when memory is corrupted. This has come to be known as “The Eternal War in Memory”. Recently, however, software programmers have shifted to using programming languages that are memory-safe by design like Go and Rust. These languages are specially favorable because they provide an easy interface that allows them to interact with the widely established C/C++ based infrastructure. Underlying this design approach is the assumption that replacing parts of a largely memory-unsafe software program with memory safe code will raise the overall security of the program. Recent work has however showed this assumption is flawed. In fact, mixing sections with different threat models into one program can lead to attacks that would not have been possible in the two sections individually. These attacks are called Cross-Language Attacks (CLA). On the other hand, analyzing large binary programs to construct CLA exploits is a tedious process. In this thesis, we present ACLEG which automatically generates CLA for the case of double-free exploits. ACLEG can help researchers and engineers understand the extent of CLA vulnerabilities in commercially deployed software programs. Moreover, it can help find bugs in software programs before they are deployed as part of the debugging toolset. M.Eng. 2023-01-19T19:57:30Z 2023-01-19T19:57:30Z 2022-09 2022-09-16T20:23:56.885Z Thesis https://hdl.handle.net/1721.1/147544 In Copyright - Educational Use Permitted Copyright MIT http://rightsstatements.org/page/InC-EDU/1.0/ application/pdf Massachusetts Institute of Technology |
| spellingShingle | Mihretie, Yosef E. Automatic Exploit Generation for Cross-Language Attacks |
| title | Automatic Exploit Generation for Cross-Language Attacks |
| title_full | Automatic Exploit Generation for Cross-Language Attacks |
| title_fullStr | Automatic Exploit Generation for Cross-Language Attacks |
| title_full_unstemmed | Automatic Exploit Generation for Cross-Language Attacks |
| title_short | Automatic Exploit Generation for Cross-Language Attacks |
| title_sort | automatic exploit generation for cross language attacks |
| url | https://hdl.handle.net/1721.1/147544 |
| work_keys_str_mv | AT mihretieyosefe automaticexploitgenerationforcrosslanguageattacks |