As some of you might know I did a talk at BH DC this year about fuzzing, below the slides and the white paper. I strongly suggest you to take a look at the white paper first as the slides are full of pictures therefore not really useful from a learning point of view. If you have any questions/suggestions on the content, please feel free to write me an email or comment on this blog post.
I am not a big fan of conference reports and stuff like that but I feel like spending a few words on the attack shown by Dionysus Blazakis as I found it pretty relevant for real world exploitation scenarios. I do not want to explain again what he did – both the white paper and the slides are public- but the important facts are mainly two:
- Defeating DEP by using JITSpraying
- Defeating ASLR by exploiting a weakness in how hash maps are ordered
In Flash it is possible to combine the two by JITspraying a piece of memory, insert the function object (with the shellcode) in a dictionary/set that uses hash maps for storing data and by using (2) being able to find the address of the shellcode.
The reason why this technique is so cool is because JITSpraying does not work just on Flash, but on everything that has a JIT compiler which creates predictable output inside it, and it is not trivially fixable. As for the technique for defeating ASLR it is easier to fix(well, sort of) but still it is one of the most advanced attacks against it we have seen so far.
The bottom line: the sky isn’t falling, but if you are an exploit writer you really want to learn this technique. If you are not you should learn it anyway – I expect to see quite a lot of exploits using this technique.
[slideshare id=3127552&doc=0knowfuzz-bh-100210153540-phpapp01]
[slideshare id=3127566&doc=bh-whitepaper-100210153835-phpapp01&type=d]
Vincent,
Could you post a direct link to your paper? This slideshare thing is pretty much unusable for me :-/
Hey jduck,
there you go: http://www.zynamics.com/downloads/bh-whitepaper.pdf