Return-Oriented Programming: Systems, Languages, and Applications

By Ryan Roemer, Erik Buchanan, Hovav Shacham, Stefan Savage. TSEC, 2012

631 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Hardware and Architecture, Signal Processing

View Paper: https://www.semanticscholar.org/paper/01b5b648af61ddb382da638a299fae2315b25192

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Hardware and Architecture

In Signal Processing

Citations in the corpus

A minimalist approach to Remote Attestation (2014, background): “However, the adversary might be able to perform a returnoriented programming (ROP) [5], [15], [25] attack, as follows: Jump into the beginning of some function within Attest.”
C-FLAT: Control-Flow Attestation for Embedded Systems Software (2016, background): “Keywords remote attestation; control-flow attacks; embedded system security”
Enforcing Forward-Edge Control-Flow Integrity in GCC & LLVM (2014, background): “However, there has been a corresponding increase in attacks that corrupt program-control data stored on the heap, such as C++ vtable pointers (inside objects) [14], or function pointers embedded in data structures; these attacks subvert indirect control transfers and are known as “return-to-libc” or”
Iago attacks: why the system call API is a bad untrusted RPC interface (2013, background): “At this point, a saved return address on the stack may be overwritten and the program can be coerced into executing a return-oriented program [27].”
SoK: Eternal War in Memory (2013, background): “We cover enforcing this policy under Section VII-B.”
Hacking Blind (2014, background): “Unfortunately, canaries are not a perfect solution, as even with layout precautions, the structure of a buffer overflow can sometimes permit an attacker to bypass canary words and access critical state directly, as happened with unsafe pointer arithmetic in yaSSL [3].”
Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attacks (2023, background): “This observation is also key in a class of traditional program attacks called return-oriented programming (ROP) (Roemer et al., 2012).”
Cyber-physical systems security: Limitations, issues and future trends (2020, neutral): “According to current studies carried out by [160], [161], CPS is highly prone to malicious code injection attacks [162] and code-reuse attacks [163], along with fake data injection attacks [164], zero-control data attacks [165], and ﬁnally Control-Flow Attestation (C-FLAT) attacks [160].”
Context-Sensitive Fencing: Securing Speculative Execution via Microcode Customization (2019, background): “The variant-2 Spectre attack further allows the attacker to hijack speculative execution by mistraining the branch predictor and associated structures, enabling a ROP-style attack[63] that stitches together Spectre gadgets.”