Return-oriented programming without returns

By Stephen Checkoway, Lucas Davi, Alexandra Dmitrienko, Ahmad-Reza Sadeghi, Hovav Shacham, Marcel Winandy. Conference on Computer and Communications Security, 2010

639 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Hardware and Architecture

View Paper: https://www.semanticscholar.org/paper/5190dab1e43e5e42833beaf12cc155ff16f23808

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Hardware and Architecture

Citations in the corpus

Counterfeit Object-oriented Programming: On the Difficulty of Preventing Code Reuse Attacks in C++ Applications (2015, methodology): “Before presenting the ideas and concepts behind COOP in detail, we review the background necessary for understanding our approach and its relation to existing work.”
Control Flow Integrity for COTS Binaries (2013, background): “Unlike code injection defenses such as DEP (data execution prevention), CFI can protect from existing code attacks such as return-oriented programming (ROP) [38, 9, 49] and jump-oriented programming (JOP) [10, 7].”
ROPdefender: a detection tool to defend against return-oriented programming attacks (2011, background): “A new ROP attack has been recently presented in [11] that is solely based on indirect jumps rather than returns.”
Code-pointer integrity (2014, background): “Attackers exploit bugs, such as buffer overflows and use after free errors, to cause memory corruption that enables them to steal sensitive data or execute code that gives them control over a remote system [44, 37, 12, 8].”
Stitching the Gadgets: On the Ineffectiveness of Coarse-Grained Control-Flow Integrity Protection (2014, background): “1 the basic gadgets that form a Turing-complete language [12, 35].”
CollAFL: Path Sensitive Fuzzing (2018, background): “Memory corruption vulnerabilities are the root cause of many severe threats to programs, including control flow hijacking attacks [12, 37, 38] and information leakage attacks [36].”
Control-Flow Integrity (2017, background): “By way of modifying return addresses on the stack, an attacker can “return” to all addresses in a program, the foundation of return-oriented programming [10, 58, 63].”
ILR: Where'd My Gadgets Go? (2012, background): “The original authors of ROP have described ROP’s salient feature as “Turing completeness without code injection” [9].”
Just-In-Time Code Reuse: On the Effectiveness of Fine-Grained Address Space Layout Randomization (2013, background): “Recently, this concept was generalized by removing the reliance on actual return instructions [12].”
Practical Control Flow Integrity and Randomization for Binary Executables (2013, background): “Some new mitigation techniques have focused on protecting against ROP [29], but this has also spawned newer variants of attacks [12].”
SMART: Secure and Minimal Architecture for (Establishing a Dynamic) Root of Trust (2012, background): “, return to libc [42], borrowed code chunks [27] or Return-Oriented Programming [39], [7], [9]).”
Privilege Escalation Attacks on Android (2010, methodology): “9 ARM supports the 32-bit ARM instruction set and a 16-bit instruction set, which is called THUMB. the example presented in [4].”
Binary stirring: self-randomizing instruction addresses of legacy x86 binary code (2012, background): “…attackers began to redirect control ﬂows directly to potentially dangerous code already present in victim process address spaces (e.g., in standard libraries), bypassing W ⊕ X. Return-into-libc attacks [55] and return oriented programming (ROP) [12, 15, 51] are two major categories of such attacks.”
SGX-Shield: Enabling Address Space Layout Randomization for SGX Programs (2017, background): “In §VI, we demonstrate that the kernel can succeed in an ROP attack against a vulnerable enclave program with only a single trial in the current Intel SGX SDKs. C2.”
SoK: Eternal War in Memory (2013, background): “Return-Oriented Programming (ROP) [6], [7], [8], [9], [10], [11], information leaks [12], [13] and the prevalent use of user scripting and just-in-time compilation [14] allow attackers to carry out practically any attack despite all protections.”
Out of Control: Overcoming Control-Flow Integrity (2014, methodology): “Nevertheless, it has been shown that ROP is possible in RISC architectures [27], or it can be carried out without using the ret instruction [11], [12] making defenses that are based on the emulation of the ret command less effective [24].”
Jump over ASLR: Attacking branch predictors to bypass ASLR (2016, background): “The attack is based by scanning and constructing the Return-Oriented-Programming (ROP) payload at the runtime exploiting memory disclosures.”