On the effectiveness of address-space randomization

By Hovav Shacham, M. Page, Ben Pfaff, Eu-Jin Goh, Nagendra Modadugu, Dan Boneh. Conference on Computer and Communications Security, 2004

1,034 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/71b5c849af8b00eacf7993e67cde55b76056cd2a

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Non-Control-Data Attacks Are Realistic Threats (2005, background): “[43] have recently shown that most current randomization implementations on 32-bit architectures suffer from the low entropy problem: even with very aggressive re-randomization measures, these techniques cannot provide more than 16-20 bits of entropy, which is not sufficient to defeat determined int”
Dynamic Taint Analysis for Automatic Detection, Analysis, and SignatureGeneration of Exploits on Commodity Software (2005, background): “The attacker is free to attack the vulnerable program again and again, usually causing the program to crash, and possibly even exploiting the program if he is lucky enough to guess the randomized values [39].”
SGXBOUNDS: Memory Safety for Shielded Execution (2017, background): “Also note that Address Space Randomization (ASR) and its fine-grained variants [31, 34, 41, 50] do not have sufficient bit entropy in SGX en- claves (recall that SGX restricts enclave address space to only 36 bits) and thus can be easily broken [70, 72].”
Efficient Techniques for Comprehensive Protection from Memory Error Exploits (2005, methodology): “In particular, with a page size of 4096 (= 2(12)) bytes on Linux, uncertainty in the base address of a library cannot be much larger than 2(16), which makes them susceptible to bruteforce attacks [29].”
Address Space Layout Permutation (ASLP): Towards Fine-Grained Randomization of Commodity Software (2006, background): “This section explains the design and implementation of ASLP in detail.”
ILR: Where'd My Gadgets Go? (2012, background): “ASLR on a 32-bit architecture only provides 16 bits of entropy and is susceptible to brute-force attacks [7].”
Binary stirring: self-randomizing instruction addresses of legacy x86 binary code (2012, methodology): “Brute force attacks that defeat ASLR by randomly guessing gad-get locations over many trials [52] or using the location of one binary feature to infer the locations of others [46] therefore fail when applied to STIR.”
SoK: Automated Software Diversity (2014, background): “, ASLR on 32bit systems, are insecure because an attacker can defeat randomization via brute-force attacks [58].”
DieHard: probabilistic memory safety for unsafe languages (2006, background): “Base address randomization provides little protection from heap-based attacks on 32-bit platforms [36].”
Jump over ASLR: Attacking branch predictors to bypass ASLR (2016, background): “Several works have demonstrated how ASLR can be defeated through brute-force approach [12], and by using memory disclosure attacks [60].”
Code injection attacks on harvard-architecture devices (2008, neutral): “However, since a sensor’s address space is very limited it would still be vulnerable to brute force attacks [24].”
Jump-oriented programming: a new class of code-reuse attack (2011, background): “However, there are derandomization attacks to bypass ASLR [19, 33, 37] or limit its effectiveness.”
SoK: Eternal War in Memory (2013, background): “Causing faults in normal operation is unacceptable in production environments.”
When good instructions go bad: generalizing return-oriented programming to RISC (2008, neutral): “Derandomization and other techniques for bypassing ASLR [24, 4, 14] may be applicable on the SPARC generally and to return-oriented programming on SPARC specifically.”
Toward Proactive, Adaptive Defense: A Survey on Moving Target Defense (2019, methodology): “Common MTD techniques include artificial diversity [22], [79], [84], [138], [161] or randomizations [3], [12], [87], [91], [95], [97], [107], [110], [144], [147], [152], [165], which rearrange or randomize the various system and network attributes where each work can belong to shuffling, diversity, ”
ROPecker: A Generic and Practical Approach For Defending Against ROP Attacks (2014, background): “However, it has been shown that ASLR can be bypassed by leveraging brute-force attacks [30] or information leakage attacks [31].”