Non-Control-Data Attacks Are Realistic Threats

By Shuo Chen, Jun Xu, Emre Can Sezer. USENIX Security Symposium, 2005

666 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/af94e541655466a0966e04a02aad3e209b1cfb89

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Preventing Memory Error Exploits with WIT (2008, methodology): “We attacked NullHttpd using the technique described in [15].”
Securing software by enforcing data-flow integrity (2006, methodology): “However, as pointed out by [14], attacks can succeed without changing the control-flow of the target programs.”
Guest-Transparent Prevention of Kernel Rootkits with VMM-Based Memory Shadowing (2008, background): “From another perspective, an attacker may also be able to directly or indirectly inﬂuence the kernel-level control ﬂow by manipulating certain non-control data [21].”
SecVisor: a tiny hypervisor to provide lifetime kernel code integrity for commodity OSes (2007, unknown): “in the context of user applications [4].”
Jump over ASLR: Attacking branch predictors to bypass ASLR (2016, background): “Non-control-data attacks [15] require the attacker to know locations of various data structures.”
ROP is Still Dangerous: Breaking Modern Defenses (2014, methodology): “There are other methods of attack that do not involve issuing system calls [10].”
Trusted Execution Environment: What It is, and What It is Not (2015, background): “Despite its numerous benefits, it introduces new threats: (1) message overload attacks [24]; (2) user and control data corruption attacks [25]; (3) memory faults caused by shared pages being removed; and (4) unbound waits caused by the noncooperation of the untrusted part of system.”
Practical Control Flow Integrity and Randomization for Binary Executables (2013, background): “Memory safety enforcement can protect against control-flow hijacking attacks; it also defeats non-control-data attacks [20].”
C-FLAT: Control-Flow Attestation for Embedded Systems Software (2016, methodology): “Keywords remote attestation; control-flow attacks; embedded system security”
Control-Flow Bending: On the Effectiveness of Control-Flow Integrity (2015, background): “Return Oriented Programming (ROP) [25, 36] is a more advanced form of code-reuse attack that lets the attacker perform arbitrary computation solely by reusing existing code.”
Raksha: a flexible information flow architecture for software security (2007, background): “It has been shown that this policy is insufficient to prevent all memory corruption cases [3].”