ROP is Still Dangerous: Breaking Modern Defenses

By Nicholas Carlini, David A. Wagner. USENIX Security Symposium, 2014

393 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/b5563d8ef6ec0bd2e4a7aad2224906bf4e7b64b2

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Control-Flow Bending: On the Effectiveness of Control-Flow Integrity (2015, background): “This notion of fully-precise static CFI allows us to transcend the recent arms race caused by defenders proposing forms of CFI [9,28] and then attackers defeating them [5, 14, 16].”
Control-Flow Integrity (2017, background): “Second, even a large reduction of targets often leaves enough targets for an attacker to achieve the desired goals [8, 19, 26], making AIR unable to evaluate security of CFI mechanisms on an absolute scale.”
The Cybersecurity Landscape in Industrial Control Systems (2016, unknown): “[99] N.”
Stitching the Gadgets: On the Ineffectiveness of Coarse-Grained Control-Flow Integrity Protection (2014, methodology): “For instance, the attacks shown in [11, 22, 34] are prevented by our combined CFI policy which monitors the sequence length at any time in program execution.”
SGX-Shield: Enabling Address Space Layout Randomization for SGX Programs (2017, background): “In §VI, we demonstrate that the kernel can succeed in an ROP attack against a vulnerable enclave program with only a single trial in the current Intel SGX SDKs. C2.”
Counterfeit Object-oriented Programming: On the Difficulty of Preventing Code Reuse Attacks in C++ Applications (2015, methodology): “For example, the widely deployed address space layout randomization (ASLR) technique ensures that the stack, the heap, and executable modules of a program are mapped at secret, pseudo-randomly chosen memory locations.”
Enforcing Forward-Edge Control-Flow Integrity in GCC & LLVM (2014, methodology): “Even the most recent CFI implementation, SAFEDISPATCH [19], must sacrifice software-engineering practicality and use profile-driven, whole-program optimization to achieve overheads comparable to ours (roughly 2% for all three of their Chromium benchmarks).”