Transparent ROP Exploit Mitigation Using Indirect Branch Tracing

USENIX Security Symposium, 2013

344 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/f4b0b04bc7d7edaedae7f6f9eb17f79faaf5191b

Citations in the corpus

• Stitching the Gadgets: On the Ineffectiveness of Coarse-Grained Control-Flow Integrity Protection (2014, unknown): “ROPecker [13] and kBouncer [31], for example, leverage the branch history table of modern x86 processors to perform a CFI check on a short history of executed branches.”
• The Cybersecurity Landscape in Industrial Control Systems (2016, unknown): “To reduce this overhead, a number of proposals have been made: kBouncer [92], ROPecker [93], CFI for COTS binaries [94], ROPGuard [95], and CCFIR [96].”
• On the Detection of Kernel-Level Rootkits Using Hardware Performance Counters (2017, unknown): “The use of other microarchitectural features to detect malicious activity has been studied as well. kBouncer [19] uses the last branch recording (LBR) of Intel microprocessors to detect the execution of ROP [24] code.”
• ROP is Still Dangerous: Breaking Modern Defenses (2014, unknown): “We use these attacks to break two recent state-of-theart runtime defenses, kBouncer [23] and ROPecker [11].”
• Control-Flow Bending: On the Effectiveness of Control-Flow Integrity (2015, unknown): “This notion of fully-precise static CFI allows us to transcend the recent arms race caused by defenders proposing forms of CFI [9,28] and then attackers defeating them [5,14,16].”
• Counterfeit Object-oriented Programming: On the Difficulty of Preventing Code Reuse Attacks in C++ Applications (2015, unknown): “However, several researchers have recently shown that many of these solutions [3], [14], [23], [40], [56], [58], [59] can be bypassed in realistic adversary settings [11], [16], [25], [26], [43].”
• ROPecker: A Generic and Practical Approach For Defending Against ROP Attacks (2014, unknown): “The ROPGuard [3] and KBouncer [11] approaches only add the checking points in the selective critical functions (e.g., Windows APIs) by instrumenting the binary code on-the-fly.”
• Out of Control: Overcoming Control-Flow Integrity (2014, unknown): “kBouncer [34] monitors a process to detect function returns to addresses not preceded by a call instruction.”
• Hacking Blind (2014, unknown): “is to enforce control flow inside the system call handler by comparing the stack against last branch record (LBR) facility available in Intel processors [23].”