Spraying is a common payload delivery technique used by attackers to execute arbitrary code in presence of Address Space Layout Randomisation (ASLR). In this paper we present Graffiti, an efficient hypervisorbased memory analysis framework for the detection and prevention of spraying attacks. Compared with previous solutions, our system is the first to offer an efficient, complete, extensible, and OS independent protection against all spraying techniques known to date. We developed a prototype open source framework based on our approach, and we thoroughly evaluated it against all known variations of spraying attacks on two operating systems: Linux and Microsoft Windows. Our tool can be applied out of the box to protect any application, and its overhead can be tuned according to the application behavior and to the desired level of protection.
Micro-virtualization memory tracing to detect and prevent spraying attacks
USENIX 2016, 25th USENIX Security Symposium, August 10-12, 2016, Austin, TX, USA
Type:
Conference
City:
Austin
Date:
2016-08-10
Department:
Digital Security
Eurecom Ref:
4902
Copyright:
Copyright Usenix. Personal use of this material is permitted. The definitive version of this paper was published in USENIX 2016, 25th USENIX Security Symposium, August 10-12, 2016, Austin, TX, USA and is available at :
See also:
PERMALINK : https://www.eurecom.fr/publication/4902
