Overview of Exploit techniques and mitigation options

1. Techniques & Mi-ga-on
Yaniv Shani

2. What is Exploit?
A piece of so=ware that leverage an
applica-on vulnerability to cause
unintended applica-on behavior

3. Exploits Techniques
• Stack overflow
• SEH frame overwrite
• Heap overflow
• Ret2LibC
• Return Oriented Programing
• JIT Spraying
• Bypass the Sandbox Model

4. Stack overflow
Overwrite the the return address on the stack with a
pointer to some malicious shell code

5. SEH Frame overwrite
Override the SEH records to jump to the shellcode

6. Heap overflow
• Overwrite the allocated buffer internal
linked list pointers.
• Use the resul=ng pointer exchange to
overwrite program counter.

7. • Change the return address on the stack to
a known func=on in a shared library
• Doesn’t include shellcode
Ret2LibC

8. Return Oriented Programing
• Form Gadgets by combine various instruc-ons.
• Gadget perform high-level ac-on
• i.e VirtualAlloc(), SetProcessDEPPolicy()

9. JIT Spraying
• Make use of the fact that JIT compiler generated
executable code at run=me
• Spraying NOP slides, XOR and shellcode into memory

10. Bypass the Sandbox Model
• Bypass the security mechanism
• Enable untrusted applica-on an access to
underlying system resources.

11. Mi-ga-on techniques
• Stack Protec-on
• SafeSEH
• Heap Protec-on
• DEP
• ASLR

12. Stack Protec-on
• Add Canary before stack return pointer
• Check Canary & terminate on mismatch

13. SafeSEH
• A Link =me op=on that generate a table with
all SEH that will be used by the program

14. Heap Protec-on
• Unlink check
• Entry header cookie
• Pointer encoding
• Randomized meta data and base address

15. Data Execu-on Preven-on
• Preven=ng applica=on from execu=ng code
from non-executable memory region

16. Address Space Layout Randomiza-on
• Randomly arranging the posi=on of key data area
(heap, stack, exec. , library space).

17. Malware Protec=on Solu=on
• An=-Virus: Black list of file signature.
• Only effec=ve against known threads
• Whitelis=ng and Sandboxing solu=on
• Hard to implement
• Require consistent maintenance
• Stateful applica=on control
• Automated malware protec=on
• Protect from zero day aZack

18. Thank You