Is Exploitation Over? Bypassing Memory Protections in Windows 7
Alexander Sotirov [email protected] About me Exploit development
since 1999 Published research into reliable exploitation
techniques: !Heap manipulation in JavaScript !Bypassing browser
memory protections on Windows Vista (with Mark Dowd) Exploitation
is getting harder !"#$"% '()"*+,-$)$.*/ +*)$,-)* *01)2$3,.2" !"#$
&'()*+,! 45564557 Overview of this talk The evolution of
exploit mitigations !GS, SafeSEH, DEP, ASLR, SEHOP State of the art
in exploitation !Windows XP through Windows 7 Windows 7 challenges
and directions for future research The evolution of exploit
mitigations Part I OS evolution Exploit mitigations Detect memory
corruption: GS stack cookies SEH chain validation (SEHOP) Heap
corruption detection Stop common exploitation patterns: GS variable
reordering SafeSEH DEP ASLR GS stack cookies cookie-(8*+ !"#$%
'($%)'* retaddr saved cookie Breaking GS cookie12$"3*+ ',+retaddr
saved cookie pointer arg !"#$% '($%)'* -(8*+ shellcode GS variable
reordering cookie-(8*+ !"#$% '($%)'* retaddr saved cookie
non-buffer variables copes of arguments arguments (unused) 12$"3*+
,+%(9*"3/ ,+* :21$*# -*;2+* 3
