{"id":1756,"date":"2017-02-15T07:46:26","date_gmt":"2017-02-15T07:46:26","guid":{"rendered":"https:\/\/www.inforsec.org\/wp\/?p=1756"},"modified":"2017-02-17T01:09:20","modified_gmt":"2017-02-17T01:09:20","slug":"%e3%80%90%e6%b4%bb%e5%8a%a8%e9%a2%84%e5%91%8a%e3%80%91%e9%92%88%e5%af%b9%e6%95%b0%e6%8d%ae%e6%b5%81%e7%9a%84%e6%94%bb%e5%87%bb%ef%bc%9a%e5%8d%b1%e5%ae%b3%ef%bc%8c%e6%9e%84%e9%80%a0%e5%92%8c%e5%ae%9e","status":"publish","type":"post","link":"http:\/\/202.112.238.40\/wp\/?p=1756","title":{"rendered":"\u3010\u6d3b\u52a8\u9884\u544a\u3011\u9488\u5bf9\u6570\u636e\u6d41\u7684\u653b\u51fb\uff1a\u5371\u5bb3\uff0c\u6784\u9020\u548c\u5b9e\u6218"},"content":{"rendered":"

\u62a5\u544a\u9898\u76ee<\/strong>\uff1a\u9488\u5bf9\u6570\u636e\u6d41\u7684\u653b\u51fb\uff1a\u5371\u5bb3\uff0c\u6784\u9020\u548c\u5b9e\u6218
\nData-Oriented Attacks: Expressiveness, Construction and Application<\/p>\n

\u6f14\u8bb2\u4eba<\/strong>\uff1a\u80e1\u5b8f\uff0c\u535a\u58eb\u540e\uff0c\u4f50\u6cbb\u4e9a\u7406\u5de5\u5b66\u9662<\/p>\n

\u65f6\u95f4<\/strong>\uff1a2017\u5e742\u670821\u65e5\uff08\u5468\u4e8c\uff0910:00am -12:00am<\/p>\n

\u5730\u70b9<\/strong>\uff1a\u6e05\u534e\u5927\u5b66\u4fe1\u606f\u6280\u672f\u5927\u697c\uff08FIT\uff09 3-225<\/p>\n

<\/p>\n

\u5185\u5bb9\u6458\u8981\uff1a<\/b><\/strong><\/p>\n

\u56f4\u7ed5\u5185\u5b58\u6f0f\u6d1e\u7684\u653b\u9632\u5df2\u7ecf\u6301\u7eed\u4e86\u8fd1\u4e09\u5341\u5e74\u3002\u968f\u7740\u9632\u62a4\u6280\u672f\u7684\u53d1\u5c55\uff0c\u9488\u5bf9\u63a7\u5236\u6d41\u7684\u653b\u51fb\u53d8\u5f97\u6108\u53d1\u56f0\u96be\u3002\u5c11\u91cf\u9488\u5bf9\u6570\u636e\u6d41\u7684\u653b\u51fb\u663e\u793a\u51fa\u4e86\u5176\u6f5c\u5728\u7684\u5371\u5bb3\u6027\u3002 \u7136\u800c\uff0c\u76ee\u524d\u5bf9\u9488\u5bf9\u6570\u636e\u6d41\u7684\u653b\u51fb\u8fd8\u77e5\u4e4b\u751a\u5c11\u3002 \u6211\u4eec\u6df1\u5165\u5730\u7814\u7a76\u4e86\u9488\u5bf9\u6570\u636e\u6d41\u7684\u653b\u51fb\uff0c\u63d0\u51fa\u4e86\u7cfb\u7edf\u6027\u7684\u6784\u9020\u65b9\u6cd5\uff0c\u5e76\u8bc1\u660e\u5176\u5371\u5bb3\u6027\u4e3a\u56fe\u7075\u5b8c\u5907\u7684\u3002\u6700\u540e\u6211\u4eec\u5728\u4e3b\u6d41\u6d4f\u89c8\u5668 Chromium \u4e0a\u5b9e\u73b0\u4e86\u9488\u5bf9\u6570\u636e\u6d41\u7684\u653b\u51fb\uff0c\u6210\u529f\u7ed5\u8fc7\u4e86\u540c\u6e90\u7b56\u7565\u3002<\/p>\n

As defense solutions against control-flow hijacking attacks gain wide deployment, control-oriented exploits from memory errors become difficult. As an alternative, attacks targeting non-control data do not require diverting the application\u2019s control flow during an attack. Although it is known that such data-oriented attacks can mount significant damage, we are not clear about their real expressiveness. In this talk, we present data-flow stitching, a systematic method to build data-oriented attacks. Then we propose data-oriented programming to demonstrate that data-oriented attacks can be Turing-complete. Finally, we build data-oriented attacks on Chromium to bypass the fundamental SOP (same origin policy) enforcement.<\/p>\n

 <\/p>\n

\u6f14\u8bb2<\/b><\/strong>\u4eba<\/b><\/strong>\u7b80\u4ecb\uff1a<\/b><\/strong><\/p>\n

<\/p>\n

\u80e1\u5b8f\u535a\u58eb2016\u5e74\u6bd5\u4e1a\u4e8e\u65b0\u52a0\u5761\u56fd\u7acb\u5927\u5b66\uff0c\u5e08\u4ece\u6881\u632f\u51ef\u6559\u6388\u3002\u4ed6\u7684\u7814\u7a76\u5174\u8da3\u5728\u7cfb\u7edf\u5b89\u5168\u9886\u57df\uff0c\u76ee\u524d\u96c6\u4e2d\u5728\u5185\u5b58\u6f0f\u6d1e\u7684\u68c0\u6d4b\uff0c\u5229\u7528\u53ca\u9632\u62a4\u4e0a\u3002\u4ed6\u7684\u7814\u7a76\u6210\u679c\u53d1\u8868\u5728 Oakland, Usenix, CCS, ESORICS, ICECCS \u7b49\u5b89\u5168\u4f1a\u8bae\u4e0a\uff0c\u5e76\u83b7\u5f97 ICECCS Best Paper Award\u3002\u80e1\u5b8f\u535a\u58eb\u5c06\u524d\u5f80\u4f50\u6cbb\u4e9a\u7406\u5de5 Prof. Wenke Lee \u7814\u7a76\u7ec4\u4ece\u4e8b\u535a\u58eb\u540e\u5de5\u4f5c\u3002<\/p>\n

Dr. Hong Hu obtained his PhD degree from National University of Singapore, advisored by Prof. Zhenkai Liang. He also closely works with Prof. Prateek Saxena. His research interest focuses on system security. Currently, he is working on the detection, exploitation and defense of memory errors. His research work has been published on Oakland, Usenix, CCS, ESORICS, ICECCS etc. He has received the Best Paper Award from ICECCS’2014. Dr. Hong Hu will join GeorgiaTech for 2-years PostDoc.<\/p>\n

\u8054\u7cfb\u4eba\uff1a \u6bb5\u6d77\u65b0\uff0c duanhx@tsinghua.edu.cn \u00a0\u00a0\u6e05\u534e\u5927\u5b66\u7f51\u7edc\u79d1\u5b66\u4e0e\u7f51\u7edc\u7a7a\u95f4\u7814\u7a76\u9662<\/p>\n","protected":false},"excerpt":{"rendered":"

\u62a5\u544a\u9898\u76ee\uff1a\u9488\u5bf9\u6570\u636e\u6d41\u7684\u653b\u51fb\uff1a\u5371\u5bb3\uff0c\u6784\u9020\u548c\u5b9e\u6218 Data-Oriented Attacks: Expr… Continue reading → <\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-1756","post","type-post","status-publish","format-standard","hentry","category-events"],"_links":{"self":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/1756","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1756"}],"version-history":[{"count":1,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/1756\/revisions"}],"predecessor-version":[{"id":1758,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/1756\/revisions\/1758"}],"wp:attachment":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1756"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1756"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1756"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}