Redirigiendo al acceso original de articulo en 20 segundos...
Inicio  /  Applied Sciences  /  Vol: 9 Par: 14 (2019)  /  Artículo
ARTÍCULO
TITULO

Address Space Layout Randomization Next Generation

Hector Marco-Gisbert and Ismael Ripoll Ripoll    

Resumen

Systems that are built using low-power computationally-weak devices, which force developers to favor performance over security; which jointly with its high connectivity, continuous and autonomous operation makes those devices specially appealing to attackers. ASLR (Address Space Layout Randomization) is one of the most effective mitigation techniques against remote code execution attacks, but when it is implemented in a practical system its effectiveness is jeopardized by multiple constraints: the size of the virtual memory space, the potential fragmentation problems, compatibility limitations, etc. As a result, most ASLR implementations (specially in 32-bits) fail to provide the necessary protection. In this paper we propose a taxonomy of all ASLR elements, which categorizes the entropy in three dimensions: (1) how, (2) when and (3) what; and includes novel forms of entropy. Based on this taxonomy we have created, ASLRA, an advanced statistical analysis tool to assess the effectiveness of any ASLR implementation. Our analysis show that all ASLR implementations suffer from several weaknesses, 32-bit systems provide a poor ASLR, and OS X has a broken ASLR in both 32- and 64-bit systems. This is jeopardizing not only servers and end users devices as smartphones but also the whole IoT ecosystem. To overcome all these issues, we present ASLR-NG, a novel ASLR that provides the maximum possible absolute entropy and removes all correlation attacks making ASLR-NG the best solution for both 32- and 64-bit systems. We implemented ASLR-NG in the Linux kernel 4.15. The comparative evaluation shows that ASLR-NG overcomes PaX, Linux and OS X implementations, providing strong protection to prevent attackers from abusing weak ASLRs.

 Artículos similares

       
 
Zhe Yang, Yi Huang, Yaqin Chen, Xiaoting Wu, Junlan Feng and Chao Deng    
Controllable Text Generation (CTG) aims to modify the output of a Language Model (LM) to meet specific constraints. For example, in a customer service conversation, responses from the agent should ideally be soothing and address the user?s dissatisfactio... ver más
Revista: Applied Sciences

 
Olga Kurasova, Arnoldas Bud?ys and Viktor Medvedev    
As artificial intelligence has evolved, deep learning models have become important in extracting and interpreting complex patterns from raw multidimensional data. These models produce multidimensional embeddings that, while containing a lot of informatio... ver más
Revista: Informatics

 
Vinh Pham, Maxim Tyan, Tuan Anh Nguyen and Jae-Woo Lee    
Multi-fidelity surrogate modeling (MFSM) methods are gaining recognition for their effectiveness in addressing simulation-based design challenges. Prior approaches have typically relied on recursive techniques, combining a limited number of high-fidelity... ver más
Revista: Aerospace

 
Longde Wang, Hui Cao, Zhichao Cui and Zeren Ai    
Marine engines confront challenges of varying working conditions and intricate failures. Existing studies have primarily concentrated on fault diagnosis in a single condition, overlooking the adaptability of these methods in diverse working condition. To... ver más

 
Firas Alghanim, Ibrahim Al-Hurani, Hazem Qattous, Abdullah Al-Refai, Osamah Batiha, Abedalrhman Alkhateeb and Salama Ikki    
Identifying menopause-related breast cancer biomarkers is crucial for enhancing diagnosis, prognosis, and personalized treatment at that stage of the patient?s life. In this paper, we present a comprehensive framework for extracting multiomics biomarkers... ver más
Revista: Algorithms