Abstract:  Code reuse attacks such as return-oriented programming (ROP) offer a robust attack technique that is extensively used to exploit bugs in modern software programs (e.g., web browsers and PDF readers). ROP requires no code injection, and only induces malicious program actions by executing a chain of instruction sequences (gadgets) residing in shared libraries or the executable itself. In this talk, we give a brief overview of ROP attacks evolution and mitigation proposals in the last years. In particular, we elaborate on recently proposed (coarse-grained) control-flow integrity (CFI) solutions such as kBouncer, ROPecker, CFI for COTS binaries, ROPGuard, and Microsoft\222s Windows EMET tool. We discuss the (in)effectiveness of these techniques and how they can be undermined even under weak adversarial assumptions. Finally we discuss some open problems and new directions.

Abstract: The number of client-side attacks has grown significantly in the past few years shifting focus on poorly protected vulnerable clients. Just as the most known honeypot technologies enable research into server-side attacks, honeyclients allow the study of client-side attacks. A complement to honeypots, a honeyclient is a tool designed to mimic the behavior of a user-driven network client application, such as a web browser, and be exploited by an attacker's content. The talk will briefly introduce honeyclient technologies and describe the low-interaction honeyclient "Thug" and how to effectively use it in order to analyze malicious websites and detect potential exploit kits.