Publications associées à Return-oriented programming

Instruction-Level Power Side-Channel Leakage Evaluation of Soft-Core CPUs on Shared FPGAs

Mathias Josef Payer, Mirjana Stojilovic, Shashwat Shrivastava, Ognjen Glamocanin, Jinwei Yao, Nour Ardo

Side-channel disassembly attacks recover CPU instructions from power or electromagnetic side-channel traces measured during code execution. These attacks typically rely on physical access, proximity to the victim device, and high sampling rate measuring in ...

2023

mu RAI: Securing Embedded Systems with Return Address Integrity

Mathias Josef Payer

Embedded systems are deployed in security critical environments and have become a prominent target for remote attacks. Microcontroller-based systems (MCUS) are particularly vulnerable due to a combination of limited resources and low level programming whic ...

INTERNET SOC2020

SpecROP: Speculative Exploitation of ROP Chains

Mathias Josef Payer, Atri Bhattacharyya, Andrés Sánchez Marín

Speculative execution attacks, such as Spectre, reuse code from the victim’s binary to access and leak secret information during speculative execution. Every variant of the attack requires very particular code sequences, necessitating elaborate gadget-sear ...

2020

Butterfly Attack: Adversarial Manipulation of Temporal Properties of Cyber-Physical Systems

Mathias Josef Payer, Amir Aminifar

Increasing internet connectivity poses an existential threat for cyber-physical systems. Securing these safety-critical systems becomes an important challenge. Cyber-physical systems often comprise several control applications that are implemented on share ...

IEEE2019

SoK: Shining Light on Shadow Stacks

Mathias Josef Payer, Xiangyu Zhang

Control-Flow Hijacking attacks are the dominant attack vector against C/C++ programs. Control-Flow Integrity (CFI) solutions mitigate these attacks on the forward edge, i.e., indirect calls through function pointers and virtual calls. Protecting the backwa ...

IEEE COMPUTER SOC2019

Block Oriented Programming: Automating Data-Only Attacks

Mathias Josef Payer

With the widespread deployment of Control-Flow Integrity (CFI), control-flow hijacking attacks, and consequently code reuse attacks, are significantly more difficult. CFI limits control flow to well-known locations, severely restricting arbitrary code exec ...

ASSOC COMPUTING MACHINERY2018

Improving systems software security through program analysis and instrumentation

Volodymyr Kuznetsov

Security and reliability bugs are prevalent in systems software. Systems code is often written in low-level languages like C/C++, which offer many benefits but also delegate memory management and type safety to programmers. This invites bugs that cause cra ...

EPFL2016

Buffer overlow vulnerabilities in CUDA: a preliminary analysis

Andrea Miele

We present a preliminary study of buffer overflow vulnerabilities in CUDA software running on GPUs. We show how an attacker can overrun a buffer to corrupt sensitive data or steer the execution flow by overwriting function pointers, e.g., manipulating the ...

Springer France2015

Confluence: unified instruction supply for scale-out servers

Babak Falsafi, Boris Robert Grot, Ilknur Cansu Kaynak

Multi-megabyte instruction working sets of server workloads defy the capacities of latency-critical instruction-supply components of a core; the instruction cache (L1-I) and the branch target buffer (BTB). Recent work has proposed dedicated prefetching tec ...

ACM Press2015

Code-Pointer Integrity

George Candea, Volodymyr Kuznetsov, Mathias Josef Payer

Systems code is often written in low-level languages like C/C++, which offer many benefits but also delegate memory management to programmers. This invites memory safety bugs that attackers can exploit to divert control flow and compromise the system. Depl ...

2014