Exploit techniques and mitigation
1 like1,972 views
This document discusses various exploit techniques such as stack overflow, heap overflow, and return oriented programming that leverage application vulnerabilities. It also covers mitigation techniques including stack protection, safeSEH, heap protection, data execution prevention, and address space layout randomization. The document recommends automated malware protection solutions that can protect against zero-day attacks as the most effective approach compared to anti-virus blacklists or sandboxing solutions.
Exploit techniques and mitigation
- 3. Exploits Techniques • Stack overflow • SEH frame overwrite • Heap overflow • Ret2LibC • Return Oriented Programing • JIT Spraying • Bypass the Sandbox Model
- 8. Return Oriented Programing • Form Gadgets by combine various instruc-ons. • Gadget perform high-level ac-on • i.e VirtualAlloc(), SetProcessDEPPolicy()
- 11. Mi-ga-on techniques • Stack Protec-on • SafeSEH • Heap Protec-on • DEP • ASLR
- 14. Heap Protec-on • Unlink check • Entry header cookie • Pointer encoding • Randomized meta data and base address
- 15. Data Execu-on Preven-on • Preven=ng applica=on from execu=ng code from non-executable memory region
- 17. Malware Protec=on Solu=on • An=-Virus: Black list of file signature. • Only effec=ve against known threads • Whitelis=ng and Sandboxing solu=on • Hard to implement • Require consistent maintenance • Stateful applica=on control • Automated malware protec=on • Protect from zero day aZack
- 18. Thank You