[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20160214233324.GA28274@thunk.org>
Date: Sun, 14 Feb 2016 18:33:24 -0500
From: Theodore Ts'o <tytso@....edu>
To: kernel-hardening@...ts.openwall.com
Subject: Two interesting papers I've been reading (or, ASLR is not enough)
Perhaps these techniques are well known in the security world (after
all, these papers are 2-3 years old), but I'm just a kernel progammer,
and I don't have time to necessarily keep up with the latest papers
coming out of academia regarding security (it's hard enough keeping up
with all of the papers out from the file system and storage
community!). As a result, they were eye-opening to me in terms of
what the exploit writers have been working on:
Kevin Snow, Fabian Monrose, Lucas Davi, and Alexandra Dmitrienko.
"Just-In-Time Code Reuse: On the Effectiveness of Fine-Grained Address
Space Layout Randomization". 2013 IEEE Symptosium on Security and
Privacy.
http://www.ieee-security.org/TC/SP2013/papers/4977a574.pdf
Michael Backes, Thorsten Holz, Benjamin Kollenda, Philipp Koppe,
Stefan Nürnberger, and Jannik Pewny. "You Can Run but You Can’t Read:
Preventing Disclosure Exploits in Executable Code". CCS 2014.
https://www.infsec.cs.uni-saarland.de/wp-content/uploads/sites/2/2014/10/nuernberger2014ccs_disclosure.pdf
Anyway, maybe this is old news for everyone on the list, but if you
haven't read these papers, IMO they are definitely worth a read. Does
anyone have a list of interesting security papers that might be of
interest to kernel programmers who want to know what the security
researchers have been up to?
Cheers,
- Ted
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
