My Journey Into 0-Day Binary Vulnerability Discovery in 2014 Author

No ratings

Presented at phdays 2014 by

Alisa Esage

While the IT security research hotspot migrates constantly towards new technologies, the demand for binary exploitation today is higher than ever before, as proven by this year’s pwn2own contest stakes and outcomes. The question that bothers many is thus whether it is still possible to discover new — and exploitable — vulnerabilities in widely deployed and extensively audited applications, given the nowadays reality of overwhelming tool base, research, computational power, and intelligence competition? The author says yes, and this is the report of her own journey on this way. The presentation will detail into the author’s own approach to discovery of 0-day binary vulnerabilities, mostly based on fuzzing. Specific concepts and techniques, which worked (or failed), will be demonstrated. Finally, the root cause analysis of a few 0-day vulnerabilities will be presented, along with a few ideas to bypass exploitation mitigations.