Mitigating control-flow hijack with dereferenced function pointers

No ratings

Presented at Bsidescanberra 2017 by

Gideon Greech

Exploits seek to gain control of the execution path of a program and direct it to attacker-supplied or -manipulated code. Much of the modern cyber defence focus is on preventing this from occurring through a variety of techniques. Traditionally, mitigation strategies rely on a range of metrics to detect control flow hijack, including CFG analysis, signature-based recognition of shellcode and heuristic assessment. This talk will present some new concepts based on original research conducted at UNSW. This new approach seeks to improve on Intel's recently released Control-flow Enforcement Technology white paper by leveraging the new hardware-based options to dereference function pointers and perform assessment based on the raw OPCODEs rather than stored pointer values.