Quantcast
Channel: CodeSection,代码区,网络安全 - CodeSec
Viewing all articles
Browse latest Browse all 12749

Initial thoughts on the AnC attack on ASLR

$
0
0
Thoughts on the ASLR^Cache (AnC) Attack

The AnC whitepaper, publicized heavily on 15 Feb 2017, provides a very interesting look into the MMU. It utilizes a timing attack on the MMU's walk of the Page Tables in order to derandomize valid memory addresses, thus defeating ASLR. They've provided sample C code and have shown proof-of-concept videos of a javascript-based attack.

This is the first paper that has fully presented successful attacks against ASLR. Other works that provide timing attacks have since been theoretical and didn't even provide proofs-of-concept.

It's important to keep in mind, though, that this attack is really only applicable to applications that allow attackers to introduce arbitrary code, even if the code is interpreted script. The paper gives two browsers, Chrome and Firefox, as prime examples. Even then, if the scripted language does not provide performance measurement APIs, then the attack might be mitigated.

For applications that do not interpret arbitrary code, ASLR remains strong. As discussed in my article about the Branch Target Buffer whitepaper, ASLR is designed to protect against remote attacks, not local attacks. For purely remote attacks where the attacker cannot simply introduce code and has no way to inspect runtime environment, ASLR is still incredibly useful and secure.

To sum up, the AnC attack is a very interesting attack that successfully defeats ASLR in web browsers. ASLR remains strong for purely remote attacks with applications that do not execute arbitrary code.


Viewing all articles
Browse latest Browse all 12749

Trending Articles