Tielei Wang is PHD of Peking University institute of computer. He is interested in the discovery of binary vulnerabilities and the analysis of malicious code. And he was the first one, came from China mainland and gave a speech at NDSS as the first author affiliation. He was a speaker of Xcon2009 and POC2009.
Heap spraying is an attack technique commonly used in hijacking browsers to execute drive-by downloads. In this attack, attackers first fill the victim process's heap with a large amount of code and data. Then they exploit a vulnerability to redirect the victim process's control to attackers' code on the heap. Because the location of the injected code is not exactly predictable, traditional heap-spraying attacks need to inject a huge amount of executable code to increase the possibility of successful attacks. Injected executable code usually includes lots of NOP-like instructions, which forms the surface area leading to attackers' code. Targetting this attack characteristic, previous solutions detect heap-spraying attacks by searching for the existence of such large amount of NOP sled and other shellcode.
In this presentation, we analyze the implication of modern operating systems' memory allocation granularity and present Heap Taichi, a new heap spraying technique exploiting the weakness in memory alignment. We describe four new heap object structures that can evade existing detection tools, as well as proof-of-concept heap- spraying code implementing our technique. Our research reveals that a large amount of NOP sleds is not necessary for a reliable heap-spraying attack. In our experiments, we showed that our heap- spraying attacks are a realistic threat by evading existing detection mechanisms. To detect and prevent the new heap-spraying attacks, we propose enhancement to existing approaches and propose to use finer memory allocation granularity at memory managers of all levels and studied the impact of this solution on system performance.