Keynote Speaker : Ahmad-Reza Sadeghi
Everything You Code Can and Will be Re-used Against You: On the Challenges of Mitigating Code-Reuse Exploits
Memory corruption and memory disclosure vulnerabilities are still a persistent source of threats against software systems, although known for over two decades. The main problem is that modern software still contains vast amount of unsafe, legacy code. Moreover, exploitation techniques are rapidly evolving and often incorporate increasingly sophisticated techniques, which can be used to bypass all widely deployed countermeasures such as Data Execution Prevention (DEP) or Address Space Layout Randomization (ASLR). This has recently motivated many researchers in academia and industry to make considerable efforts on improving defenses against modern code-reuse exploits. It seems that there is a strong desire in our community to build secure systems from unsafe code! Hence, many software-hardening solutions have been proposed, some of which are based on hardware support. Recently Intel has released new specification on Control-Flow Enforcement Technology (CET) for x86/x64 to mitigate code-reuse techniques.
However, even though these solutions significantly raise the bar for exploitation, new attacks are continually discovered, and no ultimate solution seems to be in sight.
This talk gives an overview of the continuing arms race between code-reuse attacks and mitigation techniques and their nuances, particularly the hardware-based defenses. We then highlight and discuss the effectiveness and usefulness of recent approaches. The game is not over yet.
Ahmad-Reza Sadeghi is a full professor of Computer Science at the TU Darmstadt, Germany. He is the head of the Systems Security Lab at the Cybersecurity Research Center of TU Darmstadt. Since January 2012 he is also the director of the Intel Collaborative Research Institute for Secure Computing (ICRI-SC) at TU Darmstadt. He holds a Ph.D. in Computer Science from the University of Saarland, Germany. Prior to academia, he worked in R&D of Telecommunications enterprises, amongst others Ericsson Telecommunications. He has been continuously contributing to security and privacy research. For his influential research on Trusted and Trustworthy Computing he received the renowned German “Karl Heinz Beckurts” award. This award honors excellent scientific achievements with high impact on industrial innovations in Germany.
He is Editor-In-Chief of IEEE Security and Privacy Magazine, and on the editorial board of ACM Books. He served 5 years on the editorial board of the ACM Transactions on Information and System Security (TISSEC), and was guest editor of the IEEE Transactions on Computer-Aided Design (Special Issue on Hardware Security and Trust).