|COOKIES: By using this website you agree that we can place Google Analytics Cookies on your device for performance monitoring.|
Pointless Tainting? Evaluating the practicality of pointer tainting
If you have a question about this talk, please contact Eiko Yoneki.
This talk evaluates pointer tainting, an incarnation of Dynamic Information Flow Tracking (DIFT). Pointer tainting has been used for two main purposes: detection of privacy-breaching malware (e.g., trojan keyloggers obtaining the characters typed by a user), and detection of memory corruption attacks against non-control data (e.g., a buffer over?ow that modi?es a user’s privilege level). The technique is considered one of the only methods for detecting them in unmodi?ed binaries. Unfortunately, almost all of the incarnations of pointer tainting are ?awed. We found that pointer tainting generates itself the conditions for false positives. We analyse the problems in detail and investigate various ways to improve the technique. Most have serious drawbacks in that they are either impractical (and incur many false pos- itives still), and/or cripple the technique’s ability to detect attacks. We argue that depending on architecture and operating system, pointer tainting may have some value in detecting memory corruption attacks (albeit with false negatives and not on the popular x86 architecture), but it is not suitable for automated detecting of privacy-breaching malware such as keyloggers.
Bio: Asia Slowinska is a third-year PhD student at the Vrije Universiteit Amsterdam. Her research concerns intrusion detection, signature generation, and honeypots. Currently she’s interning with MSRC .
This talk is part of the Computer Laboratory Systems Research Group Seminar series.
This talk is included in these lists:
Note that ex-directory lists are not shown.
Other listsTurkish-Armenian Relations. Facing History: Denial as a Security Concept All CMS Events Hearing Group Meetings
Other talksPESGB Seminar Series: An Arendtian perspective on inclusive education: towards a reimagined vocabulary Seeing the wood as well as the trees: the importance of the ‘macro’ perspective for public health Check Yourself Out: Recognising the Signs of Breast Cancer Discussion about the possibility of a ninth planet in the Solar System (Batygin & Brown 2016) Joint IET/I Mech E - beers and careers event 'Antislavery and Empire: Paradoxes of Liberation in the Western Indian Ocean'