DEFCON 18: Exploitation on ARM: Technique and Bypassing Defense Mechanisms 3/3

Описание: Speaker: Itzhak Avraham (zuk)

In this presentation there will be covered (from scratch) quick talk on security mechanisms on X86 and how to bypass them, how exploits are being used on X86 and why they won't work as is on ARM, How to approach ARM assembly from hacker point of view and how to write exploits in the proper way for a remote and local attacker on ARM, what are the options for ARM hacker, etc.

This presentation starts from the very basics of ARM assembly (since there are not lots of expert on this subject) and advance to an expert level of ARM. After this talk you'll think in ARM way. Today, ARM is running on almost everything (mobile phones, TVs, or tons of other devices). Till now, we were used to think that ARM means no protection mechanisms, which is not the case with the next generation mobile phones.

In the recent/upcoming mobile phones you can start seeing security mechanisms implied. How can you run your shellcode if your stack is not executable? What else do you need to know?

There's almost nothing known on how to exploit weaknesses over ARM in the assembly level, when there are security mechanisms which are very common in X86.

This presentation also presents a technique to create a shellcode which will be able to pass security mechanisms over ARM. For example, this technique can be used to exploit a stack-overflow on ARM when stack is not executable.

For presentations, whitepapers or audio version of the Defcon 18 presentations visit: http://defcon.org/html/links/dc-archi...