article · 2006
Exploit hijacking
Costin Raiciu, Mark Handley, David S. Rosenblum
Cited by 5Abstract and details only
Abstract
Recent advances in the defense of networked computers use instrumented binaries to track tainted data and can detect attempted break-ins automatically. These techniques identify how the transfer of execution to the attacker takes place, allowing the automatic generation of defenses. However, as with many technologies, these same techniques can also be used by the attackers: the information provided by detectors is accurate enough to allow an attacker to create a new worm using the same vulnerability, hijacking the exploit. Hijacking changes the threat landscape by pushing attacks to extremes (targeting selectively or creating a rapidly spreading worm), and increasing the requirements for automatic worm containment mechanisms. In this paper, we show that hijacking is feasible for two categories of attackers: those running detectors and those using Self-Certifying Alerts, a novel mechanism proposed by Costa et al. for end-to-end worm containment. We provide a discussion of the effects of hijacking on the threat landscape and list a series of possible countermeasures.
Cite this paper
Raiciu, C., Handley, M., & Rosenblum, D. S. (2006). Exploit hijacking. https://doi.org/10.1145/1162666.1162670
Raiciu, Costin, et al. “Exploit hijacking.” 2006, pp. 123–30, https://doi.org/10.1145/1162666.1162670.
Raiciu, Costin, Mark Handley, and David S. Rosenblum. 2006. “Exploit hijacking.” https://doi.org/10.1145/1162666.1162670.
Raiciu, C., Handley, M. and Rosenblum, D.S. (2006) ‘Exploit hijacking’. Available at: https://doi.org/10.1145/1162666.1162670.
@article{raiciu2006exploit,
title = {{Exploit hijacking}},
author = {Raiciu, Costin and Handley, Mark and Rosenblum, David S.},
pages = {123--130},
year = {2006},
doi = {10.1145/1162666.1162670}
}Made from the index record. Check names, capitalisation and page numbers against the paper. Need another style? AI for Research has over 10,000.