Automatic Patch-Based Exploit Generation
Published:
April 24 2008, 04:27 PM
by
Ken Williams
The Full-Disclosure mailing list is good for interesting, and often humorous, content on a daily basis. The highlight of the week last week was a link to a paper entitled "Automatic Patch-Based Exploit Generation", by David Brumley, Pongsin Poosankam, Dawn Song, and Jiang Zheng. From the abstract ... "In this paper, we propose techniques for automatic patch-based exploit generation, and show that our techniques can automatically generate exploits for vulnerable programs based upon patches provided via Windows Update. [...] Attackers can simply wait for a patch to be released, use these techniques, and with reasonable chance, produce a working exploit within seconds. Coupled with a worm, all vulnerable hosts could be compromised before most are even aware a patch is available, let alone download it." 2008 is going to be an interesting year for security enthusiasts.
Edited to add: Halvar.Flake has a blog post with very insightful commentary on the paper.
By: Ken Williams
Ken Williams is a Director with the CA Vulnerability Research Team. As a veteran vulnerability researcher, Ken has worked as the Director of the CA Vulnerability Research Team and eVM Research Team, Director of Vulnerability Research at eSecurityOnline, Manager of the Vulnerability Research Team at Ernst...
Read More..