A Call to ARMs: Understanding the Costs and Benefits of JIT Spraying Mitigations

Abstract

JIT spraying allows an attacker to subvert a Just-In-Time compiler, introducing instruction sequences useful to the attacker into executable regions of the victim program's address space as a side effect of compiling seemingly innocuous code in a safe language like JavaScript. We present new JIT spraying attacks against Google's V8 and Mozilla's SpiderMonkey JavaScript engines on ARM. The V8 attack is the first JIT spraying attack not to rely on instruction decoding ambiguity, and the SpiderMonkey attack uses the first ARM payload that executes unintended instructions derived from intended instruction bytes without resynchronizing to the intended instruction stream. We review the JIT spraying defenses proposed in the literature and their currently-deployed implementations and conclude that the current state of JIT spraying mitigation, which prioritizes low performance overhead, leaves many exploitable attacker options unchecked. We perform an empirical evaluation of mitigations with low but non-zero overhead in a unified framework and find that full, robust defense implementations of diversification defenses can effectively mitigate JIT spraying attacks in the literature as well as our new attacks with a combined average overhead of 4.56% on x86-64 and 4.88% on ARM32. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

An Analysis on the Implementation of Secure Web-Related Protocols in Portuguese City Councils

“…Despite the widespread support and implementation of DNSSEC among top-level domains, studies such as (Chung et al, 2017;Lian et al, 2013;Osterweil et al, 2008;Yang et al, 2011) have found that its adoption has been low, due to factors such as lack of support from local resolvers and server misconfigurations.…”

“…The DNSSEC subsection of this work assesses the use of the DNSSEC protocol by municipal councils in Portugal. Figure 6 of DNSSEC among top-level domains, studies have found that its adoption by lower-level domains, such as municipal councils, has been low (Chung et al, 2017;Lian et al, 2013;Osterweil et al, 2008;Yang et al, 2011).…”

Rolling With Confidence: Managing the Complexity of DNSSEC Operations

“…The measurement results are publicly available. 1 Last, (iii) we develop and publish an open source tool with which operators can easily monitor their rollover themselves. 2 The registry of the Brazilian ccTLD .br used this tool to monitor their algorithm rollover in August 2018 [10], following our method.…”