期刊文献+

一种非堆喷射的IE浏览器漏洞利用技术研究 被引量:5

Study of Non-Heapspray IE's Vulnerability Exploitation Technique
下载PDF
导出
摘要 随着互联网技术的进步和发展,计算机成为人们日常生产生活不可缺少的工具,计算机系统的安全问题愈加重要。目前,利用各类系统或软件的漏洞已经成为主流的攻击方法。为更加有效防御针对漏洞的攻击,就需要对各类漏洞利用方法深入研究。文章基于流行的IE浏览器漏洞利用方法的研究,介绍了一种新型的浏览器漏洞利用技术,并在已知漏洞中得到了验证。 With the progress and development of Internet technology, the computer has been the indispensable tool in people's daily life. The security issue of computer system becomes increasingly significant. At present, vulnerability exploitation of systems or software has become a popular attacking method. In order to defend the attack to vulnerability more effectively, we need to study various methods of vulnerability exploitation. This paper introduces a new technique of browser’s vulnerability-exploitation, which has been veriifed in the known vulnerabilities, based on popular methods of IE’s vulnerability exploitation.
出处 《信息网络安全》 2014年第6期39-42,共4页 Netinfo Security
基金 国家自然科学基金[61170282]
关键词 IE浏览器 堆喷射漏洞 漏洞利用 IE browser heapspray vulnerability vulnerability exploitation
  • 相关文献

参考文献16

  • 1E. J. Schwartz, T. Avgerinos, D. Brunlley. Exploit hardening Made Easy [C].Proceedings of the 20th USENIX Security Symposiunl, 2011.
  • 2Haroon Meer. The Complete History of Memory Corruption Attacks [C]. BlackHat Confidence USA, 2010.
  • 3David Litchfield, Buffer Underruns. DEP, ASLR and improving the Exploitation Prevention Mechanisms (XPMs) on the Windows platfbrm [EB/OL].http://www.ngssoftware.com,2014-05- 1 0.
  • 4Ken Johnson, Matt Miller. Exploit Mitigation hnprovement in Windows 8 [C]. Blackhat USA , 2012.
  • 5Alexander Sotirov. Heap Feng Shui in Javascript [EB/OL]. http:// www.phreedom.org/research/heap-feng-shui/heap-feng-shui.hmtl,2014- 03-05.
  • 6Ratanaworabhan P, Livshits B , Zorn B. NOZZLE: A Defense Against Heap-spraying Code Injection Attacks [C]. Proceedings of the 18th USENIX Security Symposium, 2009.
  • 7Brett Moore. Heaps about Heaps [C]. SyScan Singapore, 2008.
  • 8V Pappas, M Polychronakis. Smashing the Gadgets: Hindering Retum-Oriented Programming Using In-place Code , andomization[C]. IEEE Symposium on Security and Privacy, 2012.
  • 9Kangjie Lu, Dabi Zou, Weiping Wen, 1)ebm Gao.Packed, Printable, and Polymorphic Return-Oriented Programming[C]. The 14th International Symposium on P, ecent Advances in Intrusion Detection, 2011.
  • 10Peter Vreugdenhil. Pwn2Own-2010-Windows 7-InternetExplorer 8[EB/OL]. http://wenku.baidu.com/link?url=7elSHgHLc-Je2dGrPwLFU SnlaaSoJj2iqF6dgFhUgJ6IBnSpchd32zgl/.UFNJQ M G5y 1p_VdNTNGIf_ nSLlkKZIZafyYJ6L6FKK3Zkuih2Mgq7,2014-05-10.

同被引文献95

  • 1Corporation S. Internet Security Threat Report (ISTR.) [R.]. California:Symantec Corporation, 2014.
  • 2Apvrille A. Symbian worm Yxes: Towards mobile botnets?[J]. Journalin Computer Virology, 2012, 8(4): 117-131.
  • 3Hua J, Sakurai K. A sms-based mobile botnet using flooding algorithm,Information Security Theory and Practice[J].Security and Privacy ofMobile Devices in Wireless Communication: Springer, 2011: 264-279.
  • 4Hamandi K, Elhajj I H, Chehab A, et al. Android SMS botnet: a newperspective[C]// Proceedings of the 10th ACM international symposiumon Mobility management and wireless access, 2012: 125-130.
  • 5Geng G, Xu G, Zhang M, et al. The design of sms based heterogeneousmobile botnet[J].Journal of Computers, 2012, 7(1): 235-243.
  • 6Zeng Y, Shin K G, Hu X. Design of SMS commanded-and-controlled and P2P-structured mobile botnets[C]// Proceedings of thefifth ACM conference on Security and Privacy in Wireless and MobileNetworks, 2012: 137-148.
  • 7Mtibaa A, Harras K A, AJnuweiri H. Malicious attacks in MobileDevice Clouds: A data driven risk assessment[C]/ /ComputerCommunication and Networks (ICCCN), 2014 23rd InternationalConference on, 2014: 1-8.
  • 8Singh K, Sangal S, Jain N, et al. Evaluating bluetooth as a medium forbotnet command and control|J]. Detection of Intrusions and Malware, andVulnerability Assessment: Springer, 2010: 61-80.
  • 9Hua J, Sakurai K. Botnet command and control based on ShoreMessage Service and human mobility [J]. Computer Networks, 2013, 57(2):579-597.
  • 10Jiang R M, Jhang J S, Hsu F H, et al. JokerBot-An Android-BasedBotnet[J].Applied Mechanics and Materials, 2013, (284): 3454-3458.

引证文献5

二级引证文献9

相关作者

内容加载中请稍等...

相关机构

内容加载中请稍等...

相关主题

内容加载中请稍等...

浏览历史

内容加载中请稍等...
;
使用帮助 返回顶部