It changes a broad class of attack exploits to require return-oriented programmi...

jcranmer · on Oct 22, 2015

libc by itself provides a Turing-complete set of ROP gadgets: <http://www.cs.ncsu.edu/faculty/jiang/pubs/RAID11.pdf>.

halosghost · on Oct 22, 2015

First of all: thanks! I'm excited to read this!

Second of all: ugh! Dear HackerNews team, please fix your URL matching algorithm so it doesn't include <> in URLs; they're actually explicitly recommended by the URI RFC as delimiters.

Sincerely,

halosghost

rockdoe · on Oct 22, 2015

Here's the original paper of this attack (AFAIK): http://cseweb.ucsd.edu/~hovav/dist/geometry.pdf

The other paper shows that this technique is Turing complete.

But yes, basically W^X is defeated.

eugeneionesco · on Oct 22, 2015

>Are you seriously claiming that ROP isn't "that much harder" than injecting arbitrary code?

Yes I am.