KAIST Graduate School of Information Security

[세미나] Memory Allocator Security： From CTF to Research
작성일2021-11-17
다음주, 저희 정보보호대학원에서는 KAIST, 윤인수 교수님을 모시고 "Memory Allocator Security: From CTF to Research" 주제로 아래와 같이 세미나를 개최하고자 합니다. ※ 코로나19 확산방지를 위하여 원격수업으로(ZOOM) 진행할 예정입니다. 참여를 원하시는 분들은 아래의 zoom의 참가기능을 이용하시면 됩니다. = 아 래 = o 일시 - 21.11.23(화) 16:00∼ ※ 시작시간 5분전에 준비하여 주세요. URL: https://zoom.us/j/2902905410 접속 비밀번호: 이메일 별도 공지 ================================== Title: Memory Allocator Security: From CTF to Research Abstract Capture The Flag (CTF) is a well-known and effective platform in security education by supporting isolated environments to practice hacking skills. CTF covers many hacking skills, including web hacking techniques, binary exploitations, and even trendy topics like machine learning or cryptocurrencies. One of the most famous techniques would be heap exploitation techniques that exploit heap vulnerabilities (e.g., heap overflow or use-after-free). This talk will share my experience in developing research topics from CTF skills. In particular, this talk will show how to automate the discovery of heap exploitation techniques, which are well-known knowledge to CTF players. This talk will introduce my two works, ArcHeap and HardsHeap, which are published in Usenix Security 2020 and ACM CCS 2021, respectively. ArcHeap is a tool to automatically discover heap exploitation techniques. For that, ArcHeap leverages model-based search, custom oracles to determine heap exploitation techniques, and delta-debugging to eliminate redundancies. HardsHeap extends this idea to secure allocators with randomized mechanisms, which are difficult to handle in ArcHeap. Bio Insu Yun is an assistant professor at KAIST. He is interested in system security in general, especially, binary analysis, automatic vulnerability detection, and automatic exploit generation. His work has been published to the major computer conferences such as IEEE Security & Privacy, USENIX Security, and USENIX OSDI. Particularly, his research won the best paper award from USENIX Security and OSDI in 2018. In addition to research, he has been participating in several hacking competitions as a hacking expert. In particular, he won Pwn2Own 2020 by compromising Apple Safari and won DEFCON CTF in 2015 and 2018, which is the world hacking competition. Prior to joining KAIST, he received his Ph.D. degree in Computer Science from Georgia Tech in 2020. ※ 카이스트 정보보호대학원 세미나는 카이스트 학생/교수, 그리고 Security＠KAIST 컨소시움 Silver 등급 이상의 회원사에 무료로 제공됩니다. 감사합니다.

[세미나] Memory Allocator Security： From CTF to Research

작성일2021-11-17

다음주, 저희 정보보호대학원에서는 KAIST, 윤인수 교수님을 모시고 "Memory Allocator Security: From CTF to Research" 주제로 아래와 같이 세미나를 개최하고자 합니다.

※ 코로나19 확산방지를 위하여 원격수업으로(ZOOM) 진행할 예정입니다.
참여를 원하시는 분들은 아래의 zoom의 참가기능을 이용하시면 됩니다.

= 아 래 =

o 일시
- 21.11.23(화) 16:00∼

※ 시작시간 5분전에 준비하여 주세요.

URL: https://zoom.us/j/2902905410
접속 비밀번호: 이메일 별도 공지

==================================

Title: Memory Allocator Security: From CTF to Research

Abstract
Capture The Flag (CTF) is a well-known and effective platform in security education by supporting isolated environments to practice hacking skills. CTF covers many hacking skills, including web hacking techniques, binary exploitations, and even trendy topics like machine learning or cryptocurrencies. One of the most famous techniques would be heap exploitation techniques that exploit heap vulnerabilities (e.g., heap overflow or use-after-free).
This talk will share my experience in developing research topics from CTF skills. In particular, this talk will show how to automate the discovery of heap exploitation techniques, which are well-known knowledge to CTF players. This talk will introduce my two works, ArcHeap and HardsHeap, which are published in Usenix Security 2020 and ACM CCS 2021, respectively. ArcHeap is a tool to automatically discover heap exploitation techniques. For that, ArcHeap leverages model-based search, custom oracles to determine heap exploitation techniques, and delta-debugging to eliminate redundancies. HardsHeap extends this idea to secure allocators with randomized mechanisms, which are difficult to handle in ArcHeap.

Bio
Insu Yun is an assistant professor at KAIST. He is interested in system security in general, especially, binary analysis, automatic vulnerability detection, and automatic exploit generation. His work has been published to the major computer conferences such as IEEE Security & Privacy, USENIX Security, and USENIX OSDI. Particularly, his research won the best paper award from USENIX Security and OSDI in 2018.
In addition to research, he has been participating in several hacking competitions as a hacking expert. In particular, he won Pwn2Own 2020 by compromising Apple Safari and won DEFCON CTF in 2015 and 2018, which is the world hacking competition.
Prior to joining KAIST, he received his Ph.D. degree in Computer Science from Georgia Tech in 2020.

※ 카이스트 정보보호대학원 세미나는 카이스트 학생/교수, 그리고 Security＠KAIST 컨소시움 Silver 등급 이상의 회원사에 무료로 제공됩니다.

감사합니다.

목록으로