Connecting to LinkedIn...

W1siziisijiwmtuvmdqvmtuvmdgvntqvmzgvnzi1l01ptlrbu0hfqkxpr19vtljftkrfukvex0lnqudfx3jlc2l6zwrfyw5kx3jlbmrlcmvklmpwzyjdlfsiccisinrodw1iiiwimtkymhgxmjuwiyjdxq

Blog

Georgia Tech research identifies Android security weaknesses caused by performance design

20/06/2014 by

W1siziisijiwmtqvmtavmjgvmtuvmzyvntgvmza0l2zpbguixsxbinailcj0ahvtyiisijywmhg0mdbcdtawm2uixv0

Georgia Tech researchers have identified a weakness in one of Android’s security features and will present their work at Black Hat USA 2014, which will be held August 6-7 in Las Vegas. The research, titled Abusing Performance Optimisation Weaknesses to Bypass ASLR, identifies an Android performance feature that weakens a software protection called Address Space Layout Randomization (ASLR), leaving software components vulnerable to attacks that bypass the protection. The work is aimed at helping security practitioners identify and understand the future direction of such attacks.

The work was conducted at the Georgia Tech Information Security Center (GTISC) by Ph.D. students Byoungyoung Lee and Yeongjin Jang and research scientist Tielei Wang, and reveals that the introduction of performance optimisation features can inadvertently harm the security guarantees of an otherwise vetted system. In addition to describing how vulnerabilities originate from such designs, they demonstrate real attacks that exploit them.

“To optimize object tracking for some programming languages, interpreters for the languages may leak address information,” said Lee, lead researcher for the effort. “As a concrete example, we’ll demonstrate how address information can be leaked in the Safari web browser by simply running some JavaScript.”

This article has been extracted from http://esciencenews.com, please click on this link to read the article in full http://esciencenews.com/articles/2014/06/19/georgia.tech.research.identifies.android.security.weaknesses.caused.performance.design

Montash is a multi-award winning, global IT recruitment firm. Specialising in permanent and contract positions across mid-senior appointments which cover a wide range of industry sectors and IT functions, including:

ERP, BI & Data, Information Security, IT Architecture & Strategy, Scientific Technologies, Demand IT and Business Engagement, Digital and E-commerce, Infrastructure and Service Delivery, Project and Programme Delivery.

With offices based in London, Montash has completed assignments in over 30 countries and has appointed technical professionals from board level to senior and mid-management in permanent and contract roles.

Bypassing ASLR using hash table leaks was previously believed to be obsolete due to its complexity. By exhaustively investigating various language implementations and presenting concrete attacks, the research aims to show that the concern is still valid.

comments powered by Disqus

Social Stream

Latest News

W1siziisijiwmtyvmtivmdivmtavmdcvntcvotkwl2j1c2luzxnzigludgvsbglnzw5jzs5qcgcixsxbinailcj0ahvtyiisijm4mhgxmdajil1d

Annual growth rate for BI market set at 8.4%

2016-12-02 10:00:00 +0000

A new report has suggested that the compound average growth rate (CAGR) for the business intelligence (BI) market between 2016 and 2021 is likely to be around 8.4 per cent. The latest publication, named Global Business Intelligence Market by Mobile BI, Cloud BI, and Other Applications: Global Industry Perspective, Comprehensive Analysis and Forecast, 2015-2021, said that 2015 saw the global BI sector valued at $16.33 billion. By 2021, this is expected t...

W1siziisijiwmtyvmtevmzavmtavmjavntuvndgzl09jbcbyawcgc2vhlmpwzyjdlfsiccisinrodw1iiiwimzgwedewmcmixv0

Crisis in oil and gas industry nears turning ...

2016-11-30 10:00:00 +0000

A new report has suggested that the current crisis being experienced by the gas and oil industry is nearing a turning point. As part of the 25th Oil and Gas Survey, it was found that although two-thirds of firms had cut employment levels in 2015, the speed at which these cuts are occurring has slowed. In addition, other methods of saving have been utilised to drive operational costs down. Amongst the firms questioned, it was found that 67 per cent of bu...