NDLI: English shellcode

Please wait, while we are loading the content...

Attacking cryptographic schemes based on "perturbation polynomials"

EPC RFID tag security weaknesses and defenses: passport cards, enhanced drivers licenses, and beyond

CoSP: a general framework for computational soundness proofs

Efficient pseudorandom functions from the decisional linear assumption and weaker variants

NISAN: network information service for anonymization networks

Ripley: automatically securing web 2.0 applications through replicated execution

On cellular botnets: measuring the impact of malicious devices on a cellular network core

Battle of Botcraft: fighting bots in online games with human observational proofs

The fable of the bees: incentivizing robust revocation decision making in ad hoc networks

On non-cooperative location privacy: a game-theoretic analysis

The bayesian traffic analysis of mix networks

On the difficulty of software-based attestation of embedded devices

A security-preserving compiler for distributed programs: from information-flow policies to cryptographic mechanisms

On voting machine design for verification and testability

Can they hear me now?: a security analysis of law enforcement wiretaps

Countering kernel rootkits with lightweight hook protection

A new cell counter based attack against tor

Large-scale malware indexing using function-call graphs

Filter-resistant code injection on ARM

An efficient forward private RFID protocol

Reactive noninterference

Improving privacy and security in multi-authority attribute-based encryption

Certificateless onion routing

HAIL: a high-availability and integrity layer for cloud storage

On lightweight mobile phone application certification

Fides: remote anomaly-based cheat detection using client emulation

Effective implementation of the cell broadband engine™ isolation loader

Privacy-preserving genomic computation through program specialization

As-awareness in Tor path selection

Proximity-based access control for implantable medical devices

Finding bugs in exceptional situations of JNI programs

Secure in-VM monitoring using hardware virtualization

English shellcode

Mapping kernel objects to enable systematic integrity checking

Scalable onion routing with torsk

Dispatcher: enabling active botnet infiltration using automatic protocol reverse-engineering

False data injection attacks against state estimation in electric power grids

RFID privacy: relation between two notions, minimal condition, and efficient construction

Computational soundness for key exchange protocols with symmetric encryption

Oblivious transfer with access control

ShadowWalker: peer-to-peer anonymous communication using redundant structured topologies

Hey, you, get off of my cloud: exploring information leakage in third-party compute clouds

SMILE: encounter-based trust for mobile social services

Behavior based software theft detection

On achieving good operating points on an ROC plane using stochastic anomaly score prediction

Feeling-based location privacy protection for location-based services

Membership-concealing overlay networks

XCS: cross channel scripting and its impact on web applications

Secure open source collaboration: an empirical study of linus' law

A metadata calculus for secure information sharing

Learning your identity and disease from research papers: information leaks in genome wide association study

Robust signatures for kernel data structures

Anonymous credentials on a standard java card

Your botnet is my botnet: analysis of a botnet takeover

A probabilistic approach to hybrid role mining

Dynamic provable data possession

Multi-party off-the-record messaging

Multiple password interference in text passwords and click-based graphical passwords

English shellcode

Content Provider	ACM Digital Library
Author	MacManus, Greg Mason, Joshua Small, Sam Monrose, Fabian
Abstract	History indicates that the security community commonly takes a divide-and-conquer approach to battling malware threats: identify the essential and inalienable components of an attack, then develop detection and prevention techniques that directly target one or more of the essential components. This abstraction is evident in much of the literature for buffer overflow attacks including, for instance, stack protection and NOP sled detection. It comes as no surprise then that we approach shellcode detection and prevention in a similar fashion. However, the common belief that components of polymorphic shellcode (e.g., the decoder) cannot reliably be hidden suggests a more implicit and broader assumption that continues to drive contemporary research: namely, that valid and complete representations of shellcode are fundamentally different in structure than benign payloads. While the first tenet of this assumption is philosophically undeniable (i.e., a string of bytes is either shellcode or it is not), truth of the latter claim is less obvious if there exist encoding techniques capable of producing shellcode with features nearly indistinguishable from non-executable content. In this paper, we challenge the assumption that shellcode must conform to superficial and discernible representations. Specifically, we demonstrate a technique for automatically producing English Shellcode, transforming arbitrary shellcode into a representation that is superficially similar to English prose. The shellcode is completely self-contained---i.e., it does not require an external loader and executes as valid IA32 code)---and can typically be generated in under an hour on commodity hardware. Our primary objective in this paper is to promote discussion and stimulate new ideas for thinking ahead about preventive measures for tackling evolutions in code-injection attacks.
Starting Page	524
Ending Page	533
Page Count	10
File Format	PDF
ISBN	9781605588940
DOI	10.1145/1653662.1653725
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2009-11-09
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Network emulation Shellcode Natural language
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Real-world polymorphic attack detection using network-level emulation

Dynamic emulation based modeling and detection of polymorphic shellcode at the network level

Network-level polymorphic shellcode detection using emulation

Comprehensive shellcode detection using runtime heuristics

Network-level polymorphic shellcode detection using emulation (2006)

Emulation-based Detection of Non-self-contained Polymorphic Shellcode

Improvement of Emulation-based Shellcode Detection

Network-level polymorphic shellcode detection using emulation (2006)

Emulation-based detection of non-self-contained polymorphic shellcode (2007)

English shellcode

Similar Documents

Real-world polymorphic attack detection using network-level emulation

Dynamic emulation based modeling and detection of polymorphic shellcode at the network level

Network-level polymorphic shellcode detection using emulation

Comprehensive shellcode detection using runtime heuristics

Network-level polymorphic shellcode detection using emulation (2006)

Emulation-based Detection of Non-self-contained Polymorphic Shellcode

Improvement of Emulation-based Shellcode Detection

Network-level polymorphic shellcode detection using emulation (2006)

Emulation-based detection of non-self-contained polymorphic shellcode (2007)

English shellcode