关键词: APT攻击, 内存损坏, 内存地址泄漏, 地址空间布局随机化, 边界保护

Abstract: With memory address leakage, an attacker can bypass ALSR(address space layout randomization) mechanism, deploy ROP(return-oriented programming) chains to close the DEP (data execution prevention), and divert the program to execute Shellcode. With regard to memory address leakage, this paper gathers the related information of vulnerability instances, presents the classification of vulnerabilities resulting in memory address leakage based on the procedure of memory leakage. The paper analyzes all kinds of illegal operations of pointer or object which cause the operation of cross-border memory access, as well as side-channel information leakage.In the meantime, this paper divids the defense methods of memory address leakage into four categories according to the procedure of memory corruption attacks, including memory layout randomization, object border protection, object content protection, and the critical address information randomization. And these protections make memory layout vague, memory object unavailable, memory object unreadable and critical memory address untraceable. Finally, this paper points out that we need to provide support of memory layout randomization, fine-grained memory address randomization and object content protection in perspective of programming design, adapting the operating system to establish collaborative defense mechanism in order to build robust defense system in depth.

Key words: advanced persistent threat (APT), memory corruption, memory address leakage, address space layout randomization (ASLR), border protection