shadow v2 public release
About four months ago (April 2017), Vasilis Tsaousoglou and myself presented our work on exploiting Android's libc allocator at the 2017 INFILTRATE conference (Miami, Florida). Since version 5.0, Android has adopted the jemalloc allocator as its default libc malloc(3) implementation. For our talk we extended our previously released jemalloc heap exploration and exploitation tool called 'shadow' to support Android (both ARM32 and ARM64), and demonstrated its use on understanding the impact of libc heap corruption vulnerabilities. We also presented new jemalloc/Android-specific exploitation techniques for double free and arbitrary free vulnerabilities.
INFILTRATE 2017
CENSUS researchers Vasilis Tsaousoglou and Patroklos Argyroudis delivered the "The Shadow over Android: Heap Exploitation Assistance for Android's libc Allocator" technical talk at the 2017 INFILTRATE (Miami, Florida) conference. The abstract of the talk follows:
INFILTRATE and SUMMERCON 2015
CENSUS researcher Patroklos Argyroudis delivered the "OR'LYEH? The Shadow over Firefox" presentation at the 2015 INFILTRATE (Miami, Florida) and Summercon (Brooklyn, New York) conferences. The talk introduced a new jemalloc exploitation tool called "shadow" and expanded on Patroklos' previous work on Firefox/jemalloc exploitation techniques.
OR’LYEH? The Shadow over Firefox (INFILTRATE 2015)
About two months ago (April 15th 2015) I visited Miami and presented at the INFILTRATE Security Conference a talk on Firefox heap exploitation, titled “OR’LYEH? The Shadow over Firefox”. The organization of the conference was flawless and the people I met there were amazing. A special thank you to the Immunity team for being great hosts and for their helpful feedback.