The DOI matches its Crossref record; 13 of the 13 references it cites were found in a registry or an index.
Hacking Blind
Abstract
We show that it is possible to write remote stack buffer overflow exploits without possessing a copy of the target binary or source code, against services that restart after a crash. This makes it possible to hack proprietary closed-binary services, or open-source servers manually compiled and installed from source where the binary remains unknown to the attacker. Traditional techniques are usually paired against a particular binary and distribution where the hacker knows the location of useful gadgets for Return Oriented Programming (ROP). Our Blind ROP (BROP) attack instead remotely finds enough ROP gadgets to perform a write system call and transfers the vulnerable binary over the network, after which an exploit can be completed using known techniques. This is accomplished by leaking a single bit of information based on whether a process crashed or not when given a particular input string. BROP requires a stack vulnerability and a service that restarts after a crash. We implemented Braille, a fully automated exploit that yielded a shell in under 4,000 requests (20 minutes) against a contemporary nginx vulnerability, yaSSL + MySQL, and a toy proprietary server written by a colleague. The attack works against modern 64-bit Linux with address space layout randomization (ASLR), no-execute page protection (NX) and stack canaries.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks
Cowan, C., Pu, C., Maier, D., Hintony, H., Walpole, J., Bakke, P., Beattie, S., Grier, A., Wagle, P., & Zhang, Q. (1998) · PDXScholar (Portland State University) · Cited by 1,278
Abadi, M., Budiu, M., Erlingsson, Ú., & Ligatti, J. (2005) · Proceedings of the 12th ACM conference on Computer and communications security · doi:10.1145/1102120.1102165 · Cited by 1,032
On the effectiveness of address-space randomization
Shacham, H., Page, M., Pfaff, B., Goh, E.-J., Modadugu, N., & Boneh, D. (2004) · Proceedings of the 11th ACM conference on Computer and communications security · doi:10.1145/1030083.1030124 · Cited by 861
Self-citationSmashing The Stack For Fun And Profit
One, A. (1996) · Medical Entomology and Zoology · Cited by 769
Address obfuscation: an efficient approach to combat a board range of memory error exploits
Bhatkar, S., DuVarney, D. C., & Sekar, R. (2003) · USENIX Security Symposium · Cited by 509
Return-Oriented Programming: Systems, Languages, and Applications
Roemer, R., Buchanan, E., Shacham, H., & Savage, S. (2012) · ACM Transactions on Information and System Security · doi:10.1145/2133375.2133377 · Cited by 497
Binary stirring: self-randomizing instruction addresses of legacy x86 binary code
Wartell, R., Mohan, V., Hamlen, K. W., & Lin, Z. (2012) · Proceedings of the 2012 ACM conference on Computer and communications security · doi:10.1145/2382196.2382216 · Cited by 323
Smashing the Gadgets: Hindering Return-Oriented Programming Using In-place Code Randomization
Pappas, V., Polychronakis, M., & Keromytis, A. D. (2012) · 2012 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2012.41 · Cited by 322
Transparent ROP exploit mitigation using indirect branch tracing
Pappas, V., Polychronakis, M., & Keromytis, A. D. (2013) · USENIX Security Symposium · Cited by 274
Hiser, J., Nguyen-Tuong, A., Co, M., Hall, M., & Davidson, J. W. (2012) · 2012 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2012.39 · Cited by 256
Cited by
DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning
Du, M., Li, F., Zheng, G., & Srikumar, V. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134015 · Cited by 1,835
(2021) · doi:10.1109/isca52012.2021.00032 · Cited by 33
Metadata
- Authors
- Bittau, A., Belay, A., Mashtizadeh, A., Mazieres, D., & Boneh, D.
- Venue
- 2014 IEEE Symposium on Security and Privacy
- Publisher
- IEEE
- Published
- 2014-05
- Pages
- 227-242
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W2293825325
- Cited by
- 313
- References
- 13
- FWCI
- 24.51
- Type
- conference paper
- Language
- en
- Open access
- closed
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Hacking Blind. https://app.cochat.ai/papers/10.1109/sp.2014.22
- The paper
- Bittau, A., Belay, A., Mashtizadeh, A., Mazieres, D., & Boneh, D. (2014). Hacking Blind. 2014 IEEE Symposium on Security and Privacy. https://doi.org/10.1109/sp.2014.22
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
