for Secure Computing

Exploitation of memory-corruption vulnerabilities in widely-used software has been a threat for over two decades and no end seems to be in sight. Since performance and back-wards compatibility trump security concerns, popular pro-grams such as web browsers, servers, and office suites still contain large amounts of untrusted legacy code written in error-prone languages such as C and C++. At the same time, modern exploits are evolving quickly and routinely in-corporate sophisticated techniques such as code reuse and memory disclosure. As a result, they bypass all widely de-ployed countermeasures including data execution prevention (DEP) and code randomization such as address space layout randomization (ASLR). The good news is that the security community has recently introduced several promising prototype defenses that offer a more principled response to modern exploits. Even though these solutions have improved substantially over time, they are not perfect and weaknesses that allow bypasses are con-tinually being discovered. Moreover, it remains to be seen whether these prototype defenses can be matured and inte-grated into operating systems, compilers, and other systems software. This paper provides a brief overview of current state-of-the-art exploitation and defense techniques against run-time exploits and elaborates on innovative research prototypes that may one day stem the tide of sophisticated exploits. We also provide a brief analysis and categorization of ex-isting defensive techniques and ongoing work in the areas of code randomization and control-flow integrity, and cover both hardware and software-based solutions