ROP is Dying and Your Exploit Mitigations are on Life Support

[Solarquest]

Too often the defense community makes the mistake of focusing on the what, without truly understanding the why. This mindset often leads to the development of technologies that have limited effectiveness, and an even shorter shelf life. Time and again we’ve seen newly developed software protections bypassed shortly after their release. This is especially true with exploit mitigations, and Return-Oriented Programming (ROP) in particular. In short, current defenses target obsolete offensive techniques.

The offensive community has known something for a long time that I would like to share with you. ROP is dying and ROP exploit mitigations aren’t as effective as you might think.

......
By: Cody Pierce

More in the link above.

 

[hjlbx]

ROP ain't going away any time soon... so keep dem dare ROP anti-exploit softs on your systems boys.

When every body starts talking about phasing-ou ROPt anti-exploit softs - like people talk about phasing-out Flash today - then you might want to start looking around for some new strategies.

Maybe sometime within the next 10 years. By then, you'll probably have moved on past the IT security drama and debates...

 

[DJ Panda]

I don't mean to sound arrogant in any way but why have an anti exploit software if you have never encountered an exploit before or never go on crack/porn sites I ghghavent ever gotten malvertised or exploited so I don't use anti exploits (used to use MBAE for support of company) (adblocking I went for a few months and got scared that if I kept doing it YT and other sites would charge big time to site view)