Describing Data Format Exploits Using Bitstream Segment Graphs

Michael Hartle; Daniel Schumann; Arsene Botchak; Erik  Tews; Max Mühlhäuser

doi:10.1109/ICCGI.2008.21

Describing Data Format Exploits Using Bitstream Segment Graphs

Michael Hartle, Daniel Schumann, Arsene Botchak, Erik Tews, Max Mühlhäuser

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

1 Citation (Scopus)

8 Downloads (Pure)

Abstract

Exploits based on data processing bugs are delivered through crafted data that seems to follow a data format, yet is altered in some way to trigger a specific bug during processing, eg. in order to execute contained malicious code. Decomposing crafted data according to the purported data format and the function of its components that are not format-compliant is a step towards understanding the delivery mechanism of an exploit and fixing the vulnerable application. This paper demonstrates the use of bitstream segment graphs for describing the structure of exploits on the example of the TIFF Jailbreak exploit for the Apple iPhone and iPod Touch with firmware 1.1.1.

Original language	English
Title of host publication	The Third International Multi-Conference on Computing in the Global Information Technology, ICCGI 2008
Place of Publication	Piscataway, NJ
Publisher	IEEE
Pages	119-124
Number of pages	6
ISBN (Print)	978-0-7695-3275-2
DOIs	https://doi.org/10.1109/ICCGI.2008.21
Publication status	Published - 2008
Event	3rd International Multi-Conference on Computing in the Global Information Technology 2008 - Athens, Greece Duration: 27 Jul 2008 → 1 Aug 2008 Conference number: 3

Conference

Conference	3rd International Multi-Conference on Computing in the Global Information Technology 2008
Abbreviated title	ICCGI 2008
Country/Territory	Greece
City	Athens
Period	27/07/08 → 1/08/08

Access to Document

10.1109/ICCGI.2008.21

https://www.datenzone.de/blog/wp-content/uploads/2016/06/DESCRIBING-DATA-FORMAT-EXPLOITS-USING-BITSTREAM-SEGMENT-GRAPHS.pdf

Cite this

@inproceedings{03087cbfe58040adb62e5d78b403c84a,

title = "Describing Data Format Exploits Using Bitstream Segment Graphs",

abstract = "Exploits based on data processing bugs are delivered through crafted data that seems to follow a data format, yet is altered in some way to trigger a specific bug during processing, eg. in order to execute contained malicious code. Decomposing crafted data according to the purported data format and the function of its components that are not format-compliant is a step towards understanding the delivery mechanism of an exploit and fixing the vulnerable application. This paper demonstrates the use of bitstream segment graphs for describing the structure of exploits on the example of the TIFF Jailbreak exploit for the Apple iPhone and iPod Touch with firmware 1.1.1.",

author = "Michael Hartle and Daniel Schumann and Arsene Botchak and Erik Tews and Max M{\"u}hlh{\"a}user",

year = "2008",

doi = "10.1109/ICCGI.2008.21",

language = "English",

isbn = "978-0-7695-3275-2",

pages = "119--124",

booktitle = "The Third International Multi-Conference on Computing in the Global Information Technology, ICCGI 2008",

publisher = "IEEE",

address = "United States",

note = "3rd International Multi-Conference on Computing in the Global Information Technology 2008, ICCGI 2008 ; Conference date: 27-07-2008 Through 01-08-2008",

}

Hartle, M, Schumann, D, Botchak, A, Tews, E & Mühlhäuser, M 2008, Describing Data Format Exploits Using Bitstream Segment Graphs. in The Third International Multi-Conference on Computing in the Global Information Technology, ICCGI 2008. IEEE, Piscataway, NJ, pp. 119-124, 3rd International Multi-Conference on Computing in the Global Information Technology 2008, Athens, Greece, 27/07/08. https://doi.org/10.1109/ICCGI.2008.21

Describing Data Format Exploits Using Bitstream Segment Graphs. / Hartle, Michael; Schumann, Daniel; Botchak, Arsene et al.
The Third International Multi-Conference on Computing in the Global Information Technology, ICCGI 2008. Piscataway, NJ: IEEE, 2008. p. 119-124.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - Describing Data Format Exploits Using Bitstream Segment Graphs

AU - Hartle, Michael

AU - Schumann, Daniel

AU - Botchak, Arsene

AU - Tews, Erik

AU - Mühlhäuser, Max

N1 - Conference code: 3

PY - 2008

Y1 - 2008

N2 - Exploits based on data processing bugs are delivered through crafted data that seems to follow a data format, yet is altered in some way to trigger a specific bug during processing, eg. in order to execute contained malicious code. Decomposing crafted data according to the purported data format and the function of its components that are not format-compliant is a step towards understanding the delivery mechanism of an exploit and fixing the vulnerable application. This paper demonstrates the use of bitstream segment graphs for describing the structure of exploits on the example of the TIFF Jailbreak exploit for the Apple iPhone and iPod Touch with firmware 1.1.1.

AB - Exploits based on data processing bugs are delivered through crafted data that seems to follow a data format, yet is altered in some way to trigger a specific bug during processing, eg. in order to execute contained malicious code. Decomposing crafted data according to the purported data format and the function of its components that are not format-compliant is a step towards understanding the delivery mechanism of an exploit and fixing the vulnerable application. This paper demonstrates the use of bitstream segment graphs for describing the structure of exploits on the example of the TIFF Jailbreak exploit for the Apple iPhone and iPod Touch with firmware 1.1.1.

U2 - 10.1109/ICCGI.2008.21

DO - 10.1109/ICCGI.2008.21

M3 - Conference contribution

SN - 978-0-7695-3275-2

SP - 119

EP - 124

BT - The Third International Multi-Conference on Computing in the Global Information Technology, ICCGI 2008

PB - IEEE

CY - Piscataway, NJ

T2 - 3rd International Multi-Conference on Computing in the Global Information Technology 2008

Y2 - 27 July 2008 through 1 August 2008

ER -

Describing Data Format Exploits Using Bitstream Segment Graphs

Abstract

Conference

Access to Document

Fingerprint

Cite this