Stephan Chenette's guest appearances

Stephan Chenette

Black Hat Briefings, USA 2007 [Video] Presentations from the security conference.

Black Hat Briefings, USA 2007 [Audio] Presentations from the security conference.

Krishna Kurapati

Chris Palmer

Keith Jones

Mark Ryan

Bruce Schneier

Tony Sager

Mark Dowd

David Byrne

Rob King

Jennifer Granick

Robert Graham

John McDonald

Mike Perry

Robert Hansen

Jamie Butler

OwlTail

Moti Joseph

In 2007 black hat Europe a talk was given titled: "Heap Feng Shui in JavaScript"		That presentation introduced a new technique for precise manipulation of the browser heap layout using specific sequences of JavaScript allocations.	This allowed an attacker to set up the heap in any desired state and exploit difficult heap corruption vulnerabilities with more reliability and precision.		Our talk is a defensive response to this new technique. We will begin with an overview of "in the wild" heap spray exploits and how we can catch them, as well other zero day exploits using our exploit-detection module.	We will give an overview of the analysis engine we have built that utilizes this module and we will demonstrate scanning and detection of a "live" website hosting a heap corruption vulnerability.		The talk will focus on Internet Explorer exploitation, but the general technique presented is applicable to other browsers as well.

In 2007 black hat Europe a talk was given titled: "Heap Feng Shui in JavaScript" 	 	That presentation introduced a new technique for precise manipulation of the browser heap layout using specific sequences of JavaScript allocations. 	This allowed an attacker to set up the heap in any desired state and exploit difficult heap corruption vulnerabilities with more reliability and precision. 	 	Our talk is a defensive response to this new technique. We will begin with an overview of "in the wild" heap spray exploits and how we can catch them, as well other zero day exploits using our exploit-detection module. 	We will give an overview of the analysis engine we have built that utilizes this module and we will demonstrate scanning and detection of a "live" website hosting a heap corruption vulnerability. 	 	The talk will focus on Internet Explorer exploitation, but the general technique presented is applicable to other browsers as well.

Stephan Chenette & Moti Joseph: Defeating Web Browser Heap Spray Attacks