Detecting House of Spirit Attacks by Glibc Heap Information Extraction
The current forensic research on heaps mainly extracts information from the heap and the NT heap of Windows. However，the study of how to extract the information on the Glibc heap in the Linux from dump files is not sufficient. To reproduce the internal information on the Glibc heap，this...
Saved in:
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | Chinese |
| Published: |
Harbin University of Science and Technology Publications
2024-02-01
|
| Series: | Journal of Harbin University of Science and Technology |
| Subjects: | |
| Online Access: | https://hlgxb.hrbust.edu.cn/#/digest?ArticleID=2299 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| Summary: | The current forensic research on heaps mainly extracts information from the heap and the NT heap of Windows. However，the study of how to extract the information on the Glibc heap in the Linux from dump files is not sufficient. To reproduce the internal information on the Glibc heap，this paper proposes a method to extract the internal information of Glibc heap in the Linux according to the field offset in the vtype description information of memory object combined with Glibc heap implementation in memory. Based on this method，three heap information extraction plugins were developed on the Rekall framework. In addition，the House of Spirit heap attack is studied，established an attack model，and extracted its attack features. A detection algorithm for House of Spirit attack is designed based on the extracted attack features. The attack detection plug-in is developed based on the heap information extraction plugins. The experimental results show that this method can effectively extract the heap information in the memory of the Linux system process，and successfully detect the House of Spirit attack in the memory based on the information combined with the attack detection algorithm. |
|---|---|
| ISSN: | 1007-2683 |