Brown CS Blog

Vasileios Kemerlis Develops "Shuffler" To Prevent Cyber-Attacks By Continuously Rearranging Code


    It's hard to launch an effective cyber-attack if you don't know the exact location of the vulnerable code you're trying to exploit.

    Assistant Professor Vasileios Kemerlis of Brown University's Department of Computer Science (Brown CS), working with lead author David Williams-King and other colleagues from Columbia University and the University of British Columbia, have just released Shuffler, an all-purpose, efficient, and user-friendly piece of software that prevents cyberattacks by continuously altering the layout of programs. 

    Shuffler, which was recently featured on ACM TechNews, takes a security feature called address space layout randomization (ASLR) to a new level. Developed more than a decade ago, ASLR foils hackers by rearranging code at the launch of a program, making it more difficult for hackers to find and exploit vulnerable code, but over time, it's become less useful as hackers use memory disclosure bugs to extract bits of code layout once programs are running.

    To counter this, Shuffler randomizes small blocks of code every 20 to 50 milliseconds, making it extremely unlikely for a hacker's attack to find the location of the desired segment. “By the time the server returns the information the attacker needs," says Vasileios, "it is already invalid — Shuffler has already relocated the respective code snippets to different memory locations."

    Instead of requiring users to be security experts, Shuffler runs in parallel with the code it protects, not modifying compilers or the operating system, and even randomizes its own code to defend against attacks.

    If you're interested in trying to break Shuffler, click here.

    To read the full article on Shuffler at the Columbia University web site, click here.

    For more information, click the link that follows to contact Brown CS Communication Outreach Specialist Jesse C. Polhemus.