Papers for

offensive security teams

Papers whose findings have a practical use for this group, as judged from the abstract. Open a paper to read what it means in practice.

Quantum algorithms improve selection of code pieces for computer exploits

Quantum ROP: Using Quantum Algorithms for ROP Chain Selection in Exploit Construction

Abstract: The quantum computing threat to cybersecurity is nowadays predominantly framed around Shor's algorithm and its eventual capacity to break asymmetric cryptography. Beyond cryptanalysis, however, quantum computing may also enable other capabilities in offensive security. This work explores one such direction: the application of quantum combinatorial optimization to Return-Oriented Programming (ROP) gadget selection for exploit construction. We formulate gadget selection as a Quadratic Unconstrained Binary Optimization (QUBO) problem that captures individual gadget cost and inter-gadget register-clobbering interactions, and solve it using QAOA on real IBM Heron r2 hardware. Applied to a Linux kernel exploitation scenario, the QAOA-selected chain achieves privilege escalation to uid=0 with SMEP and SMAP active. Across eight Linux binaries and 16 benchmark instances, QAOA recovered the lowest-cost valid chain in 11 cases; in the remaining five, it did not recover the optimum, with the failures associated with excessive circuit depth on current limited hardware.

Mon 21 SeptCryptography and Security

The gist

Building computer exploits often involves choosing a sequence of code snippets called gadgets. The authors show how quantum computing can help pick better sequences by turning this selection into a puzzle a quantum algorithm can solve. They tested this approach on real quantum hardware in attacks on Linux systems with certain security features active. They found the quantum method often picked the best chain but sometimes struggled due to current hardware limitations.

Open → 2609.25364v1