Results 1 - 10
of
10
Readactor: Practical code randomization resilient to memory disclosure
- In IEEE Symposium on Security and Privacy, S&P ’15
, 2015
"... Abstract-Code-reuse attacks such as return-oriented programming (ROP) pose a severe threat to modern software. Designing practical and effective defenses against code-reuse attacks is highly challenging. One line of defense builds upon fine-grained code diversification to prevent the adversary from ..."
Abstract
-
Cited by 11 (2 self)
- Add to MetaCart
(Show Context)
Abstract-Code-reuse attacks such as return-oriented programming (ROP) pose a severe threat to modern software. Designing practical and effective defenses against code-reuse attacks is highly challenging. One line of defense builds upon fine-grained code diversification to prevent the adversary from constructing a reliable code-reuse attack. However, all solutions proposed so far are either vulnerable to memory disclosure or are impractical for deployment on commodity systems. In this paper, we address the deficiencies of existing solutions and present the first practical, fine-grained code randomization defense, called Readactor, resilient to both static and dynamic ROP attacks. We distinguish between direct memory disclosure, where the attacker reads code pages, and indirect memory disclosure, where attackers use code pointers on data pages to infer the code layout without reading code pages. Unlike previous work, Readactor resists both types of memory disclosure. Moreover, our technique protects both statically and dynamically generated code. We use a new compiler-based code generation paradigm that uses hardware features provided by modern CPUs to enable execute-only memory and hide code pointers from leakage to the adversary. Finally, our extensive evaluation shows that our approach is practical-we protect the entire Google Chromium browser and its V8 JIT compiler-and efficient with an average SPEC CPU2006 performance overhead of only 6.4%.
Control jujutsu: On the weaknesses of fine-grained control flow integrity
- In ACM SIGSAC Conference on Computer and Communications Security, CCS
, 2015
"... ABSTRACT Control flow integrity (CFI) has been proposed as an approach to defend against control-hijacking memory corruption attacks. CFI works by assigning tags to indirect branch targets statically and checking them at runtime. Coarse-grained enforcements of CFI that use a small number of tags to ..."
Abstract
-
Cited by 1 (0 self)
- Add to MetaCart
(Show Context)
ABSTRACT Control flow integrity (CFI) has been proposed as an approach to defend against control-hijacking memory corruption attacks. CFI works by assigning tags to indirect branch targets statically and checking them at runtime. Coarse-grained enforcements of CFI that use a small number of tags to improve the performance overhead have been shown to be ineffective. As a result, a number of recent efforts have focused on fine-grained enforcement of CFI as it was originally proposed. In this work, we show that even a finegrained form of CFI with unlimited number of tags and a shadow stack (to check calls and returns) is ineffective in protecting against malicious attacks. We show that many popular code bases such as Apache and Nginx use coding practices that create flexibility in their intended control flow graph (CFG) even when a strong static analyzer is used to construct the CFG. These flexibilities allow an attacker to gain control of the execution while strictly adhering to a fine-grained CFI. We then construct two proof-of-concept exploits that attack an unlimited tag CFI system with a shadow stack. We also evaluate the difficulties of generating a precise CFG using scalable static analysis for real-world applications. Finally, we perform an analysis on a number of popular applications that highlights the availability of such attacks.
Per-Input Control-Flow Integrity
"... Control-Flow Integrity (CFI) is an effective approach to mitigat-ing control-flow hijacking attacks. Conventional CFI techniques statically extract a control-flow graph (CFG) from a program and instrument the program to enforce that CFG. The statically gener-ated CFG includes all edges for all possi ..."
Abstract
-
Cited by 1 (0 self)
- Add to MetaCart
(Show Context)
Control-Flow Integrity (CFI) is an effective approach to mitigat-ing control-flow hijacking attacks. Conventional CFI techniques statically extract a control-flow graph (CFG) from a program and instrument the program to enforce that CFG. The statically gener-ated CFG includes all edges for all possible inputs; however, for a concrete input, the CFG may include many unnecessary edges. We present Per-Input Control-Flow Integrity (PICFI or piCFI), which is a new CFI technique that can enforce a CFG computed for each concrete input. piCFI starts executing a program with the empty CFG and lets the program itself lazily add edges to the enforced CFG if such edges are required for the concrete input. The edge addition is performed by piCFI-inserted instrumentation code. To prevent attackers from arbitrarily adding edges, piCFI uses a statically computed all-input CFG to constrain what edges can be added at runtime. To minimize performance overhead, op-erations for adding edges are designed to be idempotent, so they can be patched to no-ops after their first execution. As our evalu-ation shows, piCFI provides better security than conventional fine-grained CFI with comparable performance overhead.
Remix: On-demand Live Randomization
"... ABSTRACT Code randomization is an effective defense against code reuse attacks. It scrambles program code to prevent attackers from locating useful functions or gadgets. The key to secure code randomization is achieving high entropy. A practical approach to boost entropy is on-demand live randomiza ..."
Abstract
- Add to MetaCart
(Show Context)
ABSTRACT Code randomization is an effective defense against code reuse attacks. It scrambles program code to prevent attackers from locating useful functions or gadgets. The key to secure code randomization is achieving high entropy. A practical approach to boost entropy is on-demand live randomization that works on running processes. However, enabling live randomization is challenging in that it often requires manual efforts to solve ambiguity in identifying function pointers. In this paper, we propose Remix, an efficient and practical live randomization system for both user processes and kernel modules. Remix randomly shuffles basic blocks within their respective functions. By doing so, it avoids the complexity of migrating stale function pointers, and allows mixing randomized and non-randomized code to strike a balance between performance and security. Remix randomizes a running process in two steps: it first randomly reorders its basic blocks, and then comprehensively migrates live pointers to basic blocks. Our experiments show that Remix can significantly increase randomness with low performance overhead on both CPU and I/O intensive benchmarks and kernel modules, even at very short randomization intervals.
Evaluating Modern Defenses Against Control Flow Hijacking Evaluating Modern Defenses Against Control Flow Hijacking
"... Abstract Memory corruption attacks continue to be a major vector of attack for compromising modern systems. Strong defenses such as complete memory safety for legacy languages (C/C++) incur a large overhead, while weaker and practical defenses such as Code Pointer Integrity (CPI) and Control Flow I ..."
Abstract
- Add to MetaCart
(Show Context)
Abstract Memory corruption attacks continue to be a major vector of attack for compromising modern systems. Strong defenses such as complete memory safety for legacy languages (C/C++) incur a large overhead, while weaker and practical defenses such as Code Pointer Integrity (CPI) and Control Flow Integrity (CFI) have their weaknesses. In this thesis, I present attacks that expose the fundamental weaknesses of CPI and CFI. CPI promises to balance security and performance by focusing memory safety on code pointers thus preventing most control-hijacking attacks while maintaining low overhead. CPI protects access to code pointers by storing them in a safe region that is isolated by hardward enforcement on 0x86-32 architecture and by information-hiding on 0x86-64 and ARM architectures. We show that when CPI relies on information hiding, CPI's safe region can be leaked and thus rendering it ineffective against malicious exploits. CFI works by assigning tags to indirect branch targets statically and checking them at runtime. Coarse-grained enforcements of CFI that use a small number of tags to improve the performance overhead have been shown to be ineffective. As a result, a number of recent efforts have focused on fine-grained enforcement of CFI as it was originally proposed. In this work, we show that even a fine-grained form of CFI with unlimited number of tags is ineffective in protecting against attacks. We show that many popular code bases such as Apache and Nginx use coding practices that create flexibility in their intended control flow graph (CFG) even when a strong static analyzer is used to construct the CFG. These flexibilities allow an attacker to gain control of the execution while strictly adhering to a fine-grained CFI.
Return to where? You can't exploit what you can't find
, 2015
"... So far, no countermeasure has been able to fully pre-vent sophisticated exploitation techniques such as return-oriented programming (ROP). Recent control-flow integrity (CFI) defenses from Google and Microsoft can be bypassed by constructing a ROP payload that adheres to the control-flow constraint ..."
Abstract
- Add to MetaCart
So far, no countermeasure has been able to fully pre-vent sophisticated exploitation techniques such as return-oriented programming (ROP). Recent control-flow integrity (CFI) defenses from Google and Microsoft can be bypassed by constructing a ROP payload that adheres to the control-flow constraints or by exploiting implementation flaws to bypass the control-flow checks. Microsoft’s EMET has less overhead than full CFI but offers less protection in return, and can also be bypassed. Probabilistic countermeasures based on memory layout randomization (such as ASLR) are already in widespread use. As the Pwn2own competitions have repeatedly demonstrated, attackers can use various types of information leaks to bypass code randomization. To reduce the impact of information disclosure vulnerabilities, recent defenses utilize execute-only memory. However, execute-only memory alone is insufficient to prevent disclosure of the code layout. In particular, we show how to determine the code layout by analyzing pointers in the heap, in vtables, and on the stack without ever directly reading the code. This paper presents a comprehensive yet practical defense— Readactor—that counters both direct reading of code and indirect layout disclosure through analysis of code pointers. We employ a thin hypervisor and a kernel patch to enable hardware-enforced execute-only memory which prevents direct reading of code. Code pointers in readable memory are hidden by converting them into direct jumps stored in execute-only memory to prevent indirect disclosure of the code layout. Readactor is efficient because it activates previously unused hardware capabilities in modern x86 processors and is often faster than industry CFI implementations. Our solution is also highly practical; we were able to automatically apply our defense to the Chromium web browser. Finally, our solution is comprehensive; we also protect the dynamically generated code emitted by the V8 JavaScript JIT compiler.
Securing Legacy Software against . . .
, 2015
"... Exploitation of memory-corruption vulnerabilities in widely-used software has been a threat for over two decades and no end seems to be in sight. Since performance and back-wards compatibility trump security concerns, popular pro-grams such as web browsers, servers, and office suites still contain l ..."
Abstract
- Add to MetaCart
Exploitation of memory-corruption vulnerabilities in widely-used software has been a threat for over two decades and no end seems to be in sight. Since performance and back-wards compatibility trump security concerns, popular pro-grams such as web browsers, servers, and office suites still contain large amounts of untrusted legacy code written in error-prone languages such as C and C++. At the same time, modern exploits are evolving quickly and routinely in-corporate sophisticated techniques such as code reuse and memory disclosure. As a result, they bypass all widely deployed countermeasures including data execution prevention (DEP) and code randomization such as address space layout randomization (ASLR). The good news is that the security community has recently introduced several promising prototype defenses that offer a more principled response to modern exploits. Even though these solutions have improved substantially over time, they are not perfect and weaknesses that allow bypasses are con-tinually being discovered. Moreover, it remains to be seen whether these prototype defenses can be matured and integrated into operating systems, compilers, and other systems software. This paper provides a brief overview of current state-of-the-art exploitation and defense techniques against run-time exploits and elaborates on innovative research prototypes that may one day stem the tide of sophisticated exploits. We also provide a brief analysis and categorization of existing defensive techniques and ongoing work in the areas of code randomization and control-flow integrity, and cover both hardware and software-based solutions.
It’s a TRaP: Table Randomization and Protection against Function-Reuse Attacks
"... Code-reuse attacks continue to evolve and remain a severe threat to modern software. Recent research has proposed a variety of defenses with differing security, efficiency, and practicality characteristics. Whereas the majority of these solutions focus on specific code-reuse attack variants such as ..."
Abstract
- Add to MetaCart
(Show Context)
Code-reuse attacks continue to evolve and remain a severe threat to modern software. Recent research has proposed a variety of defenses with differing security, efficiency, and practicality characteristics. Whereas the majority of these solutions focus on specific code-reuse attack variants such as return-oriented programming (ROP), other attack variants that reuse whole functions, such as the classic return-into-libc, have received much less attention. Mitigating function-level code reuse is highly challenging because one needs to distin-guish a legitimate call to a function from an illegitimate one. In fact, the recent counterfeit object-oriented programming (COOP) attack demonstrated that the majority of code-reuse defenses can be bypassed by reusing dynamically bound func-tions, i.e., functions that are accessed through global offset
It’s a TRaP: Table Randomization and Protection against Function-Reuse Attacks
"... Code-reuse attacks continue to evolve and remain a severe threat to modern software. Recent research has proposed a variety of defenses with differing security, efficiency, and practicality characteristics. Whereas the majority of these solutions focus on specific code-reuse attack variants such as ..."
Abstract
- Add to MetaCart
(Show Context)
Code-reuse attacks continue to evolve and remain a severe threat to modern software. Recent research has proposed a variety of defenses with differing security, efficiency, and practicality characteristics. Whereas the majority of these solutions focus on specific code-reuse attack variants such as return-oriented programming (ROP), other attack variants that reuse whole functions, such as the classic return-into-libc, have received much less attention. Mitigating function-level code reuse is highly challenging because one needs to distin-guish a legitimate call to a function from an illegitimate one. In fact, the recent counterfeit object-oriented programming (COOP) attack demonstrated that the majority of code-reuse defenses can be bypassed by reusing dynamically bound func-tions, i.e., functions that are accessed through global offset
Recommended Citation
, 2014
"... This dissertation is an in-depth case study of NATO advisors and their perceived influence in Afghanistan (2009-2012). It explores the two-part question, how do foreign security actors (ministerial advisors and security force trainers, advisors, and commanders) attempt to influence their host-nation ..."
Abstract
- Add to MetaCart
(Show Context)
This dissertation is an in-depth case study of NATO advisors and their perceived influence in Afghanistan (2009-2012). It explores the two-part question, how do foreign security actors (ministerial advisors and security force trainers, advisors, and commanders) attempt to influence their host-nation partners and what are their perceptions of these approaches on changes in local capacity, values, and security governance norms? I argue that security sector reform (SSR) programs in fragile states lack an explicit theory of change that specifies how reform occurs. From this view, I theorize internationally led SSR as “guided institutional transfer, ” grounded in rationalist and social constructivist explanations of convergence, diffusion, and socialization processes. Responding to calls for greater depth and emphasis on interactions and institutional change in SSR research, I examine NATO’s efforts in Afghanistan as an extreme case of SSR in which external-internal interactions were the highest. A stratified, purposive sample of 68 military and civilian elites (24 ministerial advisors, 27 embedded field advisors and commanders, and 17 experts and external observers) participated in a confidential, semi-structured interview.
