DMCA
Practical control flow integrity and randomization for binary executables
Cached
Download Links
| Venue: | in Security and Privacy (SP), 2013 IEEE Symposium on. IEEE, 2013 |
| Citations: | 59 - 1 self |
BibTeX
@INPROCEEDINGS{Zhang_practicalcontrol,
author = {Chao Zhang and Tao Wei and Zhaofeng Chen and Lei Duan and Stephen Mccamant and Dawn Song and Wei Zou},
title = {Practical control flow integrity and randomization for binary executables},
booktitle = {in Security and Privacy (SP), 2013 IEEE Symposium on. IEEE, 2013},
year = {},
pages = {559--573}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Abstract—Control Flow Integrity (CFI) provides a strong protection against modern control-flow hijacking attacks. How-ever, performance and compatibility issues limit its adoption. We propose a new practical and realistic protection method called CCFIR (Compact Control Flow Integrity and Random-ization), which addresses the main barriers to CFI adoption. CCFIR collects all legal targets of indirect control-transfer in-structions, puts them into a dedicated “Springboard section ” in a random order, and then limits indirect transfers to flow only to them. Using the Springboard section for targets, CCFIR can validate a target more simply and faster than traditional CFI, and provide support for on-site target-randomization as well as better compatibility. Based on these approaches, CCFIR can stop control-flow hijacking attacks including ROP and return-into-libc. Results show that ROP gadgets are all eliminated. We observe that with the wide deployment of ASLR, Windows/x86 PE executables contain enough information in relocation tables which CCFIR can use to find all legal instructions and jump targets reliably, without source code or symbol information. We evaluate our prototype implementation on common web browsers and the SPEC CPU2000 suite: CCFIR protects large applications such as GCC and Firefox completely automati-cally, and has low performance overhead of about 3.6%/8.6% (average/max) using SPECint2000. Experiments on real-world exploits also show that CCFIR-hardened versions of IE6, Firefox 3.6 and other applications are protected effectively.
Keyphrases
practical control flow integrity binary executables legal instruction dedicated springboard section spec cpu2000 suite average max window x86 pe common web browser enough information modern control-flow hijacking attack large application on-site target-randomization control-flow hijacking attack wide deployment prototype implementation real-world exploit springboard section symbol information realistic protection method source code rop gadget cfi adoption ccfir-hardened version jump target legal target compatibility issue main barrier random order traditional cfi relocation table indirect control-transfer in-structions strong protection compact control flow integrity abstract control flow integrity low performance overhead
