检索结果-内蒙古大学图书馆

return-oriented programming on a resource constrained device

SUSTAINABLE COMPUTING-INFORMATICS & SYSTEMS 2019年 22卷 244-256页

作者： Weidler, Nathanael R. Brown, Dane Mitchell, Samuel A. Anderson, Joel Williams, Jonathan R. Costley, Austin Kunz, Chase Wilkinson, Christopher Wehbe, Remy Gerdes, Ryan Utah State Univ Logan UT 84322 USA Virginia Tech Arlington VA 22203 USA

Microcontrollers are found in many everyday devices and will only become more prevalent as the Internet of Things (IoT) and other low power devices gain momentum. As such, it is increasingly important that they are reasonably resilient to known exploitation techniques. Modern enterprise-grade systems with virtually unlimited resources have many options when it comes to implementing state of the art intrusion prevention and detection solutions. These solutions are costly in terms of energy, execution time, circuit board area, and - of - course - money. Sustainable IoT devices and power-constrained embedded systems cannot afford such costs and are forced to make suboptimal security trade-offs. One such trade-off is the design of architectures which prevent execution of injected shell code, yet have allowed return oriented programming (ROP) to emerge as a more reliable way to execute malicious code following attacks. ROP is a method used to take over the execution of a program by causing the return address of a function to be modified through an exploit vector, then returning to small segments of otherwise innocuous code located in executable memory one after the other to carry out the attacker's aims. It will be shown that the Tiva TM4C123GH6PM microcontroller, which utilizes a Cortex-M4F processor, can be fully controlled with this technique. Sufficient code is pre-loaded into a ROM on Tiva microcontrollers to erase and rewrite the flash memory where the program resides. Then, that same ROM is searched for a Turing-complete gadget set which would allow for arbitrary execution. This allows an attacker to re-purpose the microcontroller, altering the original functionality to their own malicious ends. Our results show that advanced exploitation techniques are still effective against embedded systems which prioritize energy-efficiency and that more research needs to be focused on finding the right balance of security for devices with a small energy footprint. (C) 2018 El

关键词： return-oriented programming ROP Gadgets ARM Thumb Microcontroller Resource-constrained device Flash memory

来源：评论

学校读者我要写书评

暂无评论

return-oriented programming: Systems, Languages, and Applications

引用

ACM TRANSACTIONS ON INFORMATION AND SYSTEM SECURITY 2012年第1期15卷 1–34页

作者： Roemer, Ryan Buchanan, Erik Shacham, Hovav Savage, Stefan Univ Calif San Diego San Diego CA 92103 USA

We introduce return-oriented programming, a technique by which an attacker can induce arbitrary behavior in a program whose control flow he has diverted, without injecting any code. A return-oriented program chains together short instruction sequences already present in a program's address space, each of which ends in a "return" instruction. return-oriented programming defeats the W circle plus X protections recently deployed by Microsoft, Intel, and AMD;in this context, it can be seen as a generalization of traditional return-into-libc attacks. But the threat is more general. return-oriented programming is readily exploitable on multiple architectures and systems. It also bypasses an entire category of security measures-those that seek to prevent malicious computation by preventing the execution of malicious code. To demonstrate the wide applicability of return-oriented programming, we construct a Turing-complete set of building blocks called gadgets using the standard C libraries of two very different architectures: Linux/x86 and Solaris/SPARC. To demonstrate the power of return-oriented programming, we present a high-level, general-purpose language for describing return-oriented exploits and a compiler that translates it to gadgets.

关键词： Security Algorithms return-oriented programming return-into-libc W-xor-X NX x86 SPARC RISC attacks memory safety control flow integrity

来源：评论

学校读者我要写书评

暂无评论

return-oriented programming Attack on the Xen Hypervisor

Return-Oriented Programming Attack on the Xen Hypervisor

引用

7th International Conference on Availability, Reliability and Security (ARES)

作者： Ding, Baozeng Wu, Yanjun He, Yeping Tian, Shuo Guan, Bei Wu, Guowei Chinese Acad Sci Inst Software Beijing 100190 Peoples R China Grad Univ Chinese Acad Sci Beijing 100049 Peoples R China Dalian Univ Technol Sch Software Dalian Peoples R China

ISBN: (纸本)9780769547756

In this paper, we present an approach to attack on the Xen hypervisor utilizing return-oriented programming (ROP). It modifies the data in the hypervisor that controls whether a VM is privileged or not and thus can escalate the privilege of an unprivileged domain (domU) at run time. As ROP technique makes use of existed code to implement attack, not modifying or injecting any code, it can bypass the integrity protections that base on code measurement. By constructing such kind of attack at the virtualization layer, it can motivate further research work towards preventing or detecting ROP attack on the hypervisor.

关键词： return-oriented programming hypervisor privilege escalation security

来源：评论

学校读者我要写书评

暂无评论

return-oriented programming Gadget Catalog for the Xtensa Architecture

Return-Oriented Programming Gadget Catalog for the Xtensa Ar...

引用

20th IEEE International Conference on Pervasive Computing and Communications (IEEE PerCom)

作者： Amatov, Batyi Lehniger, Kai Langendoerfer, Peter Brandenburg Tech Univ Cottbus Senftenberg Cottbus Germany IHP Leibniz Inst Innovat Mikroelekt Frankfurt Germany

ISBN: (纸本)9781665416474

This paper shows that the modern high customizable Xtensa architecture for embedded devices is exploitable by return-oriented programming (ROP) attacks. We used a simple Hello-World application written with the RIOT OS as an almost minimal code basis for determining if the number of gadgets that can be found in this code base is sufficient to build a reasonably complex attack. We determined 859 found gadgets which are sufficient to create a gadget catalog for the Xtensa. Despite the code basis used being really small, the presented gadget catalog provides Turing completeness, which allows an arbitrary computation of any exploit program.

关键词： return-oriented programming Xtensa gadget catalog gadget chaining window ABI ESP32

来源：评论

学校读者我要写书评

暂无评论

return-oriented programming protection in the IBM POWER10 22

Return-oriented programming protection in the IBM POWER10

引用

19th ACM International Conference on Computing Frontiers (CF)

作者： Moreira, Jose E. Chatterjee, Debapriya Ekanadham, K. Flores, Arnold IBM Corp Armonk NY 10504 USA

ISBN: (纸本)9781450393386

return-oriented programming (ROP) is a technique for hijacking the control-flow of a program and forcing it to perform computations that were never originally intended. ROP is achieved by modifying the values of return addresses saved to memory, causing a failure of control-flow integrity. In the POWER10 processor, we have adopted a cryptographic mechanism for ROP protection. return addresses are cryptographically hashed when control-flow enters a function and the hash is saved in memory. The hash is recomputed and compared to the saved value just before a return from the function. Any mismatch is flagged as a violation and generates an exception to the supervisor. POWER10 was augmented with instructions to generate and verify those hashes. We minimize performance impact on running programs by implementing the cryptographic hash with dedicated functional units.

关键词： return-oriented programming control-flowintegrity cryptographic hash

来源：评论

学校读者我要写书评

暂无评论

return-oriented programming without returns 10

Return-Oriented Programming without Returns

引用

17th ACM Conference on Computer and Communications Security (CCS)

作者： Checkoway, Stephen Davi, Lucas Dmitrienko, Alexandra Sadeghi, Ahmad-Reza Shacham, Hovav Winandy, Marcel Univ Calif San Diego Dept Comp Sci & Engn La Jolla CA 92093 USA Ruhr Univ Bochum Syst Secur Lab Bochum Germany

ISBN: (纸本)9781450302449

We show that on both the x86 and ARM architectures it is possible to mount return-oriented programming attacks without using return instructions. Our attacks instead make use of certain instruction sequences that behave like a return, which occur with sufficient frequency in large libraries on (x86) Linux and (ARM) Android to allow creation of Turing-complete gadget sets. Because they do not make use of return instructions, our new attacks have negative implications for several recently proposed classes of defense against return-oriented programming: those that detect the too-frequent use of returns in the instruction stream;those that detect violations of the last-in, first-out invariant normally maintained for the return-address stack;and those that modify compilers to produce code that avoids the return instruction.

关键词： x86 return-oriented programming arm

来源：评论

学校读者我要写书评

暂无评论

Finding gadgets in incremental code updates for return-oriented programming attacks on resource-constrained devices

引用

ANNALS OF TELECOMMUNICATIONS 2023年第3-4期78卷 209-220页

作者： Lehniger, Kai Saad, Abdelaziz Langendoerfer, Peter IHP Leibniz Inst Innovat Mikroelekt Wireless Syst Technol Pk 25 D-15236 Frankfurt Brandenburg Germany Brandenburg Tech Univ Cottbus Cottbus SenftenbergPl Deutsch Einheit 1 D-03046 Cottbus Brandenburg Germany

Code-reuse attacks pose a threat to embedded devices since they are able to defeat common security defences such as non-executable stacks. To succeed in his code-reuse attack, the attacker has to gain knowledge of some or all of the instructions of the target firmware/software. In case of a bare metal firmware that is protected from being dumped out of a device, it is hard to know the running instructions of the target firmware. This consequently makes code-reuse attacks more difficult to achieve. This paper presents a novel approach how an attacker can gain knowledge of some of these instructions by sniffing unencrypted incremental updates. These updates exist to reduce the radio reception power for resource-constrained devices. It will be demonstrated how a return-oriented programming (ROP) attack can be accomplished on a MSP430 MCU using only the passively sniffed incremental updates. The generated updates of the R3diff and Delta Generator (DG) differencing algorithms will be under assessment. The evaluation reveals that both of them can be exploited by the attacker and how an attacker can maximize his information gain when dealing with more than one update. It also shows that the DG generated updates leak more information than the R3diff generated updates. This stresses the fact that even delta updates need to be protected with encryption. To defend against this attack, different countermeasures that consider different power consumption scenarios are proposed, but yet to be evaluated.

关键词： return-oriented programming IoT Security Incremental code update

来源：评论

学校读者我要写书评

暂无评论

ROP-Hunt: Detecting return-oriented programming Attacks in Applications 1

引用

9th International Conference on Security, Privacy, and Anonymity in Computation, Communication and Storage (SpaCCS)

作者： Si, Lu Yu, Jie Luo, Lei Ma, Jun Wu, Qingbo Li, Shasha Natl Univ Def Technol Coll Comp Changsha 410073 Hunan Peoples R China

ISBN: (数字)9783319491486

ISBN: (纸本)9783319491486;9783319491479

return-oriented programming (ROP) is a new exploitation technique that can perform arbitrary unintended operations by constructing a gadget chain reusing existing small code sequences. Although many defense mechanisms have been proposed, some new variants of ROP attack can easily circumvent them. In this paper, we present a new tool, ROP-Hunt, that can defend against ROP attacks based on the differences between normal program and ROP malicious code. ROP-Hunt leverages instrumentation technique and detects ROP attack at runtime. In our experiment, ROP-Hunt can detect all types of ROP attack from real-world examples. We use several unmodified SPEC2006 benchmarks to test the performance and the result shows that it has a zero false positive rate and an acceptable overhead.

关键词： return-oriented programming Buffer overflow Detection Code reuse attack Binary instrumentation

来源：评论

学校读者我要写书评

暂无评论

deRop: Removing return-oriented programming from Malware 11

deRop: Removing Return-Oriented Programming from Malware

引用

27th Annual Computer Security Applications Conference (ACSAC))

作者： Lu, Kangjie Zou, Dabi Wen, Weiping Gao, Debin Peking Univ Beijing Peoples R China Singapore Management Univ Singapore 178902 Singapore

ISBN: (纸本)9781450306720

Over the last few years, malware analysis has been one of the hottest areas in security research. Many techniques and tools have been developed to assist in automatic analysis of malware. This ranges from basic tools like disassemblers and decompilers, to static and dynamic tools that analyze malware behaviors, to automatic malware clustering and classification techniques, to virtualization technologies to assist malware analysis, to signature- and anomaly-based malware detection, and many others. However, most of these techniques and tools would not work on new attacking techniques, e.g., attacks that use return-oriented programming (ROP). In this paper, we look into the possibility of enabling existing defense technologies designed for normal malware to cope with malware using return-oriented programming. We discuss difficulties in removing ROP from malware, and design and implement an automatic converter, called deRop, that converts an ROP exploit into shellcode that is semantically equivalent with the original ROP exploit but does not use ROP, which could then be analyzed by existing malware defense technologies. We apply deRop on four real ROP malwares and demonstrate success in using deRop for the automatic conversion. We further discuss applicability and limitations of deRop.

关键词： return-oriented programming malware analysis

来源：评论

学校读者我要写书评

暂无评论

When Good Instructions Go Bad: Generalizing return-oriented programming to RISC 08

When Good Instructions Go Bad: Generalizing Return-Oriented ...

引用

15th ACM Conference on Computer and Communications Security

作者： Buchanan, Erik Roemer, Ryan Shacham, Hovav Savage, Stefan Univ Calif San Diego Dept Comp Sci & Engn La Jolla CA 92093 USA

ISBN: (纸本)9781595938107

This paper reconsiders the threat posed by Shacham's "return-oriented programming"-a technique by which W circle plus X-style hardware protections arc evaded via carefully crafted stack frames that divert control flow into the middle of existing variable-length x86 instructions - creating short new instructions streams that then return. We believe this attack is both more general and a greater threat than the author appreciated. In fact, the vulnerability is not limited to the x86 architecture or any particular operating system, is readily exploitable, and bypasses ail entire category of malware protections. In this paper we demonstrate general return-oriented programming on the SPARC, a fixed instruction length RISC architecture with structured control flow. We construct a Turing-complete library of code gadgets using snippets of the Solaris libc, a general purpose programming language, and a compiler for constructing return-oriented exploits. Finally, we argue that the threat posed by return-oriented programming, across all architectures and systems, has negative implications for ail entire class of security mechanisms: those that seek to prevent malicious computation by preventing the execution of malicious code.

关键词： return-oriented programming return-into-libc SPARC RISC

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：