检索结果-内蒙古大学图书馆

21st ACM Conference on Computer and Communications Security (CCS)

作者： Dahse, Johannes Krein, Nikolai Holz, Thorsten Ruhr Univ Bochum Horst Gortz Inst It Secur HGI Bochum Germany

ISBN: (纸本)9781450329576

Memory corruption vulnerabilities that lead to control-flow hijacking attacks are a common problem for binary executables and such attacks are known for more than two decades. Over the last few years, especially code reuse attacks attracted a lot of attention. In such attacks, an adversary does not need to inject her own code during the exploitation phase, but she reuses existing code fragments (so called gadgets) to build a code chain that performs malicious computations on her behalf. Return-oriented programming (ROP) is a well-known technique that bypasses many existing defenses. Surprisingly, code reuse attacks are also a viable attack vector against web applications. In this paper, we study code reuse attacks in the context of PHP-based web applications. We analyze how PHP object injection (POI) vulnerabilities can be exploited via property-oriented programming (POP) and perform a systematic analysis of available gadgets in common PHP applications. Furthermore, we introduce an automated approach to statically detect POI vulnerabilities in object-oriented PHP code. Our approach is also capable of generating POP chains in an automated way. We implemented a prototype of the proposed approach and evaluated it with 10 well-known applications. Overall, we detected 30 new POI vulnerabilities and 28 new gadget chains.

关键词： Static code Analysis Web Security PHP Object Injection Property-Oriented Programming code reuse attacks

来源：评论

学校读者我要写书评

暂无评论

Efficiently Securing Systems from code reuse attacks

引用

IEEE TRANSACTIONS ON COMPUTERS 2014年第5期63卷 1144-1156页

作者： Kayaalp, Mehmet Ozsoy, Meltem Abu Ghazaleh, Nael Ponomarev, Dmitry SUNY Binghamton Dept Comp Sci Binghamton NY 13902 USA

code reuse attacks (CRAs) are recent security exploits that allow attackers to execute arbitrary code on a compromised machine. CRAs, exemplified by return-oriented and jump-oriented programming approaches, reuse fragments of the library code, thus avoiding the need for explicit injection of attack code on the stack. Since the executed code is reused existing code, CRAs bypass current hardware and software security measures that prevent execution from data or stack regions of memory. While software-based full control flow integrity (CFI) checking can protect against CRAs, it includes significant overhead, involves non-trivial effort of constructing a control flow graph, relies on proprietary tools and has potential vulnerabilities due to the presence of unintended branch instructions in architectures such as x86-those branches are not checked by the software CFI. We propose branch regulation (BR), a lightweight hardware-supported protection mechanism against the CRAs that addresses all limitations of software CFI. BR enforces simple control flow rules in hardware at the function granularity to disallow arbitrary control flow transfers from one function into the middle of another function. This prevents common classes of CRAs without the complexity and run-time overhead of full CFI enforcement. BR incurs a slowdown of about 2% and increases the code footprint by less than 1% on the average for the SPEC 2006 benchmarks.

关键词： Security microarchitecture code reuse attacks

来源：评论

学校读者我要写书评

暂无评论

Signature-Based Protection from code reuse attacks

引用

IEEE TRANSACTIONS ON COMPUTERS 2015年第2期64卷 533-546页

作者： Kayaalp, Mehmet Schmitt, Timothy Nomani, Junaid Ponomarev, Dmitry Abu Ghazaleh, Nael SUNY Binghamton Dept Comp Sci Binghamton NY 13902 USA

code reuse attacks (CRAs) recently emerged as a new class of security exploits. CRAs construct malicious programs out of small fragments (gadgets) of existing code, thus eliminating the need for code injection. Existing defenses against CRAs often incur large performance overheads or require extensive binary rewriting and other changes to the system software. In this paper, we examine a signature-based detection of CRAs, where the attack is detected by observing the behavior of programs and detecting the gadget execution patterns. We first demonstrate that naive signature-based defenses can be defeated by introducing special "delay gadgets" as part of the attack. We then show how a software-configurable signature-based approach can be designed to defend against such stealth CRAs, including the attacks that manage to use longer-length gadgets. The proposed defense (called SCRAP) can be implemented entirely in hardware using simple logic at the commit stage of the pipeline. SCRAPis realized with minimal performance cost, no changes to the software layers, and no implications on binary compatibility. Finally, we show that SCRAP generates no false alarms on a wide range of applications.

关键词： Processor architectures support for security code reuse attacks

来源：评论

学校读者我要写书评

暂无评论

Counterfeit Object-oriented Programming On the Difficulty of Preventing code reuse attacks in C plus plus Applications 36

Counterfeit Object-oriented Programming On the Difficulty of...

引用

IEEE Symposium on Security and Privacy SP

作者： Schuster, Felix Tendyck, Thomas Liebchen, Christopher Davi, Lucas Sadeghi, Ahmad-Reza Holz, Thorsten Ruhr Univ Bochum HGI Bochum Germany Tech Univ Darmstadt CASED Darmstadt Germany

ISBN: (纸本)9781467369497

code reuse attacks such as return-oriented programming (ROP) have become prevalent techniques to exploit memory corruption vulnerabilities in software programs. A variety of corresponding defenses has been proposed, of which some have already been successfully bypassed-and the arms race continues. In this paper, we perform a systematic assessment of recently proposed CFI solutions and other defenses against code reuse attacks in the context of C++. We demonstrate that many of these defenses that do not consider object-oriented C++ semantics precisely can be generically bypassed in practice. Our novel attack technique, denoted as counterfeit object-oriented programming (COOP), induces malicious program behavior by only invoking chains of existing C++ virtual functions in a program through corresponding existing call sites. COOP is Turing complete in realistic attack scenarios and we show its viability by developing sophisticated, real-world exploits for Internet Explorer 10 on Windows and Firefox 36 on Linux. Moreover, we show that even recently proposed defenses (CPS, T-VIP, vfGuard, and VTint) that specifically target C++ are vulnerable to COOP. We observe that constructing defenses resilient to COOP that do not require access to source code seems to be challenging. We believe that our investigation and results are helpful contributions to the design and implementation of future defenses against control-flow hijacking attacks.

关键词： C++ CFI ROP code reuse attacks chemotactic factor inactivator Software reuse Retinopathy of Prematurity defenses Carbon object oriented programming Program Behavior Counterfeiting Turing

来源：评论

学校读者我要写书评

暂无评论

A Generic Technique for Automatically Finding Defense-Aware code reuse attacks 20

A Generic Technique for Automatically Finding Defense-Aware ...

引用

ACM SIGSAC Conference on Computer and Communications Security (ACM CCS)

作者： Schwartz, Edward J. Cohen, Cory F. Gennari, Jeffrey S. Schwartz, Stephanie M. Carnegie Mellon Univ Software Engn Inst Pittsburgh PA 15213 USA Millersville Univ Pennsylvania Comp Sci Dept Millersville PA USA

ISBN: (纸本)9781450370899

code reuse attacks have been the subject of a substantial amount of research during the past decade. This research largely resulted from early work on Return-Oriented Programming (ROP), which showed that the then newly proposed Non-Executable Memory (NX) defense could be bypassed. More recently, the research community has been simultaneously investigating new defenses that are believed to thwart code reuse attacks, such as Control Flow Integrity (CFI), and defense-aware techniques for attacking these defenses, such as Data-Oriented Programming (DOP). Unfortunately, the feasibility of defense-aware attacks are very dependent on the behaviors of the attacked program, which makes it difficult for defenders to understand how much protection a defense such as CFI may provide. To better understand this, researchers have introduced automated defense-aware code reuse attack systems. Unfortunately, the handful of existing systems implement a single fixed, defense-specific strategy that is complex and cannot be used to consider other defenses. In this paper, we propose a generic framework for automatically discovering defense-aware code reuse attacks in executables. Unlike existing work, which utilizes hard-coded strategies for specific defenses, our framework can produce attacks for multiple defenses by analyzing the runtime behavior of the defense. The high-level insight behind our framework is that code reuse attacks can be defined as a state reachability problem, and that defenses prevent some transitions between states. We implement our framework as a tool named Limbo, which employs an existing binary concolic executor to solve the reachability problem. We evaluate Limbo and show that it excels when there is little code available for reuse, making it complementary to existing techniques. We show that, in such scenarios, Limbo outperforms existing systems that automate ROP attacks, as well as systems that automate DOP attacks in the presence of fine-grained CFI, despite h

关键词： code reuse attacks software defenses

来源：评论

学校读者我要写书评

暂无评论

Tazhi: A Novel Technique for Hunting Trampoline Gadgets of Jump Oriented Programming (A Class of code reuse attacks) 11

Tazhi: A Novel Technique for Hunting Trampoline Gadgets of J...

引用

11th International ISC Conference on Information Security and Cryptology (ISCISC)

作者： Sadeghi, Ali-Akbar Aminmansour, Farzane Shahriari, Hamid-Reza Amirkabir Univ Technol Dept Comp Engn & Informat Technol Tehran Iran

ISBN: (纸本)9781479953837

code reuse attacks enable attackers to manipulate the memory and execute their own code on a target system without the need to inject any operating code in the memory space. Jump Oriented Programming is known as a class of this type which has two different kinds of implementation. The main idea is to chain different sequences of instructions terminated to an indirect jump by using controller gadgets called dispatchers or trampolines. This paper focuses on the second type of implementations which uses trampoline gadgets. Finding useful trampolines in different libraries is an issue that considered here. This paper shows useful intended and unintended trampolines available in some famous versions of libraries in Windows and Linux platforms. Additionally, our searching algorithm and a comparison between results of trampolines are presented.

关键词： component code reuse attacks Jump Oriented Programming Trampoline gadget

来源：评论

学校读者我要写书评

暂无评论

A Technique Preventing code reuse attacks Based on RISC Processor

A Technique Preventing Code Reuse Attacks Based on RISC Proc...

引用

2018 International Conference on Computer,Communication and Network Technology(CCNT 2018)

作者： Yang LI Zi-bin DAI Jun-wei LI Zhengzhou Information Science and Technology Institute

A full-process tag inspection system was designed and experimentally verified. This system based on RISC processors can defend code reuse attacks, as well as prevent high overhead caused by the implementation of software fine-grained control flow integrity technology. By extending memory tag, adding special memory-access instructions and setting up security rules, this design achieves hardware-based fine-grained control flow integrity, which can defend against attacks of ROP, JOP and COOP. The experimental measurement have been performed to validate that this design has effective effect on defending CRA with low overhead, which is evaluated on the RISC-V platform.

关键词： code reuse attacks Control flow integrity Instruction extension RISC

来源：评论

学校读者我要写书评

暂无评论

Timely address space rerandomization for resisting code reuse attacks

引用

CONCURRENCY AND COMPUTATION-PRACTICE & EXPERIENCE 2017年第16期29卷 1-14页

作者： Chen, Xiaoquan Xue, Rui Wu, Chuankun Chinese Acad Sci Inst Informat Engn State Key Lab Informat Secur Beijing Peoples R China Univ Chinese Acad Sci Beijing Peoples R China

The major weakness of address space layout randomization is the address space of the program being randomized only once at loading. Therefore, it cannot prevent those advanced code reuse attacks, such as just-in-time return-oriented programming. In view of this situation, we propose an instantaneous and continual address space rerandomization approach, called just-in-time address space rerandomization (JIT-ASR) to thwart the attack. The JIT-ASR uses the virtual memory management and can ceaselessly change the program's address space by modifying the virtual page number of the code address and page table at runtime. In this way, the address space of the program will change continually. This mechanism will make the addresses used by the attacker become stale, and the attack payload cannot be performed successfully. To demonstrate the effectiveness and efficiency of JIT-ASR, we apply it to SPEC CPU2006 benchmark suite. The evaluation results and security analysis show that JIT-ASR can resist the code reuse attacks, especially just-in-time return-oriented programming, and yield low runtime performance overhead (1.2% on average on the SPEC CPU2006 benchmark).

关键词： ASLR code reuse attacks JIT-ASR JIT-ROP

来源：评论

学校读者我要写书评

暂无评论

Tiny Jump-Oriented Programming Attack 12

Tiny Jump-Oriented Programming Attack

引用

12th International ISC Conference on Information Security & Cryptology (ISCISC)

作者： Sadeghi, AliAkbar Aminmansour, Farzanc Shahriari, Hamid Reza Amirkabir Univ Technol Dept Comp Engn & Informat Technol Tehran Iran

ISBN: (纸本)9781467376099

code reuse attacks such as return oriented programming and jump oriented programming become the most popular exploitation methods among attackers. A large number of practical and non-practical defenses have been proposed that differ in their overhead, the source code requirement, detection rate and implementation dependencies. However, a usual aspect among them is to consider the common behavior of code reuse attacks, which is the construction of a gadget chain. Therefore, the implication of a gadget and the minimum size of an attack chain are a matter of controversy. Conservative or relaxed thresholds may cause false positive and false negative alarms respectively. The main contribution of this paper is to provide a tricky aspect of code reuse techniques, called Tiny Jump-oriented Programnting (Tiny-JOP) that demonstrates the ineffectiveness of the threshold based detection methods. We demonstrate the effectiveness of our approach by implementing a sample proof of concept shell-code and exploiting a real-world buffer overflow vulnerability in HT Editor 2.0.20.

关键词： component code reuse attacks Jump Oriented Programming TinyJOP Kernel Trapper Gadget

来源：评论

学校读者我要写书评

暂无评论

DExIE-An IoT-Class Hardware Monitor for Real-Time Fine-Grained Control-Flow Integrity

引用

JOURNAL OF SIGNAL PROCESSING SYSTEMS FOR SIGNAL IMAGE AND VIDEO TECHNOLOGY 2022年第7期94卷 739-752页

作者： Spang, Christoph Lavan, Yannick Hartmann, Marco Meisel, Florian Koch, Andreas Tech Univ Darmstadt Embedded Syst & Applicat Grp Darmstadt Germany

The Dynamic Execution Integrity Engine (DExIE) is a lightweight hardware monitor that can be flexibly attached to many IoT-class processor pipelines. It is guaranteed to catch both inter- and intra-function illegal control flows in time to prevent any illegal instructions from touching memory. The performance impact of attaching DExIE to a core depends on the concrete pipeline structure. In some especially suitable cases, extending a processor with DExIE will have no performance penalty. DExIE is real-time capable, as it causes no or only up to 10.4 % additional and then predictable pipeline stalls. Depending on the monitored processor's size and structure, DExIE is faster than software-based monitoring and often smaller than a separate guard processor. We present not just the hardware architecture, but also the automated programming flow, and discuss compact adaptable storage formats to hold fine-grained control flow information.

关键词： IoT security Runtime-dynamic integrity Fine-grained control flow integrity RISC-V code reuse attacks Real time

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：