The Experts below are selected from a list of 1569 Experts worldwide ranked by ideXlab platform
Yi-min Wang - One of the best experts on this subject based on the ideXlab platform.
-
SRDS - RandSys: Thwarting Code Injection Attacks with System Service Interface Randomization
2007 26th IEEE International Symposium on Reliable Distributed Systems (SRDS 2007), 2007Co-Authors: Xuxian Jiang, Dongyan Xu, Helen J Wang, Yi-min WangAbstract:Code Injection attacks are a top threat to today's Internet. With zero-day attacks on the rise, randomization techniques have been introduced to diversify software and operation systems of networked hosts so that attacks that succeed on one host cannot succeed on others. Two most notable system-wide randomization techniques are instruction set randomization (ISR) and address space layout randomization (ASLR). The former randomizes instruction set for each process, while the latter randomizes the memory address space layout. Both suffer from a number of attacks. In this paper, we advocate and demonstrate that by combining ISR and ASLR effectively, we can offer much more robust protection than each of them individually. However, trivial combination of both schemes is not sufficient. To this end, we make the key observation that system call instructions matter the most to attackers for Code Injection. Our system, RandSys, uses system call instruction randomization and the general technique of ASLR along with a number of new enhancements to thwart Code Injection attacks. We have built a prototype for both Linux and Windows platforms. Our experiments show that RandSys can effectively thwart a wide variety of Code Injection attacks with a small overhead.
-
RandSys: Thwarting Code Injection Attacks with System Service Interface Randomization
2007 26th IEEE International Symposium on Reliable Distributed Systems (SRDS 2007), 2007Co-Authors: Xuxian Jiang, Helen J. Wangz, Dongyan Xu, Yi-min WangAbstract:Code Injection attacks are a top threat to today's Internet. With zero-day attacks on the rise, randomization techniques have been introduced to diversify software and operation systems of networked hosts so that attacks that succeed on one host cannot succeed on others. Two most notable system-wide randomization techniques are instruction set randomization (ISR) and address space layout randomization (ASLR). The former randomizes instruction set for each process, while the latter randomizes the memory address space layout. Both suffer from a number of attacks. In this paper, we advocate and demonstrate that by combining ISR and ASLR effectively, we can offer much more robust protection than each of them individually. However, trivial combination of both schemes is not sufficient. To this end, we make the key observation that system call instructions matter the most to attackers for Code Injection. Our system, RandSys, uses system call instruction randomization and the general technique of ASLR along with a number of new enhancements to thwart Code Injection attacks. We have built a prototype for both Linux and Windows platforms. Our experiments show that RandSys can effectively thwart a wide variety of Code Injection attacks with a small overhead.
Frank Piessens - One of the best experts on this subject based on the ideXlab platform.
-
CPM: Masking Code Pointers to Prevent Code Injection Attacks
ACM Transactions on Information and System Security, 2013Co-Authors: Pieter Philippaerts, Yves Younan, Frank Piessens, Sven Lachmund, Stijn Muylle, Thomas WalterAbstract:Code Pointer Masking (CPM) is a novel countermeasure against Code Injection attacks on native Code. By enforcing the correct semantics of Code pointers, CPM thwarts attacks that modify Code pointers to divert the application’s control flow. It does not rely on secret values such as stack canaries and protects against attacks that are not addressed by state-of-the-art countermeasures of similar performance. This article reports on two prototype implementations on very distinct processor architectures, showing that the idea behind CPM is portable. The evaluation also shows that the overhead of using our countermeasure is very small and the security benefits are substantial.
-
Runtime countermeasures for Code Injection attacks against C and C++ programs
ACM Computing Surveys, 2012Co-Authors: Yves Younan, Wouter Joosen, Frank PiessensAbstract:The lack of memory safety in C/C++ often leads to vulnerabilities. Code Injection attacks exploit these vulnerabilities to gain control over the execution flow of applications. These attacks have played a key role in many major security incidents. Consequently, a huge body of research on countermeasures exists. We provide a comprehensive and structured survey of vulnerabilities and countermeasures that operate at runtime. These countermeasures make different trade-offs in terms of performance, effectivity, compatibility, etc., making it hard to evaluate and compare countermeasures in a given context. We define a classification and evaluation framework on the basis of which countermeasures can be assessed.
-
runtime countermeasures for Code Injection attacks against c and c programs
ACM Computing Surveys, 2012Co-Authors: Yves Younan, Wouter Joosen, Frank PiessensAbstract:The lack of memory safety in C/C++ often leads to vulnerabilities. Code Injection attacks exploit these vulnerabilities to gain control over the execution flow of applications. These attacks have played a key role in many major security incidents. Consequently, a huge body of research on countermeasures exists. We provide a comprehensive and structured survey of vulnerabilities and countermeasures that operate at runtime. These countermeasures make different trade-offs in terms of performance, effectivity, compatibility, etc., making it hard to evaluate and compare countermeasures in a given context. We define a classification and evaluation framework on the basis of which countermeasures can be assessed.
-
Filter-resistant Code Injection on ARM
Journal in Computer Virology, 2011Co-Authors: Yves Younan, Frank Piessens, Pieter Philippaerts, Sven Lachmund, Wouter Joosen, Thomas WalterAbstract:Code Injection attacks are one of the most powerful and important classes of attacks on software. In these attacks, the attacker sends malicious input to a software application, where it is stored in memory. The malicious input is chosen in such a way that its representation in memory is also a valid representation of a machine Code program that performs actions chosen by the attacker. The attacker then triggers a bug in the application to divert the control flow to this injected machine Code. A typical action of the injected Code is to launch a command interpreter shell, and hence the malicious input is often called shellCode . Attacks are usually performed against network facing applications, and such applications often perform validations or encodings on input. Hence, a typical hurdle for attackers, is that the shellCode has to pass one or more filtering methods before it is stored in the vulnerable application’s memory space. Clearly, for a Code Injection attack to succeed, the malicious input must survive such validations and transformations. Alphanumeric input (consisting only of letters and digits) is typically very robust for this purpose: it passes most filters and is untouched by most transformations. This paper studies the power of alphanumeric shellCode on the ARM architecture. It shows that the subset of ARM machine Code programs that (when interpreted as data) consist only of alphanumerical characters is a Turing complete subset. This is a non-trivial result, as the number of instructions that consist only of alphanumeric characters is very limited. To craft useful exploit Code (and to achieve Turing completeness), several tricks are needed, including the use of self-modifying Code.
-
Code pointer masking hardening applications against Code Injection attacks
International Conference on Detection of intrusions and malware and vulnerability assessment, 2011Co-Authors: Pieter Philippaerts, Yves Younan, Frank Piessens, Sven Lachmund, Stijn Muylle, Thomas WalterAbstract:In this paper we present an efficient countermeasure against Code Injection attacks. Our countermeasure does not rely on secret values such as stack canaries and protects against attacks that are not addressed by state-of-the-art countermeasures of similar performance. By enforcing the correct semantics of Code pointers, we thwart attacks that modify Code pointers to divert the application's control flow. We have implemented a prototype of our solution in a C-compiler for Linux. The evaluation shows that the overhead of using our countermeasure is small and the security benefits are substantial.
Niels Provos - One of the best experts on this subject based on the ideXlab platform.
-
shellos enabling fast detection and forensic analysis of Code Injection attacks
USENIX Security Symposium, 2011Co-Authors: Kevin Z Snow, Srinivas Krishnan, Fabian Monrose, Niels ProvosAbstract:The availability of off-the-shelf exploitation toolkits for compromising hosts, coupled with the rapid rate of exploit discovery and disclosure, has made exploit or vulnerability-based detection far less effective than it once was. For instance, the increasing use of metamorphic and polymorphic techniques to deploy Code Injection attacks continues to confound signature-based detection techniques. The key to detecting these attacks lies in the ability to discover the presence of the injected Code (or, shellCode). One promising technique for doing so is to examine data (be that from network streams or buffers of a process) and efficiently execute its content to find what lurks within. Unfortunately, current approaches for achieving this goal are not robust to evasion or scalable, primarily because of their reliance on software-based CPU emulators. In this paper, we argue that the use of software-based emulation techniques are not necessary, and instead propose a new framework that leverages hardware virtualization to better enable the detection of Code Injection attacks. We also report on our experience using this framework to analyze a corpus of malicious Portable Document Format (PDF) files and network-based attacks.
-
USENIX Security Symposium - SHELLOS: enabling fast detection and forensic analysis of Code Injection attacks
2011Co-Authors: Kevin Z Snow, Srinivas Krishnan, Fabian Monrose, Niels ProvosAbstract:The availability of off-the-shelf exploitation toolkits for compromising hosts, coupled with the rapid rate of exploit discovery and disclosure, has made exploit or vulnerability-based detection far less effective than it once was. For instance, the increasing use of metamorphic and polymorphic techniques to deploy Code Injection attacks continues to confound signature-based detection techniques. The key to detecting these attacks lies in the ability to discover the presence of the injected Code (or, shellCode). One promising technique for doing so is to examine data (be that from network streams or buffers of a process) and efficiently execute its content to find what lurks within. Unfortunately, current approaches for achieving this goal are not robust to evasion or scalable, primarily because of their reliance on software-based CPU emulators. In this paper, we argue that the use of software-based emulation techniques are not necessary, and instead propose a new framework that leverages hardware virtualization to better enable the detection of Code Injection attacks. We also report on our experience using this framework to analyze a corpus of malicious Portable Document Format (PDF) files and network-based attacks.
Xuxian Jiang - One of the best experts on this subject based on the ideXlab platform.
-
An Architectural Approach to Preventing Code Injection Attacks
IEEE Transactions on Dependable and Secure Computing, 2010Co-Authors: Ryan Riley, Xuxian Jiang, Dongyan XuAbstract:Code Injection attacks, despite being well researched, continue to be a problem today. Modern architectural solutions such as the execute-disable bit and PaX have been useful in limiting the attacks; however, they enforce program layout restrictions and can oftentimes still be circumvented by a determined attacker. We propose a change to the memory architecture of modern processors that addresses the Code Injection problem at its very root by virtually splitting memory into Code memory and data memory such that a processor will never be able to fetch injected Code for execution. This virtual split memory system can be implemented as a software-only patch to an operating system and can be used to supplement existing schemes for improved protection. Furthermore, our system is able to accommodate a number of response modes when a Code Injection attack occurs. Our experiments with both benchmarks and real-world attacks show the system is effective in preventing a wide range of Code Injection attacks while incurring reasonable overhead.
-
SRDS - RandSys: Thwarting Code Injection Attacks with System Service Interface Randomization
2007 26th IEEE International Symposium on Reliable Distributed Systems (SRDS 2007), 2007Co-Authors: Xuxian Jiang, Dongyan Xu, Helen J Wang, Yi-min WangAbstract:Code Injection attacks are a top threat to today's Internet. With zero-day attacks on the rise, randomization techniques have been introduced to diversify software and operation systems of networked hosts so that attacks that succeed on one host cannot succeed on others. Two most notable system-wide randomization techniques are instruction set randomization (ISR) and address space layout randomization (ASLR). The former randomizes instruction set for each process, while the latter randomizes the memory address space layout. Both suffer from a number of attacks. In this paper, we advocate and demonstrate that by combining ISR and ASLR effectively, we can offer much more robust protection than each of them individually. However, trivial combination of both schemes is not sufficient. To this end, we make the key observation that system call instructions matter the most to attackers for Code Injection. Our system, RandSys, uses system call instruction randomization and the general technique of ASLR along with a number of new enhancements to thwart Code Injection attacks. We have built a prototype for both Linux and Windows platforms. Our experiments show that RandSys can effectively thwart a wide variety of Code Injection attacks with a small overhead.
-
an architectural approach to preventing Code Injection attacks
Dependable Systems and Networks, 2007Co-Authors: Ryan Riley, Xuxian JiangAbstract:Code Injection attacks, despite being well researched, continue to be a problem today. Modern architectural solutions such as the NX-bit and PaX have been useful in limiting the attacks, however they enforce program layout restrictions and can often times still be circumvented by a determined attacker. We propose a change to the memory architecture of modern processors that addresses the Code Injection problem at its very root by virtually splitting memory into Code memory and data memory such that a processor will never be able to fetch injected Code for execution. This virtual split memory system can be implemented as a software only patch to an operating system, and can be used to supplement existing schemes for improved protection. Our experimental results show the system is effective in preventing a wide range of Code Injection attacks while incurring acceptable overhead.
-
DSN - An Architectural Approach to Preventing Code Injection Attacks
37th Annual IEEE IFIP International Conference on Dependable Systems and Networks (DSN'07), 2007Co-Authors: Ryan Riley, Xuxian Jiang, Dongyan XuAbstract:Code Injection attacks, despite being well researched, continue to be a problem today. Modern architectural solutions such as the NX-bit and PaX have been useful in limiting the attacks, however they enforce program layout restrictions and can often times still be circumvented by a determined attacker. We propose a change to the memory architecture of modern processors that addresses the Code Injection problem at its very root by virtually splitting memory into Code memory and data memory such that a processor will never be able to fetch injected Code for execution. This virtual split memory system can be implemented as a software only patch to an operating system, and can be used to supplement existing schemes for improved protection. Our experimental results show the system is effective in preventing a wide range of Code Injection attacks while incurring acceptable overhead.
-
RandSys: Thwarting Code Injection Attacks with System Service Interface Randomization
2007 26th IEEE International Symposium on Reliable Distributed Systems (SRDS 2007), 2007Co-Authors: Xuxian Jiang, Helen J. Wangz, Dongyan Xu, Yi-min WangAbstract:Code Injection attacks are a top threat to today's Internet. With zero-day attacks on the rise, randomization techniques have been introduced to diversify software and operation systems of networked hosts so that attacks that succeed on one host cannot succeed on others. Two most notable system-wide randomization techniques are instruction set randomization (ISR) and address space layout randomization (ASLR). The former randomizes instruction set for each process, while the latter randomizes the memory address space layout. Both suffer from a number of attacks. In this paper, we advocate and demonstrate that by combining ISR and ASLR effectively, we can offer much more robust protection than each of them individually. However, trivial combination of both schemes is not sufficient. To this end, we make the key observation that system call instructions matter the most to attackers for Code Injection. Our system, RandSys, uses system call instruction randomization and the general technique of ASLR along with a number of new enhancements to thwart Code Injection attacks. We have built a prototype for both Linux and Windows platforms. Our experiments show that RandSys can effectively thwart a wide variety of Code Injection attacks with a small overhead.
Yves Younan - One of the best experts on this subject based on the ideXlab platform.
-
CPM: Masking Code Pointers to Prevent Code Injection Attacks
ACM Transactions on Information and System Security, 2013Co-Authors: Pieter Philippaerts, Yves Younan, Frank Piessens, Sven Lachmund, Stijn Muylle, Thomas WalterAbstract:Code Pointer Masking (CPM) is a novel countermeasure against Code Injection attacks on native Code. By enforcing the correct semantics of Code pointers, CPM thwarts attacks that modify Code pointers to divert the application’s control flow. It does not rely on secret values such as stack canaries and protects against attacks that are not addressed by state-of-the-art countermeasures of similar performance. This article reports on two prototype implementations on very distinct processor architectures, showing that the idea behind CPM is portable. The evaluation also shows that the overhead of using our countermeasure is very small and the security benefits are substantial.
-
Runtime countermeasures for Code Injection attacks against C and C++ programs
ACM Computing Surveys, 2012Co-Authors: Yves Younan, Wouter Joosen, Frank PiessensAbstract:The lack of memory safety in C/C++ often leads to vulnerabilities. Code Injection attacks exploit these vulnerabilities to gain control over the execution flow of applications. These attacks have played a key role in many major security incidents. Consequently, a huge body of research on countermeasures exists. We provide a comprehensive and structured survey of vulnerabilities and countermeasures that operate at runtime. These countermeasures make different trade-offs in terms of performance, effectivity, compatibility, etc., making it hard to evaluate and compare countermeasures in a given context. We define a classification and evaluation framework on the basis of which countermeasures can be assessed.
-
runtime countermeasures for Code Injection attacks against c and c programs
ACM Computing Surveys, 2012Co-Authors: Yves Younan, Wouter Joosen, Frank PiessensAbstract:The lack of memory safety in C/C++ often leads to vulnerabilities. Code Injection attacks exploit these vulnerabilities to gain control over the execution flow of applications. These attacks have played a key role in many major security incidents. Consequently, a huge body of research on countermeasures exists. We provide a comprehensive and structured survey of vulnerabilities and countermeasures that operate at runtime. These countermeasures make different trade-offs in terms of performance, effectivity, compatibility, etc., making it hard to evaluate and compare countermeasures in a given context. We define a classification and evaluation framework on the basis of which countermeasures can be assessed.
-
Filter-resistant Code Injection on ARM
Journal in Computer Virology, 2011Co-Authors: Yves Younan, Frank Piessens, Pieter Philippaerts, Sven Lachmund, Wouter Joosen, Thomas WalterAbstract:Code Injection attacks are one of the most powerful and important classes of attacks on software. In these attacks, the attacker sends malicious input to a software application, where it is stored in memory. The malicious input is chosen in such a way that its representation in memory is also a valid representation of a machine Code program that performs actions chosen by the attacker. The attacker then triggers a bug in the application to divert the control flow to this injected machine Code. A typical action of the injected Code is to launch a command interpreter shell, and hence the malicious input is often called shellCode . Attacks are usually performed against network facing applications, and such applications often perform validations or encodings on input. Hence, a typical hurdle for attackers, is that the shellCode has to pass one or more filtering methods before it is stored in the vulnerable application’s memory space. Clearly, for a Code Injection attack to succeed, the malicious input must survive such validations and transformations. Alphanumeric input (consisting only of letters and digits) is typically very robust for this purpose: it passes most filters and is untouched by most transformations. This paper studies the power of alphanumeric shellCode on the ARM architecture. It shows that the subset of ARM machine Code programs that (when interpreted as data) consist only of alphanumerical characters is a Turing complete subset. This is a non-trivial result, as the number of instructions that consist only of alphanumeric characters is very limited. To craft useful exploit Code (and to achieve Turing completeness), several tricks are needed, including the use of self-modifying Code.
-
Code pointer masking hardening applications against Code Injection attacks
International Conference on Detection of intrusions and malware and vulnerability assessment, 2011Co-Authors: Pieter Philippaerts, Yves Younan, Frank Piessens, Sven Lachmund, Stijn Muylle, Thomas WalterAbstract:In this paper we present an efficient countermeasure against Code Injection attacks. Our countermeasure does not rely on secret values such as stack canaries and protects against attacks that are not addressed by state-of-the-art countermeasures of similar performance. By enforcing the correct semantics of Code pointers, we thwart attacks that modify Code pointers to divert the application's control flow. We have implemented a prototype of our solution in a C-compiler for Linux. The evaluation shows that the overhead of using our countermeasure is small and the security benefits are substantial.