The Experts below are selected from a list of 813 Experts worldwide ranked by ideXlab platform

Birch Miriam - One of the best experts on this subject based on the ideXlab platform.

  • Control-Flow Integrity: Attacks and Protections
    'MDPI AG', 2019
    Co-Authors: Sayeed Sarwar, Marco-gisbert Hector, Ripoll Ismael, Birch Miriam
    Abstract:

    Despite the intense efforts to prevent programmers from writing code with memory errors, memory corruption vulnerabilities are still a major security threat. Consequently, control-flow integrity has received significant attention in the research community, and software developers to combat control code execution attacks in the presence of type of faults. Control-flow Integrity (CFI) is a large family of techniques that aims to eradicate memory error exploitation by ensuring that the Instruction Pointer (IP) of a running process cannot be controlled by a malicious attacker. In this paper, we assess the effectiveness of 14 CFI techniques against the most popular exploitation techniques, including code reuse attacks, return-to-user, return-to-libc, and replay attacks. We also classify these techniques based on their security, robustness, and implementation complexity. Our study indicates that the majority of the CFI techniques are primarily focused on restricting indirect branch Instructions and cannot prevent all forms of vulnerability exploitation. We conclude that the performance overhead introduced, jointly with the partial attack coverage, is discouraging the industry from adopting most of them

  • Control-Flow Integrity: Attacks and Protections
    'MDPI AG', 2019
    Co-Authors: Sayeed Sarwar, Marco-gisbert Hector, Ripoll-ripoll Ismael, Birch Miriam
    Abstract:

    [EN] Despite the intense efforts to prevent programmers from writing code with memory errors, memory corruption vulnerabilities are still a major security threat. Consequently, control-flow integrity has received significant attention in the research community, and software developers to combat control code execution attacks in the presence of type of faults. Control-flow Integrity (CFI) is a large family of techniques that aims to eradicate memory error exploitation by ensuring that the Instruction Pointer (IP) of a running process cannot be controlled by a malicious attacker. In this paper, we assess the effectiveness of 14 CFI techniques against the most popular exploitation techniques, including code reuse attacks, return-to-user, return-to-libc, and replay attacks. We also classify these techniques based on their security, robustness, and implementation complexity. Our study indicates that the majority of the CFI techniques are primarily focused on restricting indirect branch Instructions and cannot prevent all forms of vulnerability exploitation. We conclude that the performance overhead introduced, jointly with the partial attack coverage, is discouraging the industry from adopting most of them.Sayeed, S.; Marco-Gisbert, H.; Ripoll-Ripoll, I.; Birch, M. (2019). Control-Flow Integrity: Attacks and Protections. Applied Sciences. 9(20):1-22. https://doi.org/10.3390/app9204229S122920Kim, Y., Daly, R., Kim, J., Fallin, C., Lee, J. H., Lee, D., … Mutlu, O. (2014). Flipping bits in memory without accessing them: An experimental study of DRAM disturbance errors. 2014 ACM/IEEE 41st International Symposium on Computer Architecture (ISCA). doi:10.1109/isca.2014.6853210Buchanan, E., Roemer, R., Shacham, H., & Savage, S. (2008). When good Instructions go bad. Proceedings of the 15th ACM conference on Computer and communications security - CCS ’08. doi:10.1145/1455770.1455776Checkoway, S., Davi, L., Dmitrienko, A., Sadeghi, A.-R., Shacham, H., & Winandy, M. (2010). Return-oriented programming without returns. Proceedings of the 17th ACM conference on Computer and communications security - CCS ’10. doi:10.1145/1866307.1866370Bletsch, T., Jiang, X., Freeh, V. W., & Liang, Z. (2011). Jump-oriented programming. Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security - ASIACCS ’11. doi:10.1145/1966913.1966919Bosman, E., & Bos, H. (2014). Framing Signals - A Return to Portable Shellcode. 2014 IEEE Symposium on Security and Privacy. doi:10.1109/sp.2014.23GCC Extension for Protecting Applications from Stack-Smashing Attacks (ProPolice) http://www.trl.ibm.com/projects/security/ssp/Address Space Layout Randomization http://pax.grsecurity.net/docs/aslr.txtLu, K., Song, C., Lee, B., Chung, S. P., Kim, T., & Lee, W. (2015). ASLR-Guard. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS ’15. doi:10.1145/2810103.2813694New Security Enhancementsin Red Hat Enterprise Linux http://www.redhat.com/f/pdf/rhel/WHP0006US_Execshield.pdfWehbe, T., Mooney, V., & Keezer, D. (2018). Hardware-Based Run-Time Code Integrity in Embedded Devices. Cryptography, 2(3), 20. doi:10.3390/cryptography2030020Nanda, S., Li, W., Lam, L., & Chiueh, T. (2006). Foreign Code Detection on the Windows/X86 Platform. 2006 22nd Annual Computer Security Applications Conference (ACSAC’06). doi:10.1109/acsac.2006.29CWE Category http://cwe.mitre.org/Stack-Based Buffer Overflow Attacks: What You Need to Know https://blog.rapid7.com/2019/02/19/stack-based-buffer-overflow-attacks-what-you-need-to-know/Novark, G., & Berger, E. D. (2010). DieHarder. Proceedings of the 17th ACM conference on Computer and communications security - CCS ’10. doi:10.1145/1866307.1866371Dietz, W., Li, P., Regehr, J., & Adve, V. (2015). Understanding Integer Overflow in C/C++. ACM Transactions on Software Engineering and Methodology, 25(1), 1-29. doi:10.1145/2743019Dowson, M. (1997). The Ariane 5 software failure. ACM SIGSOFT Software Engineering Notes, 22(2), 84. doi:10.1145/251880.251992An Introduction to Use After Free Vulnerabilities https://www.purehacking.com/blog/lloyd-simon/an-introduction-to-use-after-free-vulnerabilitiesNull Dereference https://www.owasp.org/index.php/Null_DereferenceCode Injection https://www.owasp.org/index.php/Code_InjectionPerforming a Ret2libc Attack https://www.shellblade.net/docs/ret2libc.pdfRoglia, G. F., Martignoni, L., Paleari, R., & Bruschi, D. (2009). Surgically Returning to Randomized lib(c). 2009 Annual Computer Security Applications Conference. doi:10.1109/acsac.2009.16Guan, L., Lin, J., Luo, B., Jing, J., & Wang, J. (2015). Protecting Private Keys against Memory Disclosure Attacks Using Hardware Transactional Memory. 2015 IEEE Symposium on Security and Privacy. doi:10.1109/sp.2015.8Defending against Return-Oriented Programming https://www.cs.columbia.edu/~angelos/Papers/theses/vpappas_thesis.pdfNiu, B., & Tan, G. (2015). Per-Input Control-Flow Integrity. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS ’15. doi:10.1145/2810103.2813644Mashtizadeh, A. J., Bittau, A., Boneh, D., & Mazières, D. (2015). CCFI. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS ’15. doi:10.1145/2810103.2813676Muench, M., Pagani, F., Shoshitaishvili, Y., Kruegel, C., Vigna, G., & Balzarotti, D. (2016). Taming Transactions: Towards Hardware-Assisted Control Flow Integrity Using Transactional Memory. Lecture Notes in Computer Science, 24-48. doi:10.1007/978-3-319-45719-2_2How Does RAP Works https://grsecurity.net/rap_faq.phpAbadi, M., Budiu, M., Erlingsson, Ú., & Ligatti, J. (2005). Control-flow integrity. Proceedings of the 12th ACM conference on Computer and communications security - CCS ’05. doi:10.1145/1102120.1102165Abadi, M., Budiu, M., Erlingsson, Ú., & Ligatti, J. (2009). Control-flow integrity principles, implementations, and applications. ACM Transactions on Information and System Security, 13(1), 1-40. doi:10.1145/1609956.1609960Hawkins, B., Demsky, B., & Taylor, M. B. (2016). BlackBox: lightweight security monitoring for COTS binaries. Proceedings of the 2016 International Symposium on Code Generation and Optimization - CGO 2016. doi:10.1145/2854038.2854062Zhang, J., Hou, R., Fan, J., Liu, K., Zhang, L., & McKee, S. A. (2017). RAGuard. Proceedings of the Computing Frontiers Conference on ZZZ - CF’17. doi:10.1145/3075564.3075570Burow, N., Carr, S. A., Nash, J., Larsen, P., Franz, M., Brunthaler, S., & Payer, M. (2017). Control-Flow Integrity. ACM Computing Surveys, 50(1), 1-33. doi:10.1145/3054924Hu, H., Qian, C., Yagemann, C., Chung, S. P. H., Harris, W. R., Kim, T., & Lee, W. (2018). Enforcing Unique Code Target Property for Control-Flow Integrity. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security. doi:10.1145/3243734.3243797Chao Zhang, Tao Wei, Zhaofeng Chen, Lei Duan, Szekeres, L., McCamant, S., … Wei Zou. (2013). Practical Control Flow Integrity and Randomization for Binary Executables. 2013 IEEE Symposium on Security and Privacy. doi:10.1109/sp.2013.44Qiu, P., Lyu, Y., Zhang, J., Wang, D., & Qu, G. (2018). Control Flow Integrity Based on Lightweight Encryption Architecture. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 37(7), 1358-1369. doi:10.1109/tcad.2017.2748000Criswell, J., Dautenhahn, N., & Adve, V. (2014). KCoFI: Complete Control-Flow Integrity for Commodity Operating System Kernels. 2014 IEEE Symposium on Security and Privacy. doi:10.1109/sp.2014.26Evans, I., Long, F., Otgonbaatar, U., Shrobe, H., Rinard, M., Okhravi, H., & Sidiroglou-Douskos, S. (2015). Control Jujutsu. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS ’15. doi:10.1145/2810103.2813646Control Flow Guard https://courses.cs.washington.edu/courses/cse484/14au/reading/25-years-vulnerabilities.pdfLi, J., Tong, X., Zhang, F., & Ma, J. (2018). Fine-CFI: Fine-Grained Control-Flow Integrity for Operating System Kernels. IEEE Transactions on Information Forensics and Security, 13(6), 1535-1550. doi:10.1109/tifs.2018.2797932Introduction to Intel® Memory Protection Extensions https://software.intel.com/en-us/articles/introduction-to-intel-memory-protection-extensionsVan der Veen, V., Andriesse, D., Göktaş, E., Gras, B., Sambuc, L., Slowinska, A., … Giuffrida, C. (2015). Practical Context-Sensitive CFI. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS ’15. doi:10.1145/2810103.2813673Biondo, A., Conti, M., & Lain, D. (2018). Back To The Epilogue: Evading Control Flow Guard via Unaligned Targets. Proceedings 2018 Network and Distributed System Security Symposium. doi:10.14722/ndss.2018.23318Van der Veen, V., Andriesse, D., Stamatogiannakis, M., Chen, X., Bos, H., & Giuffrdia, C. (2017). The Dynamics of Innocent Flesh on the Bone. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. doi:10.1145/3133956.3134026Zhang, J., Qi, B., Qin, Z., & Qu, G. (2019). HCIC: Hardware-Assisted Control-Flow Integrity Checking. IEEE Internet of Things Journal, 6(1), 458-471. doi:10.1109/jiot.2018.2866164Wang, X., Huang, F., & Chen, H. (2019). DTrace: fine-grained and efficient data integrity checking with hardware Instruction tracing. Cybersecurity, 2(1). doi:10.1186/s42400-018-0018-3Christoulakis, N., Christou, G., Athanasopoulos, E., & Ioannidis, S. (2016). HCFI. Proceedings of the Sixth ACM on Conference on Data and Application Security and Privacy - CODASPY ’16. doi:10.1145/2857705.2857722Windows 10 Control Flow Guard Internals http://www.powerofcommunity.net/poc2014/mj0011.pdfCrane, S. J., Franz, M., Volckaert, S., Schuster, F., Liebchen, C., Larsen, P., … De Sutter, B. (2015). It’s a TRaP. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS ’15. doi:10.1145/2810103.2813682Zhang, M., Qiao, R., Hasabnis, N., & Sekar, R. (2014). A platform for secure static binary instrumentation. ACM SIGPLAN Notices, 49(7), 129-140. doi:10.1145/2674025.2576208Dang, T. H. Y., Maniatis, P., & Wagner, D. (2015). The Performance Cost of Shadow Stacks and Stack Canaries. Proceedings of the 10th ACM Symposium on Information, Computer and Communications Security - ASIA CCS ’15. doi:10.1145/2714576.271463

Aravind Prakash - One of the best experts on this subject based on the ideXlab platform.

  • Binary program integrity models for defeating code-reuse attacks
    2015
    Co-Authors: Aravind Prakash
    Abstract:

    During a cyber-attack, an adversary executes offensive maneuvers to target computer systems. Particularly, an attacker often exploits a vulnerability within a program, hijacks control-flow, and executes malicious code. Data Execution Prevention (DEP), a hardware-enforced security feature, prevents an attacker from directly executing the injected malicious code. Therefore, attackers have resorted to code-reuse attacks, wherein carefully chosen fragments of code within existing code sections of a program are sequentially executed to accomplish malicious logic. Code-reuse attacks are ubiquitous and account for majority of the attacks in the wild. On one hand, due to the wide use of closed-source software, binary-level solutions are essential. On the other hand, without access to source-code and debug-information, defending raw binaries is hard. A majority of defenses against code-reuse attacks enforce ”control-flow integrity”, a program property that requires the runtime execution of a program to adhere to a statically determined control-flow graph (CFG) – a graph that captures the intended flow of control within the program. While defenses against code-reuse attacks have focused on reducing the attack space, due to the lack of high-level semantics in the binary, they lack in precision, which in turn results in smaller yet significant attack space. This dissertation presents program integrity models aimed at narrowing the attack space available to execute code-reuse attacks. First, we take a semantic-recovery approach to restrict the targets of indirect branches in a binary. Then, we further improve the precision by recovering C++-level semantics, and enforce a strict integrity model that improves precision for virtual function calls in the binary. Finally, in order to further reduce the attack space, we take a different perspective on defense against code-reuse attacks, and introduce Stack-Pointer Integrity – a novel integrity model targeted at ensuring the integrity of stack Pointer as opposed to the Instruction Pointer. Our results show that the semantic-recovery-based approaches can help in significantly reducing the attack space by improving the precision of the underlying CFG. Function-level semantic recovery can eliminate 99.47% of inaccurate targets, whereas recovering virtual callsites and VTables at a C++ level can eliminate 99.99% of inaccurate targets. BINARY PROGRAM INTEGRITY MODELS FOR DEFEATING CODE-REUSE ATTACKS by Aravind Prakash B.E. Visvesvaraya Technological University, Belgaum, India, 2004 M.S. University of Miami, FL, 2009 Dissertation Submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Electrical & Computer Engineering Syracuse University May 2015 c © Copyright 2015 Aravind Prakash All Rights Reserved

Sayeed Sarwar - One of the best experts on this subject based on the ideXlab platform.

  • Control-Flow Integrity: Attacks and Protections
    'MDPI AG', 2019
    Co-Authors: Sayeed Sarwar, Marco-gisbert Hector, Ripoll Ismael, Birch Miriam
    Abstract:

    Despite the intense efforts to prevent programmers from writing code with memory errors, memory corruption vulnerabilities are still a major security threat. Consequently, control-flow integrity has received significant attention in the research community, and software developers to combat control code execution attacks in the presence of type of faults. Control-flow Integrity (CFI) is a large family of techniques that aims to eradicate memory error exploitation by ensuring that the Instruction Pointer (IP) of a running process cannot be controlled by a malicious attacker. In this paper, we assess the effectiveness of 14 CFI techniques against the most popular exploitation techniques, including code reuse attacks, return-to-user, return-to-libc, and replay attacks. We also classify these techniques based on their security, robustness, and implementation complexity. Our study indicates that the majority of the CFI techniques are primarily focused on restricting indirect branch Instructions and cannot prevent all forms of vulnerability exploitation. We conclude that the performance overhead introduced, jointly with the partial attack coverage, is discouraging the industry from adopting most of them

  • Control-Flow Integrity: Attacks and Protections
    'MDPI AG', 2019
    Co-Authors: Sayeed Sarwar, Marco-gisbert Hector, Ripoll-ripoll Ismael, Birch Miriam
    Abstract:

    [EN] Despite the intense efforts to prevent programmers from writing code with memory errors, memory corruption vulnerabilities are still a major security threat. Consequently, control-flow integrity has received significant attention in the research community, and software developers to combat control code execution attacks in the presence of type of faults. Control-flow Integrity (CFI) is a large family of techniques that aims to eradicate memory error exploitation by ensuring that the Instruction Pointer (IP) of a running process cannot be controlled by a malicious attacker. In this paper, we assess the effectiveness of 14 CFI techniques against the most popular exploitation techniques, including code reuse attacks, return-to-user, return-to-libc, and replay attacks. We also classify these techniques based on their security, robustness, and implementation complexity. Our study indicates that the majority of the CFI techniques are primarily focused on restricting indirect branch Instructions and cannot prevent all forms of vulnerability exploitation. We conclude that the performance overhead introduced, jointly with the partial attack coverage, is discouraging the industry from adopting most of them.Sayeed, S.; Marco-Gisbert, H.; Ripoll-Ripoll, I.; Birch, M. (2019). Control-Flow Integrity: Attacks and Protections. Applied Sciences. 9(20):1-22. https://doi.org/10.3390/app9204229S122920Kim, Y., Daly, R., Kim, J., Fallin, C., Lee, J. H., Lee, D., … Mutlu, O. (2014). Flipping bits in memory without accessing them: An experimental study of DRAM disturbance errors. 2014 ACM/IEEE 41st International Symposium on Computer Architecture (ISCA). doi:10.1109/isca.2014.6853210Buchanan, E., Roemer, R., Shacham, H., & Savage, S. (2008). When good Instructions go bad. Proceedings of the 15th ACM conference on Computer and communications security - CCS ’08. doi:10.1145/1455770.1455776Checkoway, S., Davi, L., Dmitrienko, A., Sadeghi, A.-R., Shacham, H., & Winandy, M. (2010). Return-oriented programming without returns. Proceedings of the 17th ACM conference on Computer and communications security - CCS ’10. doi:10.1145/1866307.1866370Bletsch, T., Jiang, X., Freeh, V. W., & Liang, Z. (2011). Jump-oriented programming. Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security - ASIACCS ’11. doi:10.1145/1966913.1966919Bosman, E., & Bos, H. (2014). Framing Signals - A Return to Portable Shellcode. 2014 IEEE Symposium on Security and Privacy. doi:10.1109/sp.2014.23GCC Extension for Protecting Applications from Stack-Smashing Attacks (ProPolice) http://www.trl.ibm.com/projects/security/ssp/Address Space Layout Randomization http://pax.grsecurity.net/docs/aslr.txtLu, K., Song, C., Lee, B., Chung, S. P., Kim, T., & Lee, W. (2015). ASLR-Guard. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS ’15. doi:10.1145/2810103.2813694New Security Enhancementsin Red Hat Enterprise Linux http://www.redhat.com/f/pdf/rhel/WHP0006US_Execshield.pdfWehbe, T., Mooney, V., & Keezer, D. (2018). Hardware-Based Run-Time Code Integrity in Embedded Devices. Cryptography, 2(3), 20. doi:10.3390/cryptography2030020Nanda, S., Li, W., Lam, L., & Chiueh, T. (2006). Foreign Code Detection on the Windows/X86 Platform. 2006 22nd Annual Computer Security Applications Conference (ACSAC’06). doi:10.1109/acsac.2006.29CWE Category http://cwe.mitre.org/Stack-Based Buffer Overflow Attacks: What You Need to Know https://blog.rapid7.com/2019/02/19/stack-based-buffer-overflow-attacks-what-you-need-to-know/Novark, G., & Berger, E. D. (2010). DieHarder. Proceedings of the 17th ACM conference on Computer and communications security - CCS ’10. doi:10.1145/1866307.1866371Dietz, W., Li, P., Regehr, J., & Adve, V. (2015). Understanding Integer Overflow in C/C++. ACM Transactions on Software Engineering and Methodology, 25(1), 1-29. doi:10.1145/2743019Dowson, M. (1997). The Ariane 5 software failure. ACM SIGSOFT Software Engineering Notes, 22(2), 84. doi:10.1145/251880.251992An Introduction to Use After Free Vulnerabilities https://www.purehacking.com/blog/lloyd-simon/an-introduction-to-use-after-free-vulnerabilitiesNull Dereference https://www.owasp.org/index.php/Null_DereferenceCode Injection https://www.owasp.org/index.php/Code_InjectionPerforming a Ret2libc Attack https://www.shellblade.net/docs/ret2libc.pdfRoglia, G. F., Martignoni, L., Paleari, R., & Bruschi, D. (2009). Surgically Returning to Randomized lib(c). 2009 Annual Computer Security Applications Conference. doi:10.1109/acsac.2009.16Guan, L., Lin, J., Luo, B., Jing, J., & Wang, J. (2015). Protecting Private Keys against Memory Disclosure Attacks Using Hardware Transactional Memory. 2015 IEEE Symposium on Security and Privacy. doi:10.1109/sp.2015.8Defending against Return-Oriented Programming https://www.cs.columbia.edu/~angelos/Papers/theses/vpappas_thesis.pdfNiu, B., & Tan, G. (2015). Per-Input Control-Flow Integrity. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS ’15. doi:10.1145/2810103.2813644Mashtizadeh, A. J., Bittau, A., Boneh, D., & Mazières, D. (2015). CCFI. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS ’15. doi:10.1145/2810103.2813676Muench, M., Pagani, F., Shoshitaishvili, Y., Kruegel, C., Vigna, G., & Balzarotti, D. (2016). Taming Transactions: Towards Hardware-Assisted Control Flow Integrity Using Transactional Memory. Lecture Notes in Computer Science, 24-48. doi:10.1007/978-3-319-45719-2_2How Does RAP Works https://grsecurity.net/rap_faq.phpAbadi, M., Budiu, M., Erlingsson, Ú., & Ligatti, J. (2005). Control-flow integrity. Proceedings of the 12th ACM conference on Computer and communications security - CCS ’05. doi:10.1145/1102120.1102165Abadi, M., Budiu, M., Erlingsson, Ú., & Ligatti, J. (2009). Control-flow integrity principles, implementations, and applications. ACM Transactions on Information and System Security, 13(1), 1-40. doi:10.1145/1609956.1609960Hawkins, B., Demsky, B., & Taylor, M. B. (2016). BlackBox: lightweight security monitoring for COTS binaries. Proceedings of the 2016 International Symposium on Code Generation and Optimization - CGO 2016. doi:10.1145/2854038.2854062Zhang, J., Hou, R., Fan, J., Liu, K., Zhang, L., & McKee, S. A. (2017). RAGuard. Proceedings of the Computing Frontiers Conference on ZZZ - CF’17. doi:10.1145/3075564.3075570Burow, N., Carr, S. A., Nash, J., Larsen, P., Franz, M., Brunthaler, S., & Payer, M. (2017). Control-Flow Integrity. ACM Computing Surveys, 50(1), 1-33. doi:10.1145/3054924Hu, H., Qian, C., Yagemann, C., Chung, S. P. H., Harris, W. R., Kim, T., & Lee, W. (2018). Enforcing Unique Code Target Property for Control-Flow Integrity. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security. doi:10.1145/3243734.3243797Chao Zhang, Tao Wei, Zhaofeng Chen, Lei Duan, Szekeres, L., McCamant, S., … Wei Zou. (2013). Practical Control Flow Integrity and Randomization for Binary Executables. 2013 IEEE Symposium on Security and Privacy. doi:10.1109/sp.2013.44Qiu, P., Lyu, Y., Zhang, J., Wang, D., & Qu, G. (2018). Control Flow Integrity Based on Lightweight Encryption Architecture. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 37(7), 1358-1369. doi:10.1109/tcad.2017.2748000Criswell, J., Dautenhahn, N., & Adve, V. (2014). KCoFI: Complete Control-Flow Integrity for Commodity Operating System Kernels. 2014 IEEE Symposium on Security and Privacy. doi:10.1109/sp.2014.26Evans, I., Long, F., Otgonbaatar, U., Shrobe, H., Rinard, M., Okhravi, H., & Sidiroglou-Douskos, S. (2015). Control Jujutsu. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS ’15. doi:10.1145/2810103.2813646Control Flow Guard https://courses.cs.washington.edu/courses/cse484/14au/reading/25-years-vulnerabilities.pdfLi, J., Tong, X., Zhang, F., & Ma, J. (2018). Fine-CFI: Fine-Grained Control-Flow Integrity for Operating System Kernels. IEEE Transactions on Information Forensics and Security, 13(6), 1535-1550. doi:10.1109/tifs.2018.2797932Introduction to Intel® Memory Protection Extensions https://software.intel.com/en-us/articles/introduction-to-intel-memory-protection-extensionsVan der Veen, V., Andriesse, D., Göktaş, E., Gras, B., Sambuc, L., Slowinska, A., … Giuffrida, C. (2015). Practical Context-Sensitive CFI. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS ’15. doi:10.1145/2810103.2813673Biondo, A., Conti, M., & Lain, D. (2018). Back To The Epilogue: Evading Control Flow Guard via Unaligned Targets. Proceedings 2018 Network and Distributed System Security Symposium. doi:10.14722/ndss.2018.23318Van der Veen, V., Andriesse, D., Stamatogiannakis, M., Chen, X., Bos, H., & Giuffrdia, C. (2017). The Dynamics of Innocent Flesh on the Bone. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. doi:10.1145/3133956.3134026Zhang, J., Qi, B., Qin, Z., & Qu, G. (2019). HCIC: Hardware-Assisted Control-Flow Integrity Checking. IEEE Internet of Things Journal, 6(1), 458-471. doi:10.1109/jiot.2018.2866164Wang, X., Huang, F., & Chen, H. (2019). DTrace: fine-grained and efficient data integrity checking with hardware Instruction tracing. Cybersecurity, 2(1). doi:10.1186/s42400-018-0018-3Christoulakis, N., Christou, G., Athanasopoulos, E., & Ioannidis, S. (2016). HCFI. Proceedings of the Sixth ACM on Conference on Data and Application Security and Privacy - CODASPY ’16. doi:10.1145/2857705.2857722Windows 10 Control Flow Guard Internals http://www.powerofcommunity.net/poc2014/mj0011.pdfCrane, S. J., Franz, M., Volckaert, S., Schuster, F., Liebchen, C., Larsen, P., … De Sutter, B. (2015). It’s a TRaP. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS ’15. doi:10.1145/2810103.2813682Zhang, M., Qiao, R., Hasabnis, N., & Sekar, R. (2014). A platform for secure static binary instrumentation. ACM SIGPLAN Notices, 49(7), 129-140. doi:10.1145/2674025.2576208Dang, T. H. Y., Maniatis, P., & Wagner, D. (2015). The Performance Cost of Shadow Stacks and Stack Canaries. Proceedings of the 10th ACM Symposium on Information, Computer and Communications Security - ASIA CCS ’15. doi:10.1145/2714576.271463

Prakash Aravind - One of the best experts on this subject based on the ideXlab platform.

  • Binary Program Integrity Models for Defeating Code-Reuse Attacks
    'Surface Analysis Society of Japan', 2015
    Co-Authors: Prakash Aravind
    Abstract:

    During a cyber-attack, an adversary executes offensive maneuvers to target computer systems. Particularly, an attacker often exploits a vulnerability within a program, hijacks control-flow, and executes malicious code. Data Execution Prevention (DEP), a hardware-enforced security feature, prevents an attacker from directly executing the injected malicious code. Therefore, attackers have resorted to code-reuse attacks, wherein carefully chosen fragments of code within existing code sections of a program are sequentially executed to accomplish malicious logic. Code-reuse attacks are ubiquitous and account for majority of the attacks in the wild. On one hand, due to the wide use of closed-source software, binary-level solutions are essential. On the other hand, without access to source-code and debug-information, defending raw binaries is hard. A majority of defenses against code-reuse attacks enforce control-flow integrity , a program property that requires the runtime execution of a program to adhere to a statically determined control-flow graph (CFG) -- a graph that captures the intended flow of control within the program. While defenses against code-reuse attacks have focused on reducing the attack space, due to the lack of high-level semantics in the binary, they lack in precision, which in turn results in smaller yet significant attack space. This dissertation presents program integrity models aimed at narrowing the attack space available to execute code-reuse attacks. First, we take a semantic-recovery approach to restrict the targets of indirect branches in a binary. Then, we further improve the precision by recovering C++-level semantics, and enforce a strict integrity model that improves precision for virtual function calls in the binary. Finally, in order to further reduce the attack space, we take a different perspective on defense against code-reuse attacks, and introduce Stack-Pointer Integrity -- a novel integrity model targeted at ensuring the integrity of stack Pointer as opposed to the Instruction Pointer. Our results show that the semantic-recovery-based approaches can help in significantly reducing the attack space by improving the precision of the underlying CFG. Function-level semantic recovery can eliminate 99.47% of inaccurate targets, whereas recovering virtual callsites and VTables at a C++ level can eliminate 99.99% of inaccurate targets

Marco-gisbert Hector - One of the best experts on this subject based on the ideXlab platform.

  • Control-Flow Integrity: Attacks and Protections
    'MDPI AG', 2019
    Co-Authors: Sayeed Sarwar, Marco-gisbert Hector, Ripoll Ismael, Birch Miriam
    Abstract:

    Despite the intense efforts to prevent programmers from writing code with memory errors, memory corruption vulnerabilities are still a major security threat. Consequently, control-flow integrity has received significant attention in the research community, and software developers to combat control code execution attacks in the presence of type of faults. Control-flow Integrity (CFI) is a large family of techniques that aims to eradicate memory error exploitation by ensuring that the Instruction Pointer (IP) of a running process cannot be controlled by a malicious attacker. In this paper, we assess the effectiveness of 14 CFI techniques against the most popular exploitation techniques, including code reuse attacks, return-to-user, return-to-libc, and replay attacks. We also classify these techniques based on their security, robustness, and implementation complexity. Our study indicates that the majority of the CFI techniques are primarily focused on restricting indirect branch Instructions and cannot prevent all forms of vulnerability exploitation. We conclude that the performance overhead introduced, jointly with the partial attack coverage, is discouraging the industry from adopting most of them

  • Control-Flow Integrity: Attacks and Protections
    'MDPI AG', 2019
    Co-Authors: Sayeed Sarwar, Marco-gisbert Hector, Ripoll-ripoll Ismael, Birch Miriam
    Abstract:

    [EN] Despite the intense efforts to prevent programmers from writing code with memory errors, memory corruption vulnerabilities are still a major security threat. Consequently, control-flow integrity has received significant attention in the research community, and software developers to combat control code execution attacks in the presence of type of faults. Control-flow Integrity (CFI) is a large family of techniques that aims to eradicate memory error exploitation by ensuring that the Instruction Pointer (IP) of a running process cannot be controlled by a malicious attacker. In this paper, we assess the effectiveness of 14 CFI techniques against the most popular exploitation techniques, including code reuse attacks, return-to-user, return-to-libc, and replay attacks. We also classify these techniques based on their security, robustness, and implementation complexity. Our study indicates that the majority of the CFI techniques are primarily focused on restricting indirect branch Instructions and cannot prevent all forms of vulnerability exploitation. We conclude that the performance overhead introduced, jointly with the partial attack coverage, is discouraging the industry from adopting most of them.Sayeed, S.; Marco-Gisbert, H.; Ripoll-Ripoll, I.; Birch, M. (2019). Control-Flow Integrity: Attacks and Protections. Applied Sciences. 9(20):1-22. https://doi.org/10.3390/app9204229S122920Kim, Y., Daly, R., Kim, J., Fallin, C., Lee, J. H., Lee, D., … Mutlu, O. (2014). Flipping bits in memory without accessing them: An experimental study of DRAM disturbance errors. 2014 ACM/IEEE 41st International Symposium on Computer Architecture (ISCA). doi:10.1109/isca.2014.6853210Buchanan, E., Roemer, R., Shacham, H., & Savage, S. (2008). When good Instructions go bad. Proceedings of the 15th ACM conference on Computer and communications security - CCS ’08. doi:10.1145/1455770.1455776Checkoway, S., Davi, L., Dmitrienko, A., Sadeghi, A.-R., Shacham, H., & Winandy, M. (2010). Return-oriented programming without returns. Proceedings of the 17th ACM conference on Computer and communications security - CCS ’10. doi:10.1145/1866307.1866370Bletsch, T., Jiang, X., Freeh, V. W., & Liang, Z. (2011). Jump-oriented programming. Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security - ASIACCS ’11. doi:10.1145/1966913.1966919Bosman, E., & Bos, H. (2014). Framing Signals - A Return to Portable Shellcode. 2014 IEEE Symposium on Security and Privacy. doi:10.1109/sp.2014.23GCC Extension for Protecting Applications from Stack-Smashing Attacks (ProPolice) http://www.trl.ibm.com/projects/security/ssp/Address Space Layout Randomization http://pax.grsecurity.net/docs/aslr.txtLu, K., Song, C., Lee, B., Chung, S. P., Kim, T., & Lee, W. (2015). ASLR-Guard. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS ’15. doi:10.1145/2810103.2813694New Security Enhancementsin Red Hat Enterprise Linux http://www.redhat.com/f/pdf/rhel/WHP0006US_Execshield.pdfWehbe, T., Mooney, V., & Keezer, D. (2018). Hardware-Based Run-Time Code Integrity in Embedded Devices. Cryptography, 2(3), 20. doi:10.3390/cryptography2030020Nanda, S., Li, W., Lam, L., & Chiueh, T. (2006). Foreign Code Detection on the Windows/X86 Platform. 2006 22nd Annual Computer Security Applications Conference (ACSAC’06). doi:10.1109/acsac.2006.29CWE Category http://cwe.mitre.org/Stack-Based Buffer Overflow Attacks: What You Need to Know https://blog.rapid7.com/2019/02/19/stack-based-buffer-overflow-attacks-what-you-need-to-know/Novark, G., & Berger, E. D. (2010). DieHarder. Proceedings of the 17th ACM conference on Computer and communications security - CCS ’10. doi:10.1145/1866307.1866371Dietz, W., Li, P., Regehr, J., & Adve, V. (2015). Understanding Integer Overflow in C/C++. ACM Transactions on Software Engineering and Methodology, 25(1), 1-29. doi:10.1145/2743019Dowson, M. (1997). The Ariane 5 software failure. ACM SIGSOFT Software Engineering Notes, 22(2), 84. doi:10.1145/251880.251992An Introduction to Use After Free Vulnerabilities https://www.purehacking.com/blog/lloyd-simon/an-introduction-to-use-after-free-vulnerabilitiesNull Dereference https://www.owasp.org/index.php/Null_DereferenceCode Injection https://www.owasp.org/index.php/Code_InjectionPerforming a Ret2libc Attack https://www.shellblade.net/docs/ret2libc.pdfRoglia, G. F., Martignoni, L., Paleari, R., & Bruschi, D. (2009). Surgically Returning to Randomized lib(c). 2009 Annual Computer Security Applications Conference. doi:10.1109/acsac.2009.16Guan, L., Lin, J., Luo, B., Jing, J., & Wang, J. (2015). Protecting Private Keys against Memory Disclosure Attacks Using Hardware Transactional Memory. 2015 IEEE Symposium on Security and Privacy. doi:10.1109/sp.2015.8Defending against Return-Oriented Programming https://www.cs.columbia.edu/~angelos/Papers/theses/vpappas_thesis.pdfNiu, B., & Tan, G. (2015). Per-Input Control-Flow Integrity. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS ’15. doi:10.1145/2810103.2813644Mashtizadeh, A. J., Bittau, A., Boneh, D., & Mazières, D. (2015). CCFI. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS ’15. doi:10.1145/2810103.2813676Muench, M., Pagani, F., Shoshitaishvili, Y., Kruegel, C., Vigna, G., & Balzarotti, D. (2016). Taming Transactions: Towards Hardware-Assisted Control Flow Integrity Using Transactional Memory. Lecture Notes in Computer Science, 24-48. doi:10.1007/978-3-319-45719-2_2How Does RAP Works https://grsecurity.net/rap_faq.phpAbadi, M., Budiu, M., Erlingsson, Ú., & Ligatti, J. (2005). Control-flow integrity. Proceedings of the 12th ACM conference on Computer and communications security - CCS ’05. doi:10.1145/1102120.1102165Abadi, M., Budiu, M., Erlingsson, Ú., & Ligatti, J. (2009). Control-flow integrity principles, implementations, and applications. ACM Transactions on Information and System Security, 13(1), 1-40. doi:10.1145/1609956.1609960Hawkins, B., Demsky, B., & Taylor, M. B. (2016). BlackBox: lightweight security monitoring for COTS binaries. Proceedings of the 2016 International Symposium on Code Generation and Optimization - CGO 2016. doi:10.1145/2854038.2854062Zhang, J., Hou, R., Fan, J., Liu, K., Zhang, L., & McKee, S. A. (2017). RAGuard. Proceedings of the Computing Frontiers Conference on ZZZ - CF’17. doi:10.1145/3075564.3075570Burow, N., Carr, S. A., Nash, J., Larsen, P., Franz, M., Brunthaler, S., & Payer, M. (2017). Control-Flow Integrity. ACM Computing Surveys, 50(1), 1-33. doi:10.1145/3054924Hu, H., Qian, C., Yagemann, C., Chung, S. P. H., Harris, W. R., Kim, T., & Lee, W. (2018). Enforcing Unique Code Target Property for Control-Flow Integrity. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security. doi:10.1145/3243734.3243797Chao Zhang, Tao Wei, Zhaofeng Chen, Lei Duan, Szekeres, L., McCamant, S., … Wei Zou. (2013). Practical Control Flow Integrity and Randomization for Binary Executables. 2013 IEEE Symposium on Security and Privacy. doi:10.1109/sp.2013.44Qiu, P., Lyu, Y., Zhang, J., Wang, D., & Qu, G. (2018). Control Flow Integrity Based on Lightweight Encryption Architecture. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 37(7), 1358-1369. doi:10.1109/tcad.2017.2748000Criswell, J., Dautenhahn, N., & Adve, V. (2014). KCoFI: Complete Control-Flow Integrity for Commodity Operating System Kernels. 2014 IEEE Symposium on Security and Privacy. doi:10.1109/sp.2014.26Evans, I., Long, F., Otgonbaatar, U., Shrobe, H., Rinard, M., Okhravi, H., & Sidiroglou-Douskos, S. (2015). Control Jujutsu. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS ’15. doi:10.1145/2810103.2813646Control Flow Guard https://courses.cs.washington.edu/courses/cse484/14au/reading/25-years-vulnerabilities.pdfLi, J., Tong, X., Zhang, F., & Ma, J. (2018). Fine-CFI: Fine-Grained Control-Flow Integrity for Operating System Kernels. IEEE Transactions on Information Forensics and Security, 13(6), 1535-1550. doi:10.1109/tifs.2018.2797932Introduction to Intel® Memory Protection Extensions https://software.intel.com/en-us/articles/introduction-to-intel-memory-protection-extensionsVan der Veen, V., Andriesse, D., Göktaş, E., Gras, B., Sambuc, L., Slowinska, A., … Giuffrida, C. (2015). Practical Context-Sensitive CFI. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS ’15. doi:10.1145/2810103.2813673Biondo, A., Conti, M., & Lain, D. (2018). Back To The Epilogue: Evading Control Flow Guard via Unaligned Targets. Proceedings 2018 Network and Distributed System Security Symposium. doi:10.14722/ndss.2018.23318Van der Veen, V., Andriesse, D., Stamatogiannakis, M., Chen, X., Bos, H., & Giuffrdia, C. (2017). The Dynamics of Innocent Flesh on the Bone. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. doi:10.1145/3133956.3134026Zhang, J., Qi, B., Qin, Z., & Qu, G. (2019). HCIC: Hardware-Assisted Control-Flow Integrity Checking. IEEE Internet of Things Journal, 6(1), 458-471. doi:10.1109/jiot.2018.2866164Wang, X., Huang, F., & Chen, H. (2019). DTrace: fine-grained and efficient data integrity checking with hardware Instruction tracing. Cybersecurity, 2(1). doi:10.1186/s42400-018-0018-3Christoulakis, N., Christou, G., Athanasopoulos, E., & Ioannidis, S. (2016). HCFI. Proceedings of the Sixth ACM on Conference on Data and Application Security and Privacy - CODASPY ’16. doi:10.1145/2857705.2857722Windows 10 Control Flow Guard Internals http://www.powerofcommunity.net/poc2014/mj0011.pdfCrane, S. J., Franz, M., Volckaert, S., Schuster, F., Liebchen, C., Larsen, P., … De Sutter, B. (2015). It’s a TRaP. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS ’15. doi:10.1145/2810103.2813682Zhang, M., Qiao, R., Hasabnis, N., & Sekar, R. (2014). A platform for secure static binary instrumentation. ACM SIGPLAN Notices, 49(7), 129-140. doi:10.1145/2674025.2576208Dang, T. H. Y., Maniatis, P., & Wagner, D. (2015). The Performance Cost of Shadow Stacks and Stack Canaries. Proceedings of the 10th ACM Symposium on Information, Computer and Communications Security - ASIA CCS ’15. doi:10.1145/2714576.271463