The Experts below are selected from a list of 57 Experts worldwide ranked by ideXlab platform
Xuxian Jiang - One of the best experts on this subject based on the ideXlab platform.
-
Defeating Returnoriented rootkits with Return-less kernels
2015Co-Authors: Zhi Wang, Xuxian Jiang, Mike Grace, Sina BahramAbstract:Targeting the operating system (OS) kernels, kernel rootkits pose a formidable threat to computer systems and their users. Recent efforts have made significant progress in blocking them from injecting malicious code into the OS kernel for execution. Unfortunately, they cannot block the emerging so-called Return-oriented rootkits (RORs). Without the need of injecting their own malicious code, these rootkits can dis-cover and chain together “Return-oriented gadgets ” (that con-sist of only legitimate kernel code) for rootkit computation. In this paper, we propose a compiler-based approach to defeat these Return-oriented rootkits. Our approach recog-nizes the hallmark of Return-oriented rootkits, i.e., the Ret Instruction, and accordingly aims to completely remove them in a running OS kernel. Specifically, one key technique named Return indirection is to replace the Return address in a stack frame into a Return index and disallow a ROR from us-ing their own Return addresses to locate and assemble Return-oriented gadgets. Further, to prevent legitimate Instructions that happen to contain Return opcodes from being misused, we also propose two other techniques, register allocation and peephole optimization, to avoid introducing them in the first place. We have developed a LLVM-based prototype and used it to generate a Return-less FreeBSD kernel. Our evalu-ation results indicate that the proposed approach is generic, effective, and can be implemented on commodity hardware with a low performance overhead
-
mitigating code reuse attacks with control flow locking
Annual Computer Security Applications Conference, 2011Co-Authors: Tyler Bletsch, Xuxian Jiang, Vince FreehAbstract:Code-reuse attacks are software exploits in which an attacker directs control flow through existing code with a malicious result. One such technique, Return-oriented programming, is based on "gadgets" (short pre-existing sequences of code ending in a Ret Instruction) being executed in arbitrary order as a result of a stack corruption exploit. Many existing codereuse defenses have relied upon a particular attribute of the attack in question (e.g., the frequency of Ret Instructions in a Return-oriented attack), which leads to an incomplete protection, while a smaller number of efforts in protecting all exploitable control flow transfers suffer from limited deploy-ability due to high performance overhead. In this paper, we present a novel cost-effective defense technique called control flow locking, which allows for effective enforcement of control flow integrity with a small performance overhead. Specifically, instead of immediately determining whether a control flow violation happens before the control flow transfer takes place, control flow locking lazily detects the violation after the transfer. To still restrict attackers' capability, our scheme guarantees that the deviation of the normal control flow graph will only occur at most once. Further, our scheme ensures that this deviation cannot be used to craft a malicious system call, which denies any potential gains an attacker might obtain from what is permitted in the threat model. We have developed a proof-of-concept prototype in Linux and our evaluation demonstrates desirable effectiveness and competitive performance overhead with existing techniques. In several benchmarks, our scheme is able to achieve significant gains.
-
jump oriented programming a new class of code reuse attack
Computer and Communications Security, 2011Co-Authors: Tyler Bletsch, Xuxian Jiang, Vince Freeh, Zhenkai LiangAbstract:Return-oriented programming is an effective code-reuse attack in which short code sequences ending in a Ret Instruction are found within existing binaries and executed in arbitrary order by taking control of the stack. This allows for Turing-complete behavior in the target program without the need for injecting attack code, thus significantly negating current code injection defense efforts (e.g., W⊕X). On the other hand, its inherent characteristics, such as the reliance on the stack and the consecutive execution of Return-oriented gadgets, have prompted a variety of defenses to detect or prevent it from happening. In this paper, we introduce a new class of code-reuse attack, called jump-oriented programming. This new attack eliminates the reliance on the stack and Ret Instructions (including Ret-like Instructions such as pop+jmp) seen in Return-oriented programming without sacrificing expressive power. This attack still builds and chains functional gadgets, each performing certain primitive operations, except these gadgets end in an indirect branch rather than Ret. Without the convenience of using Ret to unify them, the attack relies on a dispatcher gadget to dispatch and execute the functional gadgets. We have successfully identified the availability of these jump-oriented gadgets in the GNU libc library. Our experience with an example shellcode attack demonstrates the practicality and effectiveness of this technique.
-
Code-reuse attacks: new frontiers and defenses
2011Co-Authors: Vince Freeh, Xuxian Jiang, Tyler BletschAbstract:Code-reuse attacks are software exploits in which an attacker directs control flow through existing code with a malicious result. For example, Return-oriented programming is an effective code-reuse attack in which short code sequences ending in a Ret Instruction are found within existing binaries and executed in arbitrary order by taking control of the stack. This allows for Turing-complete behavior in the target program without the need for injecting attack code, thus significantly negating current code injection defense efforts (e.g., W⊕X). On the other hand, its inherent characteristics, such as the reliance on the stack and the consecutive execution of Return-oriented gadgets, have prompted a variety of defenses to detect or prevent it from happening. This document introduces two novel code-reuse attacks. The first, jump-oriented programming, eliminates the reliance on the stack and Ret Instructions seen in Return-oriented programming without sacrificing expressive power. This attack still builds and chains normal functional gadgets, each performing certain primitive operations, except these gadgets end in an indirect branch rather than Ret. Without the convenience of using Ret to unify them, the attack relies on a dispatcher gadget to dispatch and execute the functional gadgets. We have successfully identified the availability of these jump-oriented gadgets in the GNU libc library and demonstrated the technique on both the x86 and MIPS architectures. Our experience with an example shellcode attack demonstrates the practicality and effectiveness of this technique. The second attack presented, Turing-complete Return-into-libc , demonstrates that it is possible to attain arbitrary computation even when only chaining entire functions as opposed to short gadgets. This has negative implications for certain defenses, and more importantly corrects the record on the capabilities of the existing Return-into-libc technique. To mitigate the threats presented by the above exploits, this document proposes a novel defense technique called control flow locking, which ensures that the control flow graph of an application is deviated from at most once, and that this deviation cannot be used to craft a malicious system call. This defense thwarts the existing code-reuse attacks, and the implementation presented shows performance overhead competitive with existing techniques, achieving significant gains in several benchmarks. Control flow locking represents a general solution to the problem of code-reuse attacks with a performance penalty small enough to justify deployment in real-world situations.
-
AsiaCCS - Jump-oriented programming: a new class of code-reuse attack
Proceedings of the 6th ACM Symposium on Information Computer and Communications Security - ASIACCS '11, 2011Co-Authors: Tyler Bletsch, Xuxian Jiang, Vince Freeh, Zhenkai LiangAbstract:Return-oriented programming is an effective code-reuse attack in which short code sequences ending in a Ret Instruction are found within existing binaries and executed in arbitrary order by taking control of the stack. This allows for Turing-complete behavior in the target program without the need for injecting attack code, thus significantly negating current code injection defense efforts (e.g., W⊕X). On the other hand, its inherent characteristics, such as the reliance on the stack and the consecutive execution of Return-oriented gadgets, have prompted a variety of defenses to detect or prevent it from happening. In this paper, we introduce a new class of code-reuse attack, called jump-oriented programming. This new attack eliminates the reliance on the stack and Ret Instructions (including Ret-like Instructions such as pop+jmp) seen in Return-oriented programming without sacrificing expressive power. This attack still builds and chains functional gadgets, each performing certain primitive operations, except these gadgets end in an indirect branch rather than Ret. Without the convenience of using Ret to unify them, the attack relies on a dispatcher gadget to dispatch and execute the functional gadgets. We have successfully identified the availability of these jump-oriented gadgets in the GNU libc library. Our experience with an example shellcode attack demonstrates the practicality and effectiveness of this technique.
Vince Freeh - One of the best experts on this subject based on the ideXlab platform.
-
mitigating code reuse attacks with control flow locking
Annual Computer Security Applications Conference, 2011Co-Authors: Tyler Bletsch, Xuxian Jiang, Vince FreehAbstract:Code-reuse attacks are software exploits in which an attacker directs control flow through existing code with a malicious result. One such technique, Return-oriented programming, is based on "gadgets" (short pre-existing sequences of code ending in a Ret Instruction) being executed in arbitrary order as a result of a stack corruption exploit. Many existing codereuse defenses have relied upon a particular attribute of the attack in question (e.g., the frequency of Ret Instructions in a Return-oriented attack), which leads to an incomplete protection, while a smaller number of efforts in protecting all exploitable control flow transfers suffer from limited deploy-ability due to high performance overhead. In this paper, we present a novel cost-effective defense technique called control flow locking, which allows for effective enforcement of control flow integrity with a small performance overhead. Specifically, instead of immediately determining whether a control flow violation happens before the control flow transfer takes place, control flow locking lazily detects the violation after the transfer. To still restrict attackers' capability, our scheme guarantees that the deviation of the normal control flow graph will only occur at most once. Further, our scheme ensures that this deviation cannot be used to craft a malicious system call, which denies any potential gains an attacker might obtain from what is permitted in the threat model. We have developed a proof-of-concept prototype in Linux and our evaluation demonstrates desirable effectiveness and competitive performance overhead with existing techniques. In several benchmarks, our scheme is able to achieve significant gains.
-
jump oriented programming a new class of code reuse attack
Computer and Communications Security, 2011Co-Authors: Tyler Bletsch, Xuxian Jiang, Vince Freeh, Zhenkai LiangAbstract:Return-oriented programming is an effective code-reuse attack in which short code sequences ending in a Ret Instruction are found within existing binaries and executed in arbitrary order by taking control of the stack. This allows for Turing-complete behavior in the target program without the need for injecting attack code, thus significantly negating current code injection defense efforts (e.g., W⊕X). On the other hand, its inherent characteristics, such as the reliance on the stack and the consecutive execution of Return-oriented gadgets, have prompted a variety of defenses to detect or prevent it from happening. In this paper, we introduce a new class of code-reuse attack, called jump-oriented programming. This new attack eliminates the reliance on the stack and Ret Instructions (including Ret-like Instructions such as pop+jmp) seen in Return-oriented programming without sacrificing expressive power. This attack still builds and chains functional gadgets, each performing certain primitive operations, except these gadgets end in an indirect branch rather than Ret. Without the convenience of using Ret to unify them, the attack relies on a dispatcher gadget to dispatch and execute the functional gadgets. We have successfully identified the availability of these jump-oriented gadgets in the GNU libc library. Our experience with an example shellcode attack demonstrates the practicality and effectiveness of this technique.
-
Code-reuse attacks: new frontiers and defenses
2011Co-Authors: Vince Freeh, Xuxian Jiang, Tyler BletschAbstract:Code-reuse attacks are software exploits in which an attacker directs control flow through existing code with a malicious result. For example, Return-oriented programming is an effective code-reuse attack in which short code sequences ending in a Ret Instruction are found within existing binaries and executed in arbitrary order by taking control of the stack. This allows for Turing-complete behavior in the target program without the need for injecting attack code, thus significantly negating current code injection defense efforts (e.g., W⊕X). On the other hand, its inherent characteristics, such as the reliance on the stack and the consecutive execution of Return-oriented gadgets, have prompted a variety of defenses to detect or prevent it from happening. This document introduces two novel code-reuse attacks. The first, jump-oriented programming, eliminates the reliance on the stack and Ret Instructions seen in Return-oriented programming without sacrificing expressive power. This attack still builds and chains normal functional gadgets, each performing certain primitive operations, except these gadgets end in an indirect branch rather than Ret. Without the convenience of using Ret to unify them, the attack relies on a dispatcher gadget to dispatch and execute the functional gadgets. We have successfully identified the availability of these jump-oriented gadgets in the GNU libc library and demonstrated the technique on both the x86 and MIPS architectures. Our experience with an example shellcode attack demonstrates the practicality and effectiveness of this technique. The second attack presented, Turing-complete Return-into-libc , demonstrates that it is possible to attain arbitrary computation even when only chaining entire functions as opposed to short gadgets. This has negative implications for certain defenses, and more importantly corrects the record on the capabilities of the existing Return-into-libc technique. To mitigate the threats presented by the above exploits, this document proposes a novel defense technique called control flow locking, which ensures that the control flow graph of an application is deviated from at most once, and that this deviation cannot be used to craft a malicious system call. This defense thwarts the existing code-reuse attacks, and the implementation presented shows performance overhead competitive with existing techniques, achieving significant gains in several benchmarks. Control flow locking represents a general solution to the problem of code-reuse attacks with a performance penalty small enough to justify deployment in real-world situations.
-
AsiaCCS - Jump-oriented programming: a new class of code-reuse attack
Proceedings of the 6th ACM Symposium on Information Computer and Communications Security - ASIACCS '11, 2011Co-Authors: Tyler Bletsch, Xuxian Jiang, Vince Freeh, Zhenkai LiangAbstract:Return-oriented programming is an effective code-reuse attack in which short code sequences ending in a Ret Instruction are found within existing binaries and executed in arbitrary order by taking control of the stack. This allows for Turing-complete behavior in the target program without the need for injecting attack code, thus significantly negating current code injection defense efforts (e.g., W⊕X). On the other hand, its inherent characteristics, such as the reliance on the stack and the consecutive execution of Return-oriented gadgets, have prompted a variety of defenses to detect or prevent it from happening. In this paper, we introduce a new class of code-reuse attack, called jump-oriented programming. This new attack eliminates the reliance on the stack and Ret Instructions (including Ret-like Instructions such as pop+jmp) seen in Return-oriented programming without sacrificing expressive power. This attack still builds and chains functional gadgets, each performing certain primitive operations, except these gadgets end in an indirect branch rather than Ret. Without the convenience of using Ret to unify them, the attack relies on a dispatcher gadget to dispatch and execute the functional gadgets. We have successfully identified the availability of these jump-oriented gadgets in the GNU libc library. Our experience with an example shellcode attack demonstrates the practicality and effectiveness of this technique.
-
ACSAC - Mitigating code-reuse attacks with control-flow locking
Proceedings of the 27th Annual Computer Security Applications Conference on - ACSAC '11, 2011Co-Authors: Tyler Bletsch, Xuxian Jiang, Vince FreehAbstract:Code-reuse attacks are software exploits in which an attacker directs control flow through existing code with a malicious result. One such technique, Return-oriented programming, is based on "gadgets" (short pre-existing sequences of code ending in a Ret Instruction) being executed in arbitrary order as a result of a stack corruption exploit. Many existing codereuse defenses have relied upon a particular attribute of the attack in question (e.g., the frequency of Ret Instructions in a Return-oriented attack), which leads to an incomplete protection, while a smaller number of efforts in protecting all exploitable control flow transfers suffer from limited deploy-ability due to high performance overhead. In this paper, we present a novel cost-effective defense technique called control flow locking, which allows for effective enforcement of control flow integrity with a small performance overhead. Specifically, instead of immediately determining whether a control flow violation happens before the control flow transfer takes place, control flow locking lazily detects the violation after the transfer. To still restrict attackers' capability, our scheme guarantees that the deviation of the normal control flow graph will only occur at most once. Further, our scheme ensures that this deviation cannot be used to craft a malicious system call, which denies any potential gains an attacker might obtain from what is permitted in the threat model. We have developed a proof-of-concept prototype in Linux and our evaluation demonstrates desirable effectiveness and competitive performance overhead with existing techniques. In several benchmarks, our scheme is able to achieve significant gains.
Jingling Xue - One of the best experts on this subject based on the ideXlab platform.
-
Burn After Reading: A Shadow Stack with Microsecond-level Runtime Rerandomization for Protecting Return Addresses**Thanks to all the reviewers for their valuable comments. This research is supported by an Australian Research Council grant (DP18010406
2020Co-Authors: Changwei Zou, Jingling XueAbstract:Return-oriented programming (ROP) is an effective code-reuse attack in which short code sequences (i.e., gadgets) ending in a Ret Instruction are found within existing binaries and then executed by taking control of the call stack. The shadow stack, control flow integrity (CFI) and code (re)randomization are three popular techniques for protecting programs against Return address overwrites. However, existing runtime rerandomization techniques operate on concRete Return addresses, requiring expensive pointer tracking. By adding one level of indirection, we introduce BarRA, the first shadow stack mechanism that applies continuous runtime rerandomization to abstract Return addresses for protecting their corresponding concRete Return addresses (protected also by CFI), thus avoiding expensive pointer tracking. As a nice side-effect, BarRA naturally combines the shadow stack, CFI and runtime rerandomization in the same framework. The key novelty of BarRA, however, is that once some abstract Return addresses are leaked, BarRA will enforce the burn-after-reading property by rerandomizing the mapping from the abstract to the concRete Return address space in the order of microseconds instead of seconds required for rerandomizing a concRete Return address space. As a result, BarRA can be used as a superior replacement for the shadow stack, as demonstrated by comparing both using the 19 C/C++ benchmarks in SPEC CPU2006 (totalling 2,047,447 LOC) and analyzing a proof-of-concept attack, provided that we can tolerate some slight binary code size increases (by an average of 29.44%) and are willing to use 8MB of dedicated memory for holding up to 2 20 Return addresses (on a 64-bit platform). Under an information leakage attack (for some Return addresses), the shadow stack is always vulnerable but BarRA is significantly more resilient (by reducing an attacker's success rate to $\frac{1}{2^{20}}$ on average). In terms of the average performance overhead introduced, both are comparable: 6.09% (BarRA) vs. 5.38% (the shadow stack).
-
ICSE - Burn after reading: a shadow stack with microsecond-level runtime rerandomization for protecting Return addresses
Proceedings of the ACM IEEE 42nd International Conference on Software Engineering, 2020Co-Authors: Changwei Zou, Jingling XueAbstract:Return-oriented programming (ROP) is an effective code-reuse attack in which short code sequences (i.e., gadgets) ending in a Ret Instruction are found within existing binaries and then executed by taking control of the call stack. The shadow stack, control flow integrity (CFI) and code (re)randomization are three popular techniques for protecting programs against Return address overwrites. However, existing runtime rerandomization techniques operate on concRete Return addresses, requiring expensive pointer tracking.By adding one level of indirection, we introduce BarRA, the first shadow stack mechanism that applies continuous runtime rerandomization to abstract Return addresses for protecting their corresponding concRete Return addresses (protected also by CFI), thus avoiding expensive pointer tracking. As a nice side-effect, BarRA naturally combines the shadow stack, CFI and runtime rerandomization in the same framework. The key novelty of BarRA, however, is that once some abstract Return addresses are leaked, BarRA will enforce the burn-after-reading property by rerandomizing the mapping from the abstract to the concRete Return address space in the order of microseconds instead of seconds required for rerandomizing a concRete Return address space. As a result, BarRA can be used as a superior replacement for the shadow stack, as demonstrated by comparing both using the 19 C/C++ benchmarks in SPEC CPU2006 (totalling 2,047,447 LOC) and analyzing a proof-of-concept attack, provided that we can tolerate some slight binary code size increases (by an average of 29.44%) and are willing to use 8MB of dedicated memory for holding up to 220 Return addresses (on a 64-bit platform). Under an information leakage attack (for some Return addresses), the shadow stack is always vulnerable but BarRA is significantly more resilient (by reducing an attacker's success rate to 1/220 on average). In terms of the average performance overhead introduced, both are comparable: 6.09% (BarRA) vs. 5.38% (the shadow stack).
Tyler Bletsch - One of the best experts on this subject based on the ideXlab platform.
-
mitigating code reuse attacks with control flow locking
Annual Computer Security Applications Conference, 2011Co-Authors: Tyler Bletsch, Xuxian Jiang, Vince FreehAbstract:Code-reuse attacks are software exploits in which an attacker directs control flow through existing code with a malicious result. One such technique, Return-oriented programming, is based on "gadgets" (short pre-existing sequences of code ending in a Ret Instruction) being executed in arbitrary order as a result of a stack corruption exploit. Many existing codereuse defenses have relied upon a particular attribute of the attack in question (e.g., the frequency of Ret Instructions in a Return-oriented attack), which leads to an incomplete protection, while a smaller number of efforts in protecting all exploitable control flow transfers suffer from limited deploy-ability due to high performance overhead. In this paper, we present a novel cost-effective defense technique called control flow locking, which allows for effective enforcement of control flow integrity with a small performance overhead. Specifically, instead of immediately determining whether a control flow violation happens before the control flow transfer takes place, control flow locking lazily detects the violation after the transfer. To still restrict attackers' capability, our scheme guarantees that the deviation of the normal control flow graph will only occur at most once. Further, our scheme ensures that this deviation cannot be used to craft a malicious system call, which denies any potential gains an attacker might obtain from what is permitted in the threat model. We have developed a proof-of-concept prototype in Linux and our evaluation demonstrates desirable effectiveness and competitive performance overhead with existing techniques. In several benchmarks, our scheme is able to achieve significant gains.
-
jump oriented programming a new class of code reuse attack
Computer and Communications Security, 2011Co-Authors: Tyler Bletsch, Xuxian Jiang, Vince Freeh, Zhenkai LiangAbstract:Return-oriented programming is an effective code-reuse attack in which short code sequences ending in a Ret Instruction are found within existing binaries and executed in arbitrary order by taking control of the stack. This allows for Turing-complete behavior in the target program without the need for injecting attack code, thus significantly negating current code injection defense efforts (e.g., W⊕X). On the other hand, its inherent characteristics, such as the reliance on the stack and the consecutive execution of Return-oriented gadgets, have prompted a variety of defenses to detect or prevent it from happening. In this paper, we introduce a new class of code-reuse attack, called jump-oriented programming. This new attack eliminates the reliance on the stack and Ret Instructions (including Ret-like Instructions such as pop+jmp) seen in Return-oriented programming without sacrificing expressive power. This attack still builds and chains functional gadgets, each performing certain primitive operations, except these gadgets end in an indirect branch rather than Ret. Without the convenience of using Ret to unify them, the attack relies on a dispatcher gadget to dispatch and execute the functional gadgets. We have successfully identified the availability of these jump-oriented gadgets in the GNU libc library. Our experience with an example shellcode attack demonstrates the practicality and effectiveness of this technique.
-
Code-reuse attacks: new frontiers and defenses
2011Co-Authors: Vince Freeh, Xuxian Jiang, Tyler BletschAbstract:Code-reuse attacks are software exploits in which an attacker directs control flow through existing code with a malicious result. For example, Return-oriented programming is an effective code-reuse attack in which short code sequences ending in a Ret Instruction are found within existing binaries and executed in arbitrary order by taking control of the stack. This allows for Turing-complete behavior in the target program without the need for injecting attack code, thus significantly negating current code injection defense efforts (e.g., W⊕X). On the other hand, its inherent characteristics, such as the reliance on the stack and the consecutive execution of Return-oriented gadgets, have prompted a variety of defenses to detect or prevent it from happening. This document introduces two novel code-reuse attacks. The first, jump-oriented programming, eliminates the reliance on the stack and Ret Instructions seen in Return-oriented programming without sacrificing expressive power. This attack still builds and chains normal functional gadgets, each performing certain primitive operations, except these gadgets end in an indirect branch rather than Ret. Without the convenience of using Ret to unify them, the attack relies on a dispatcher gadget to dispatch and execute the functional gadgets. We have successfully identified the availability of these jump-oriented gadgets in the GNU libc library and demonstrated the technique on both the x86 and MIPS architectures. Our experience with an example shellcode attack demonstrates the practicality and effectiveness of this technique. The second attack presented, Turing-complete Return-into-libc , demonstrates that it is possible to attain arbitrary computation even when only chaining entire functions as opposed to short gadgets. This has negative implications for certain defenses, and more importantly corrects the record on the capabilities of the existing Return-into-libc technique. To mitigate the threats presented by the above exploits, this document proposes a novel defense technique called control flow locking, which ensures that the control flow graph of an application is deviated from at most once, and that this deviation cannot be used to craft a malicious system call. This defense thwarts the existing code-reuse attacks, and the implementation presented shows performance overhead competitive with existing techniques, achieving significant gains in several benchmarks. Control flow locking represents a general solution to the problem of code-reuse attacks with a performance penalty small enough to justify deployment in real-world situations.
-
AsiaCCS - Jump-oriented programming: a new class of code-reuse attack
Proceedings of the 6th ACM Symposium on Information Computer and Communications Security - ASIACCS '11, 2011Co-Authors: Tyler Bletsch, Xuxian Jiang, Vince Freeh, Zhenkai LiangAbstract:Return-oriented programming is an effective code-reuse attack in which short code sequences ending in a Ret Instruction are found within existing binaries and executed in arbitrary order by taking control of the stack. This allows for Turing-complete behavior in the target program without the need for injecting attack code, thus significantly negating current code injection defense efforts (e.g., W⊕X). On the other hand, its inherent characteristics, such as the reliance on the stack and the consecutive execution of Return-oriented gadgets, have prompted a variety of defenses to detect or prevent it from happening. In this paper, we introduce a new class of code-reuse attack, called jump-oriented programming. This new attack eliminates the reliance on the stack and Ret Instructions (including Ret-like Instructions such as pop+jmp) seen in Return-oriented programming without sacrificing expressive power. This attack still builds and chains functional gadgets, each performing certain primitive operations, except these gadgets end in an indirect branch rather than Ret. Without the convenience of using Ret to unify them, the attack relies on a dispatcher gadget to dispatch and execute the functional gadgets. We have successfully identified the availability of these jump-oriented gadgets in the GNU libc library. Our experience with an example shellcode attack demonstrates the practicality and effectiveness of this technique.
-
ACSAC - Mitigating code-reuse attacks with control-flow locking
Proceedings of the 27th Annual Computer Security Applications Conference on - ACSAC '11, 2011Co-Authors: Tyler Bletsch, Xuxian Jiang, Vince FreehAbstract:Code-reuse attacks are software exploits in which an attacker directs control flow through existing code with a malicious result. One such technique, Return-oriented programming, is based on "gadgets" (short pre-existing sequences of code ending in a Ret Instruction) being executed in arbitrary order as a result of a stack corruption exploit. Many existing codereuse defenses have relied upon a particular attribute of the attack in question (e.g., the frequency of Ret Instructions in a Return-oriented attack), which leads to an incomplete protection, while a smaller number of efforts in protecting all exploitable control flow transfers suffer from limited deploy-ability due to high performance overhead. In this paper, we present a novel cost-effective defense technique called control flow locking, which allows for effective enforcement of control flow integrity with a small performance overhead. Specifically, instead of immediately determining whether a control flow violation happens before the control flow transfer takes place, control flow locking lazily detects the violation after the transfer. To still restrict attackers' capability, our scheme guarantees that the deviation of the normal control flow graph will only occur at most once. Further, our scheme ensures that this deviation cannot be used to craft a malicious system call, which denies any potential gains an attacker might obtain from what is permitted in the threat model. We have developed a proof-of-concept prototype in Linux and our evaluation demonstrates desirable effectiveness and competitive performance overhead with existing techniques. In several benchmarks, our scheme is able to achieve significant gains.
Changwei Zou - One of the best experts on this subject based on the ideXlab platform.
-
Burn After Reading: A Shadow Stack with Microsecond-level Runtime Rerandomization for Protecting Return Addresses**Thanks to all the reviewers for their valuable comments. This research is supported by an Australian Research Council grant (DP18010406
2020Co-Authors: Changwei Zou, Jingling XueAbstract:Return-oriented programming (ROP) is an effective code-reuse attack in which short code sequences (i.e., gadgets) ending in a Ret Instruction are found within existing binaries and then executed by taking control of the call stack. The shadow stack, control flow integrity (CFI) and code (re)randomization are three popular techniques for protecting programs against Return address overwrites. However, existing runtime rerandomization techniques operate on concRete Return addresses, requiring expensive pointer tracking. By adding one level of indirection, we introduce BarRA, the first shadow stack mechanism that applies continuous runtime rerandomization to abstract Return addresses for protecting their corresponding concRete Return addresses (protected also by CFI), thus avoiding expensive pointer tracking. As a nice side-effect, BarRA naturally combines the shadow stack, CFI and runtime rerandomization in the same framework. The key novelty of BarRA, however, is that once some abstract Return addresses are leaked, BarRA will enforce the burn-after-reading property by rerandomizing the mapping from the abstract to the concRete Return address space in the order of microseconds instead of seconds required for rerandomizing a concRete Return address space. As a result, BarRA can be used as a superior replacement for the shadow stack, as demonstrated by comparing both using the 19 C/C++ benchmarks in SPEC CPU2006 (totalling 2,047,447 LOC) and analyzing a proof-of-concept attack, provided that we can tolerate some slight binary code size increases (by an average of 29.44%) and are willing to use 8MB of dedicated memory for holding up to 2 20 Return addresses (on a 64-bit platform). Under an information leakage attack (for some Return addresses), the shadow stack is always vulnerable but BarRA is significantly more resilient (by reducing an attacker's success rate to $\frac{1}{2^{20}}$ on average). In terms of the average performance overhead introduced, both are comparable: 6.09% (BarRA) vs. 5.38% (the shadow stack).
-
ICSE - Burn after reading: a shadow stack with microsecond-level runtime rerandomization for protecting Return addresses
Proceedings of the ACM IEEE 42nd International Conference on Software Engineering, 2020Co-Authors: Changwei Zou, Jingling XueAbstract:Return-oriented programming (ROP) is an effective code-reuse attack in which short code sequences (i.e., gadgets) ending in a Ret Instruction are found within existing binaries and then executed by taking control of the call stack. The shadow stack, control flow integrity (CFI) and code (re)randomization are three popular techniques for protecting programs against Return address overwrites. However, existing runtime rerandomization techniques operate on concRete Return addresses, requiring expensive pointer tracking.By adding one level of indirection, we introduce BarRA, the first shadow stack mechanism that applies continuous runtime rerandomization to abstract Return addresses for protecting their corresponding concRete Return addresses (protected also by CFI), thus avoiding expensive pointer tracking. As a nice side-effect, BarRA naturally combines the shadow stack, CFI and runtime rerandomization in the same framework. The key novelty of BarRA, however, is that once some abstract Return addresses are leaked, BarRA will enforce the burn-after-reading property by rerandomizing the mapping from the abstract to the concRete Return address space in the order of microseconds instead of seconds required for rerandomizing a concRete Return address space. As a result, BarRA can be used as a superior replacement for the shadow stack, as demonstrated by comparing both using the 19 C/C++ benchmarks in SPEC CPU2006 (totalling 2,047,447 LOC) and analyzing a proof-of-concept attack, provided that we can tolerate some slight binary code size increases (by an average of 29.44%) and are willing to use 8MB of dedicated memory for holding up to 220 Return addresses (on a 64-bit platform). Under an information leakage attack (for some Return addresses), the shadow stack is always vulnerable but BarRA is significantly more resilient (by reducing an attacker's success rate to 1/220 on average). In terms of the average performance overhead introduced, both are comparable: 6.09% (BarRA) vs. 5.38% (the shadow stack).