CodeArmor
| Autor: | Herbert Bos, Xi Chen, Cristiano Giuffrida |
|---|---|
| Přispěvatelé: | Computer Systems, Network Institute, Systems and Network Security |
| Jazyk: | angličtina |
| Rok vydání: | 2017 |
| Předmět: |
Source code
Dead code Computer science media_common.quotation_subject 020207 software engineering Code Access Security 02 engineering and technology randomization Computer security computer.software_genre honey gadgets Self-modifying code 020204 information systems code space virtualization 0202 electrical engineering electronic engineering information engineering Code injection Unreachable code Code mobility Redundant code computer media_common rerandomization |
| Zdroj: | 2017 IEEE European Symposium on Security and Privacy (EuroS&P) Chen, X, Bos, H & Giuffrida, C 2017, CodeArmor : Virtualizing the Code Space to Counter Disclosure Attacks . in Proceedings-2nd IEEE European Symposium on Security and Privacy, EuroS and P 2017 ., 7962000, Institute of Electrical and Electronics Engineers Inc., pp. 514-529, 2nd IEEE European Symposium on Security and Privacy, EuroS and P 2017, Paris, France, 26/04/17 . https://doi.org/10.1109/EuroSP.2017.17 Proceedings-2nd IEEE European Symposium on Security and Privacy, EuroS and P 2017, 514-529 STARTPAGE=514;ENDPAGE=529;TITLE=Proceedings-2nd IEEE European Symposium on Security and Privacy, EuroS and P 2017 EuroS&P |
| DOI: | 10.1109/EuroSP.2017.17 |
| Popis: | Code diversification is an effective strategy to prevent modern code-reuse exploits. Unfortunately, diversification techniques are inherently vulnerable to information disclosure. Recent diversification-aware ROP exploits have demonstrated that code disclosure attacks are a realistic threat, with an attacker able to read or execute arbitrary code memory and gather enough gadgets to bypass state-of-the-art code diversification defenses. In this paper, we present CodeArmor, a binary-level system to harden code diversification against all the existing read-based and execution-based code disclosure attacks. To counter such attacks, CodeArmor virtualizes the code space to completely decouple code pointer values from the concrete location of their targets in the memory address space. Using a combination of run-time randomization and pervasively deployed honey gadgets, code space virtualization probabilistically ensures that only code references that can legitimately be issued by the program are effectively translated to the concrete code space. This strategy significantly reduces the attack surface, limiting the attacker to only code pointer gadgets that can be leaked from data memory. In addition, unlike existing leakage-resistant code diversification techniques that provide similar security guarantees, CodeArmor requires no access to source code, hypervisors, or special hardware support. Our experimental results show that CodeArmor significantly raises the bar against existing and future attacks, at the cost of relatively low average performance overhead (6.9% on SPEC and 14.5% on popular server programs, and even lower - roughly halving such average overheads - when operating aggressive inlining optimizations at the binary level). |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|