ROPdefender
Published 22 March 2011
Lucas Davi, Ahmad‐Reza Sadeghi, Marcel Winandy
Citations244
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
This paper presents a tool, ROPdefender, that dynamically detects conventional ROP attacks (that are based on return instructions) and can be immediately deployed by end-users, since it does not rely on side information which is rarely provided in practice.
Abstract
Modern runtime attacks increasingly make use of the powerful return-oriented programming (ROP) attack techniques and principles such as recent attacks on Apple iPhone and Acrobat products to name some. These attacks even work under the presence of modern memory protection mechanisms such as data execution prevention (DEP). In this paper, we present our tool, ROPdefender, that dynamically detects conventional ROP attacks (that are based on return instructions). In contrast to existing solutions, ROPdefender can be immediately deployed by end-users, since it does not rely on side information (e.g., source code or debugging information) which are rarely provided in practice. Currently, our tool adds a runtime overhead of 2x which is comparable to similar instrumentation-based tools.
Keywords
Computer Science
Pin
2,279 Citations2005Chi-Keung Luk, Robert Cohn +7 more
The goals are to provide easy-to-use, portable, transparent, and efficient instrumentation, and to illustrate Pin's versatility, two Pintools in daily use to analyze production software are described.
Valgrind
2,260 Citations2007Nicholas Nethercote, Julian Seward
Valgrind is described, a DBI framework designed for building heavyweight DBA tools that can be used to build more interesting, heavyweight tools that are difficult or impossible to build with other DBI frameworks such as Pin and DynamoRIO.
FigshareDynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software
1,297 Citations2018James Newsome, Dawn Song
The geometry of innocent flesh on the bone
1,262 Citations2007Hovav Shacham
A return-into-libc attack to be mounted on x86 executables that calls no functions at all is presented, and how to discover such instruction sequences by means of static analysis is shown.
PDXScholar (Portland State University)StackGuard: automatic adaptive detection and prevention of buffer-overflow attacks
1,262 Citations1998Crispin Cowan, Calton Pu +8 more
StackGuard is described: a simple compiler technique that virtually eliminates buffer overflow vulnerabilities with only modest performance penalties, and a set of variations on the technique that trade-off between penetration resistance and performance.
USENIX Security SymposiumDesign and implementation of a TCG-based integrity measurement architecture
1,020 Citations2004Reiner Sailer, Xiaolan Zhang +2 more
This work shows that many of the Microsoft NGSCB guarantees can be obtained on today's hardware and today's software and that these guarantees do not require a new CPU mode or operating system but merely depend on the availability of an independent trusted entity, a TPM for example.
Control-flow integrity
1,015 Citations2005Martı́n Abadi, Mihai Budiu +2 more
Control-Flow Integrity provides a useful foundation for enforcing further security policies, as it is demonstrated with efficient software implementations of a protected shadow call stack and of access control for memory regions.
On the effectiveness of address-space randomization
861 Citations2004Hovav Shacham, Matthew J. Page +4 more
Aderandomization attack is demonstrated that will convert any standard buffer-overflow exploit into an exploit that works against systems protected by address-space randomization, and it is concluded that, on 32-bit architectures, the only benefit of PaX-like address- space randomization is a small slowdown in worm propagation speed.
The International Journal of High Performance Computing ApplicationsAn API for Runtime Code Patching
586 Citations2000Bryan Buck, Jeffrey K. Hollingsworth
The authors present a postcompiler program manipulation tool called Dyninst, which provides a C++ class library for program instrumentation that permits machine-independent binary instrumentation programs to be written.
Dytan
539 Citations2007James Clause, Wanchun Li +1 more
A general framework for dynamic tainting is defined and developed that is highly flexible and customizable, allows for performing both data-flow and control-flow based taints conservatively, and does not rely on any customized run-time system.
Return-oriented programming without returns
533 Citations2010Stephen Checkoway, Lucas Davi +4 more
It is shown that on both the x86 and ARM architectures it is possible to mount return-oriented programming attacks without using return instructions, and these attacks instead make use of certain instruction sequences that behave like a return.
DSpace@MIT (Massachusetts Institute of Technology)Secure Execution via Program Shepherding
530 Citations2002Vladimir Kiriansky, Derek Bruening +1 more
This work introduces program shepherding, a method for monitoring control flow transfers during program execution to enforce a security policy, and implements these capabilities efficiently in a runtime system with minimal or no performance penalties.
Dynamic instrumentation of production systems
436 Citations2004Bryan Cantrill, Michael W. Shapiro +1 more
TaintScope: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection
384 Citations2010Tielei Wang, Tao Wei +2 more
Experimental results show that TaintScope can accurately locate the checksum checks in programs and dramatically improve the effectiveness of fuzz testing, an automatic fuzzing system using dynamic taint analysis and symbolic execution techniques.
When good instructions go bad
358 Citations2008Erik Buchanan, Ryan Roemer +2 more
It is argued that the threat posed by return-oriented programming, across all architectures and systems, has negative implications for an entire class of security mechanisms: those that seek to prevent malicious computation by preventing the execution of malicious code.
Efficient, transparent, and comprehensive runtime code manipulation
354 Citations2004Derek Bruening, Saman Amarasinghe
D DynamoRIO is presented, a fully-implemented runtime code manipulation system that supports code transformations on any part of a program, while it executes, with zero to thirty percent time and memory overhead on both Windows and Linux.
Pointguard TM : protecting pointers from buffer overflow vulnerabilities
347 Citations2003Crispin Cowan, Steve Beattie +2 more
The PointGuard implementation is described, its overhead is shown to be low when protecting real security-sensitive applications such as OpenSSL, and it is shown that PointGuard is effective in defending against buffer overflow vulnerabilities that are not blocked by previous defenses.
Taint-enhanced policy enforcement: a practical approach to defeat a wide range of attacks
341 Citations2006Wei Xu, Sandeep Bhatkar +1 more
This paper presents a new approach to strengthen policy enforcement by augmenting security policies with information about the trustworthiness of data used in securitysensitive operations, and evaluated this technique using 9 available exploits involving several popular software packages containing the above types of vulnerabilities.
Operating Systems Design and ImplementationXFI: software guards for system address spaces
340 Citations2006Úlfar Erlingsson, Martı́n Abadi +3 more
This work has implemented XFI for Windows on the x86 architecture using binary rewriting and a simple, stand-alone verifier; the implementation's correctness depends on the verifier, but not on the rewriter.
Code injection attacks on harvard-architecture devices
255 Citations2008Aurélien Francillon, Claude Castelluccia
This paper shows how to exploit program vulnerabilities to permanently inject any piece of code into the program memory of an Atmel AVR-based sensor and shows that this attack can be used to inject a worm that can propagate through the wireless sensor network and possibly create a sensor botnet.
RAD: a compile-time solution to buffer overflow attacks
242 Citations2002Tzi‐cker Chiueh, Fu‐Hau Hsu
This paper presents a compiler-based solution to the notorious buffer overflow attack problem, a taxonomy of defense methods, the implementation details of RAD, and the performance analysis of the RAD prototype.
Return-oriented rootkits: bypassing kernel code integrity protection mechanisms
217 Citations2009Ralf Hund, Thorsten Holz +1 more
The design and implementation of a system that fully automates the process of constructing instruction sequences that can be used by an attacker for malicious computations are presented and a practical attack that can bypass existing kernel integrity protection mechanisms is described.
G-Free
214 Citations2010Kaan Onarlıoğlu, Leyla Bilge +3 more
G-Free is presented, a compiler-based approach that represents the first practical solution against any possible form of ROP, and is able to eliminate all unaligned free-branch instructions inside a binary executable, and to protect the aligned free-Branch instructions to prevent them from being misused by an attacker.
StackGhost: Hardware facilitated stack protection
201 Citations2001Mike Frantzen, Mike Shuey
Stack-Ghost advances exploit prevention in that it protects every application run on the system without their knowledge nor does it require their source or binary modification.
Lecture notes in computer scienceDROP: Detecting Return-Oriented Programming Malicious Code
167 Citations2009Ping Chen, Hai Xiao +4 more
A tool DROP is presented, which is focused on dynamically detecting ROP malicious code, and preliminary experimental results show that DROP can efficiently detect ROP malware, and have no false positives and negatives.
Vulcan Binary transformation in a distributed environment
162 Citations2001Amitabh Srivastava, Andrew J. Edwards +1 more
Vulcan provides both static and dynamic code modification and provides a framework for cross-component analysis and optimization and provides system-level analysis for heterogeneous binaries across instruction sets.
Defeating return-oriented rootkits with " <i>Return-Less</i> " kernels
159 Citations2010Jinku Li, Zhi Wang +3 more
This approach recognizes the hallmark of return-oriented rootkits, i.e., the ret instruction, and accordingly aims to completely remove them in a running OS kernel, and developed a LLVM-based prototype and used it to generate a return-less FreeBSD kernel.
USENIX Annual Technical ConferenceA Binary Rewriting Defense Against Stack based Buffer Overflow Attacks.
153 Citations2003Manish Prasad, Tzi‐cker Chiueh
Dynamic integrity measurement and attestation
150 Citations2009Lucas Davi, Ahmad‐Reza Sadeghi +1 more
This work proposes new runtime integrity monitoring techniques that use tracking instrumentation of program binaries based on taint analysis and dynamic tracing and describes how these techniques can be employed in a dynamic integrity measurement architecture (DynIMA).
Remote attestation to dynamic system properties: Towards providing complete system integrity evidence
149 Citations2009Chongkyung Kil, Emre C. Sezer +3 more
A novel remote dynamic attestation system named ReDAS (Remote Dynamic Attestation System) that provides integrity evidence for dynamic system properties that represent the runtime behavior of the attested system and enable an attester to prove its runtime integrity to a remote party.
Annual Computer Security Applications Conference/Proceedings of the annual Computer Security Applications ConferenceA General Dynamic Information Flow Tracking Framework for Security Applications
120 Citations2006Lap Chung Lam, Tzi‐cker Chiueh
This paper presents a general dynamic information flow tracking framework (called GIFT) for C programs that allows an application developer to associate application-specific tags with input data, instruments the application to propagate these tags to all the other data that are control/data-dependent on them, and invokes application- specific processing on output data according to their tag values.
Surgically Returning to Randomized lib(c)
115 Citations2009Giampaolo Fresi Roglia, Lorenzo Martignoni +2 more
It is concluded that position independent executables (PIE) are essential to complement ASLR and to prevent the attack presented in this paper, which can exploit the majority of programs vulnerable to stack-based buffer overflows surgically.
Can DREs provide long-lasting security? the case of return-oriented programming and the AVC advantage
91 Citations2009Stephen Checkoway, Ariel J. Feldman +4 more
It is demonstrated that an attacker can induce the AVC Advantage to misbehave in arbitrary ways--including changing the outcome of an election--by means of a memory cartridge containing a specially-formatted payload.
Defending embedded systems against control flow attacks
85 Citations2009Aurélien Francillon, Daniele Perito +1 more
This paper presents a control flow enforcement technique based on an Instruction Based Memory Access Control (IBMAC) implemented in hardware specifically designed to protect low-cost embedded systems against malicious manipulation of their control flow as well as preventing accidental stack overflows.
A framework for automated architecture-independent gadget search
43 Citations2010Thomas Dullien, Tim Kornau +1 more
This work defines the paradigm of free-branch instructions to succinctly capture which gadgets will be found by the generic algorithms when locating gadgets and discusses architectural idiosyncrasies for several widely spread CPU architectures.
Return-Oriented Programming without Returns on ARM
38 Citations2010Lucas Davi, Alexandra Dmitrienko +2 more
A Turing-complete attack that can induce arbitrary change of behavior in running programs without requiring code injection is presented, and it can not be detected by return address checkers.
Dynamic code instrumentation to detect and recover from return address corruption
25 Citations2006Suhas Gupta, Pranay Pratap +2 more
This paper provides a way of detecting return address corruption on the stack using dynamic code instrumentation and it does not depend on the availability of source code of the vulnerable application.
Lecture notes in computer scienceEfficient Detection of the Return-Oriented Programming Malicious Code
22 Citations2010Pïng Chen, Xing Xiao +3 more
This paper found the intrinsic feature of the ROP shellcode, and proposed an efficient method which can detect the Rop malicious code (including the one without returns).
Developments in Cisco IOS Forensics
19 Citations2008FX ' Lindner
This paper takes the position that the currently used, well accepted practices for monitoring, debugging and post mortem crash analysis are insufficient to deal with the threat of compromised IOS devices, and sets forth a different method that reduces the requirement for constant logging, favoring ondemand in-depth analysis in case of suspicion or actual device crashes.