A Function Level Randomization Technique to Mitigate ROP Attacks

Abstract:

ROP (Return-Oriented Programming) is a kind of attack technique which makes use of the existing binary code of target systems. ASLR (Address Space Layout Randomization) is widely used to protect systems from buffer-overflow attacks by introducing artificial diversity to software. With ASLR software can be immune from ROP attacks to some extent. Due to the fact that ASLR cant randomize base addresses of executables code segments and its utility on 32-bit architectures is limited by the number of bits available for address randomization, attackers can successfully exploit a target system by using brute force in limited time. Thus, we proposed FLR, a function level randomization technique to mitigate ROP attacks. FLR randomly permutes functions in executables, making attackers assumptions on executables incorrect. We implemented a prototype of FLR and randomized ten executables. ROP attacks succeeded without FLR and failed with FLR.

• Periodical: Advanced Materials Research (Volumes 765-767)
• Pages: 871-878
• DOI: https://doi.org/10.4028/www.scientific.net/AMR.765-767.871
• Online since: September 2013
• Authors: Liang Xiao, Xun Zhan, Tao Zheng
• Keywords: Address Space Layout Randomization, ASLR, Function Level Randomization, Return-Oriented Programming, ROP

References

[1] Shacham H. The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86)[C]/Proceedings of the 14th ACM conference on Computer and communications security. ACM, 2007: 552-561.

DOI: 10.1145/1315245.1315313

[2] Baratloo A, Singh N, Tsai T. Libsafe: Protecting critical elements of stacks[J]. (1999).

[3] Jones R W M, Kelly P H J. Backwards-compatible bounds checking for arrays and pointers in C programs[J]. Automated and Algorithmic Debugging, 1997, 25.

[4] Dhurjati D, Adve V. Backwards-compatible array bounds checking for C with very low overhead[C]/Proceedings of the 28th international conference on Software engineering. ACM, 2006: 162-171.

DOI: 10.1145/1134285.1134309

[5] Cowan C, Pu C, Maier D, et al. StackGuard: Automatic adaptive detection and prevention of buffer-overflow attacks[C]/Proceedings of the 7th USENIX Security Symposium. 1998, 81: 346-355.

[6] Cowan C, Beattie S, Johansen J, et al. Pointguard TM: protecting pointers from buffer overflow vulnerabilities[C]/Proceedings of the 12th conference on USENIX Security Symposium. 2003, 12: 91-104.

[7] Chen P, Xiao H, Shen X, et al. DROP: Detecting return-oriented programming malicious code[M]/Information Systems Security. Springer Berlin Heidelberg, 2009: 163-177.

DOI: 10.1007/978-3-642-10772-6_13

[8] Kayaalp M, Schmitt T, Nomani J, et al. SCRAP: Architecture for Signature-Based Protection from Code Reuse Attacks[J].

DOI: 10.1109/hpca.2013.6522324

[9] Kayaalp M, Ozsoy M, Abu-Ghazaleh N, et al. Branch Regulation: Low-overhead protection from code reuse attacks[C]/Computer Architecture (ISCA), 2012 39th Annual International Symposium on. IEEE, 2012: 94-105.

DOI: 10.1109/isca.2012.6237009

[10] Bletsch T, Jiang X, Freeh V W, et al. Jump-oriented programming: a new class of code-reuse attack[C]/Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security. ACM, 2011: 30-40.

DOI: 10.1145/1966913.1966919

[11] Jacobson E R, Bernat A R, Williams W R, et al. Preventing Code Reuse Attacks with a Model of Conformant Program Execution[J].

[12] Pappas V. kBouncer: Efficient and Transparent ROP Mitigation[J]. (2012).

[13] Li J, Wang Z, Jiang X, et al. Defeating return-oriented rootkits with return-less kernels[C]/Proceedings of the 5th European conference on Computer systems. ACM, 2010: 195-208.

DOI: 10.1145/1755913.1755934

[14] Onarlioglu K, Bilge L, Lanzi A, et al. G-Free: defeating return-oriented programming through gadget-less binaries[C]/Proceedings of the 26th Annual Computer Security Applications Conference. ACM, 2010: 49-58.

DOI: 10.1145/1920261.1920269

[15] Pappas V, Polychronakis M, Keromytis A D. Smashing the gadgets: Hindering return-oriented programming using in-place code randomization[C]/Security and Privacy (SP), 2012 IEEE Symposium on. IEEE, 2012: 601-615.

DOI: 10.1109/sp.2012.41

[16] Team PaX. PaX non-executable pages design & implementation[J]. (2003).

[17] Information on http: /boomerang. sourceforge. net.