Return-Oriented Programming 공격 방어를 위한 간접 분기 목적 주소 검증 기법
Indirect Branch Target Address Verification for Defense against Return-Oriented Programming Attacks
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
Return-Oriented Programming(ROP)는 기존 return-to-libc의 발전된 형태로 프로그램의 코드 영역에 있는 가젯을 조합하여 공격자가 원하는 모든 기능을 수행할 수 있는 코드 재사용 공격 기법이다. ROP 공격을 방어하는 기존 방어 기법들은 동적 실행 흐름 분석으로 인한 높은 성능 부하를 보이거나 ROP 공격에 대한 부분적인 방어만 가능하였다. 본 논문에서 제시하는 간접 분기 목적 주소 검증 기법(Indirect Branch Target Address Verification)은 간접 분기문의 목적 주소가 유효한지 검사해서 ROP 공격을 탐지하며, ROP 공격의 대부분을 방어할 수 있다. 또한 동적 실행 흐름 분석이 필요 없기 때문에 낮은 성능 부담을 보인다. SPEC CPU 2006 벤치마크를 대상으로 한 성능평가에서 15%보다 적은 성능 부하를 보였다.
Abstract
Return-Oriented Programming(ROP) is an advanced code-reuse attack like a return-to-libc attack. ROP attacks combine gadgets in program code area and make functions like a Turing-complete language. Some of previous defense methods against ROP attacks show high performance overhead because of dynamic execution flow analysis and can defend against only certain types of ROP attacks. In this paper, we propose Indirect Branch Target Address Verification (IBTAV). IBTAV detects ROP attacks by checking if target addresses of indirect branches are valid. IBTAV can defends against almost all ROP attacks because it verifies a target address of every indirect branch instruction. Since IBTAV does not require dynamic execution flow analysis, the performance overhead of IBTAV is relatively low. Our evaluation of IBTAV on SPEC CPU 2006 shows less than 15% performance overhead.
참고문헌 (19)
- Roemer, R, "Return-oriented programming: Systems, languages, and applications", ACM Transactions on Information and System Security (TISSEC) (2012), ACM
- "Bypassing non-executable-stack during exploitation using return-to-libc"[URL]
- "i386 W^X"[URL]
- Aleph One, "Smashing The Stack For Fun And Profit", Phrack, 7(49) (1996)
- Abadi, M., "Control-flow integrity principles, implementations, and applications", ACM Trans. Inf. Syst. Secur. (2009), ACM
- Bletsch, T, "Mitigating code-reuse attacks with control-flow locking", Proceedings of the 27th Annual Computer Security Applications Conference, pp.353~362 (2011)
- Zeng, B, "Combining control-flow integrity and static analysis for efficient and validated data sandboxing", Proceedings of the 18th ACM conference on Computer and communications security, pp.29~40 (2011)
- "Introduction to Instrumentation and Tracing"[URL]
- C.-K. Luk, "Pin: Building customized program analysis tools with dynamic instrumentation", Proceedings of PLDI 2005, pp.190~200 (2005), ACM
- Francillon, A., "Defending embedded systems against control flow attacks", Proceedings of the First ACM Workshop on Secure Execution of Untrusted Code, SecuCode 2009, pp.19~26 (2009), ACM
- Davi, L, "ROPdefender: A detection tool to defend against return-oriented programming attacks", Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security, pp.40~51 (2011), ACM
- Chen, P., "DROP : Detecting return-oriented programming malicious code, In Information Systems Security", pp.163~177 (2009), Springer
- Checkoway, S, "Return-oriented programming without returns", Proceedings of the 17th ACM conference on Computer and communications security, pp.559~572 (2010), ACM
- Bletsch, T., "Jump-oriented programming : A new class of code-reuse attack", Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security, pp.30~40 (2011), ACM
- Pappas, V., "Smashing the gadgets: Hindering return-oriented programming using in-place code randomization", Security and Privacy (SP), 2012 IEEE Symposium on, pp.601~615 (2012), IEEE
- Onarlioglu, K., "G-Free : defeating return-oriented programming through gadget-less binaries", Proceedings of the 26th Annual Computer Security Applications Conference, pp.49~68 (2010), USENIX
- "Tools Interface Standards - TIS: Executable and Linkable Format(ELF), version 1.2. Portable formats specications", ~ (1995)
- "Standard performance Evaluation Corporation"[URL]
- "ROPgadget Tool"[URL]