안드로이드 애플리케이션 환경에서 CFI 우회 공격기법 연구
A Study of Attacks to Bypass CFI on Android Application Environment
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
CFI(Control Flow Integrity)는 제어 흐름을 검증해 프로그램을 보호하는 기법이다. 안드로이드 환경에서 애플리케이션 보호를 위해 LLVM Clang 컴파일러가 지원하는 CFI 기법인 IFCC(Indirect Function CallChecks)와 SCS(Shadow Call Stack)이 도입되었다. IFCC가 함수 호출, SCS이 함수 복귀 시 제어 흐름을 보호한다. 본 논문에서는 IFCC, SCS을 적용한 애플리케이션 환경에서 CFI 우회 공격기법을 제안한다. 사용자 애플리케이션에 IFCC, SCS을 적용하여도 애플리케이션 메모리 내 IFCC, SCS으로 보호되지 않은 코드 영역이 다수존재하는 것을 확인하였다. 해당 코드 영역에서 공격을 위한 코드를 실행해 1) IFCC로 보호된 함수 우회 호출 기법, 2) SCS 우회를 통한 복귀 주소 변조 기법을 구성한다. 안드로이드10 QP1A. 191005.007.A3 환경에서IFCC, SCS으로 보호되지 않은 코드 영역을 식별하고 개념 증명(proof-of-concept) 공격을 구현해 IFCC, SCS이 적용된 환경에서 제어 흐름 변조가 가능함을 보인다.
Abstract
CFI(Control Flow Integrity) is a mitigation mechanism that protects programs by verifying control flows. IFCC(IndirectFunction Call Checks) and SCS(Shadow Call Stack), CFI supported by LLVM Clang compiler, were introduced to protectapplications in Android. IFCC protects function calls and SCS protects function returns. In this paper, we propose attacks tobypass CFI on the application environment with IFCC and SCS. Even if IFCC and SCS were applied to user applications,it was confirmed that there were many code segments not protected by IFCC and SCS in the application memory. Weexecute code in CFI unprotected segments to construct 1) bypassing IFCC to call a protected function, 2) modulating returnaddress via SCS bypass. We identify code segments not protected by IFCC and SCS in Android10 QP1A. 191005.007.A3. We also implement proof-of-concept exploits to demonstrate that modulation of control flow is possible in an environmentwhere IFCC and SCS are applied.
참고문헌 (22)
- L. Szekeres, "Sok: eternal war in memory", Proc. of the IEEE Symposium on Security and Privacy, pp.48~62 (2013)
- N. Burow, "Control-flow integrity: precision, security, and performance", ACM Computing Surveys, pp.1~33 (2017)
- M. Abadi, "Control-flow integrity principles, implementations, and applications", ACM Transactions on Information and System Security, pp.1~40 (2009)
- J. Seo, "SGX-shield: enabling address space layout randomization for SGX programs", Proc. of the Network and Distributed Systems Security Symposium (2017)
- S. Jeong, "A CFI countermeasure against GOT overwrite attacks", IEEE Access, pp.36267~36280 (2020)
- A. Biondo, "Back to the epilogue: evading control flow guard via unaligned targets", Proc. of the Network and Distributed Systems Security Symposium (2018)
- C. Tice, "Enforcing forward-edge control-flow integrity in {GCC} & {LLVM}", Proc. of 23rd USENIX Security Symposium, pp.941~955 (2014)
- T. Nguyen, "Detecting repackaged android applications using perceptual hashing", Proc. of the 53rd Hawaii International Conference on System Sciences, pp.6641~6650 (2020)
- E. M. Koruyeh, "SPECCFI:mitigating spectre attacks using CFI informed speculation", Proc. of the IEEE Symposium on Security and Privacy, pp.39~53 (2020)
- "ShadowCallStack" (2019)[URL]
- "Cross-DSO" (2019)[URL]
- "ShadowCall Stack" (2019)[URL]
- N. Carlini, "Control-flow bending: on the effectiveness of control-flow integrity", Proc. of 24th USENIX Security Symposium, pp.161~176 (2015)
- V. Parikh, "ASLR and ROP attack mitigations for ARM-based android devices", International Symposium on Security in Computing and Communication, pp.350~363 (2017)
- T. Saito, "A survey of prevention", mitigation against memory corruption attacks, 2016, 500~505
- J. Xu, "Automatic diagnosis and response to memory corruption vulnerabilities", Proc. of the 12th ACM conference on Computer and communications security, pp.223~234 (2005)
- "gadget" (2019)[URL]
- B. Lee, "From zygote to morula: fortifying weakened aslr on android", Proc. of the IEEE Symposium on Security and Privacy, pp.424~439 (2014)
- M. Conti, "Losing control: on the effectiveness of control-flow integrity under stack attacks", Proc. of the 22nd ACM SIGSAC Conference on Computer and Communications Security, pp.952~963 (2015)
- N. Carlini, "{ROP} is still dangerous: breaking modern defenses", Proc. of 23rd USENIX Security Symposium, pp.385~399 (2014)
- L. Davi, "Stitching the gadgets: on the ineffectiveness of coarse-grained control-flow integrity protection", Proc. of 23rd USENIX Security Symposium, pp.401~416 (2014)
- I. Evans, "Control jujutsu: on the weaknesses of fine-grained control flow integrity", Proc. of the 22nd ACM SIGSAC Conference on Computer and Communications Security, pp.901~913 (2015)