SOFIA : software and control flow integrity architecture

Microprocessors used in safety-critical systems are extremely sensitive to software vulnerabilities, as their failure can lead to injury, damage to equipment, or environmental catastrophe. This paper proposes a hardware-based security architecture for microprocessors used in safety-critical systems. The proposed architecture provides protection against code injection and code reuse attacks. It has mechanisms to protect software integrity, perform control flow integrity, prevent execution of tampered code, and enforce copyright protection. We are the first to propose a mechanism to enforce control flow integrity at the finest possible granularity. The proposed architectural features were added to the LEON3 open source soft microprocessor, and were evaluated on an FPGA running a software benchmark. The results show that the hardware area is 28.2% larger and the clock is 84.6% slower, while the software benchmark has a cycle overhead of 13.7% and a total execution time overhead of 110% when compared to an unmodified processor

Preventing Buffer Overflows with Binary Rewriting

Buffer overflows are the single largest cause of security attacks in recent times. Attacks based on this vulnerability have been the subject of extensive research and a significant number of defenses have been proposed for dealing with attacks of this nature. However, despite this extensive research, buffer overflows continue to be exploited due to the fact that many defenses proposed in prior research provide only partial coverage and attackers have adopted to exploit problems that are not well defended. The fact that many legacy binaries are still deployed in production environments also contributes to the success of buffer overflow attacks since most, if not all, buffer overflow defenses are source level defenses which require an application to be re-compiled. For many legacy applications, this may not be possible since the source code may no longer be available. In this thesis, we present an implementation of a defense mechanism for defending against various attack forms due to buffer overflows using binary rewriting. We study various attacks that happen in the real world and present techniques that can be employed within a binary rewriter to protect a binary from these attacks. Binary rewriting is a nascent field and little research has been done regarding the applications of binary rewriting. In particular, there is great potential for applications of binary rewriting in software security. With a binary rewriter, a vulnerable application can be immediately secured without the need for access to it's source code which allows legacy binaries to be secured. Also, numerous attacks on application software assume that application binaries are laid out in certain ways or have certain characteristics. Our defense scheme implemented using binary rewriting technology can prevent many of these attacks. We demonstrate the effectiveness of our scheme in preventing many different attack forms based on buffer overflows on both synthetic benchmarks and real-world attacks

Protecting Against Address Space Layout Randomization (ASLR) Compromises and Return-to-Libc Attacks Using Network Intrusion Detection Systems

Writable XOR eXecutable (W XOR X) and Address Space Layout Randomisation (ASLR), have elevated the understanding necessary to perpetrate buffer overflow exploits [1]. However, they have not proved to be a panacea [1] [2] [3] and so other mechanisms such as stack guards and prelinking have been introduced. In this paper we show that host based protection still does not offer a complete solution. To demonstrate, we perform an over the network brute force return-to-libc attack against a pre-forking concurrent server to gain remote access to W XOR X and ASLR. We then demonstrate that deploying a NIDS with appropriate signatures can detect this attack efficiently

Implementing an ISR defense on a MIPS architecture

Code injection attacks are an undeniable threat in today’s cyberworld. Instruction Set Randomization (ISR) was initially proposed in 2003. This technique was designed to protect systems against code injection attacks by creating an unique instruction set for each machine, thanks to randomization. It is a promising technique in the growing embedded system and Internet of Things (IoT) devices ecosystem, where the lack of complex memory management make these devices more vulnerable. However, most of ISR implementations up to day are entirely software based. In this work, we implement hardware support for an ISR defense on an 32 bits, 5 pipeline stages MIPS processor (which is an embedded system compatible architecture). Two obfuscation schemes were implemented, one based on XOR encryption and the other on transposition. The hardware implementation was tested under synthetic code injection attacks and results shows the effectiveness of the defense using both encryption circuits.Sociedad Argentina de Informática e Investigación Operativa (SADIO

Implementing an ISR defense on a MIPS architecture

Code injection attacks are an undeniable threat in today’s cyberworld. Instruction Set Randomization (ISR) was initially proposed in 2003. This technique was designed to protect systems against code injection attacks by creating an unique instruction set for each machine, thanks to randomization. It is a promising technique in the growing embedded system and Internet of Things (IoT) devices ecosystem, where the lack of complex memory management make these devices more vulnerable. However, most of ISR implementations up to day are entirely software based. In this work, we implement hardware support for an ISR defense on an 32 bits, 5 pipeline stages MIPS processor (which is an embedded system compatible architecture). Two obfuscation schemes were implemented, one based on XOR encryption and the other on transposition. The hardware implementation was tested under synthetic code injection attacks and results shows the effectiveness of the defense using both encryption circuits.Sociedad Argentina de Informática e Investigación Operativa (SADIO

Implementing an ISR defense on a MIPS architecture

Code injection attacks are an undeniable threat in today’s cyberworld. Instruction Set Randomization (ISR) was initially proposed in 2003. This technique was designed to protect systems against code injection attacks by creating an unique instruction set for each machine, thanks to randomization. It is a promising technique in the growing embedded system and Internet of Things (IoT) devices ecosystem, where the lack of complex memory management make these devices more vulnerable. However, most of ISR implementations up to day are entirely software based. In this work, we implement hardware support for an ISR defense on an 32 bits, 5 pipeline stages MIPS processor (which is an embedded system compatible architecture). Two obfuscation schemes were implemented, one based on XOR encryption and the other on transposition. The hardware implementation was tested under synthetic code injection attacks and results shows the effectiveness of the defense using both encryption circuits.Sociedad Argentina de Informática e Investigación Operativa (SADIO

Exploring Causes of Performance Overhead During Dynamic Binary Translation

Dynamic Binary Translators (DBT) have applications ranging from program portability, instrumentation, optimizations, and improving software security. To achieve these goals and maintain control over the application's execution, DBTs translate and run the original source/guest programs in a sand-boxed environment. DBT systems apply several optimization techniques like code caching, trace creation, etc. to reduce the translation overhead and enhance program performance at run-time. However, even with these optimizations, DBTs typically impose a significant performance overhead, especially for short-running applications. This performance penalty has restricted the more wide-spread adoption of DBT technology, in spite of its obvious need. The goal of this work is to determine the different factors that contribute to the performance penalty imposed by dynamic binary translators. In this thesis, we describe the experiments that we designed to achieve our goal and report our results and observations. We use a popular and sophisticated DBT, DynamoRio, for our test platform, and employ the industry-standard SPEC CPU2006 benchmarks to capture run-time statistics. Our experiments find that DynamoRio executes a large number of additional instructions when compared to the native application execution. We further measure that this increase in the number of executed instructions is caused by the DBT frequently exiting the code cache to perform various management tasks at run-time, including code translation, indirect branch resolution and trace formation. We also find that the performance loss experienced by the DBT is directly proportional to the number of code cache exits. We will discuss the details on the experiments, results, observations, and analysis in this work

Secure and practical defense against code-injection attacks using software dynamic translation

One of the most common forms of security attacks involves exploiting a vulnerability to inject malicious code into an executing application and then cause the injected code to be executed. A theoretically strong approach to defending against any type of code-injection attack is to create and use a process-specific instruction set that is created by a randomization algorithm. Code injected by an attacker who does not know the randomization key will be invalid for the randomized processor effectively thwarting the attack. This paper describes a secure and efficient implementation of instruction-set randomization (ISR) using software dynamic translation. The paper makes three contributions beyond previous work on ISR. First, we describe an implementation that uses a strong cipher algorithm—the Advanced Encryption Standard (AES), to perform randomization. AES is generally believed to be impervious to known attack methodologies. Second, we demonstrate that ISR using AES can be implemented practically and efficiently (considering both execution time and code size overheads) without requiring special hardware support. The third contribution is that our approach detects malicious code before it is executed. Previous approaches relied on probabilistic arguments that execution of non-randomized foreign code would eventually cause a fault or runtime exception

Global ISR: Toward a Comprehensive Defense Against Unauthorized Code Execution

Instruction-set randomization (ISR) obfuscates the "language" understood by a system to protect against code-injection attacks by presenting an ever-changing target. ISR was originally motivated by code injection through buffer overflow vulnerabilities. However, Stuxnet demonstrated that attackers can exploit other vectors to place malicious binaries into a victim’s filesystem and successfully launch them, bypassing most mechanisms proposed to counter buffer overflows. We propose the holistic adoption of ISR across the software stack, preventing the execution of unauthorized binaries and scripts regardless of their origin. Our approach requires that programs be randomized with different keys during a user-controlled installation, effectively combining the benefits of code whitelisting/signing and runtime program integrity. We discuss how an ISR-enabled environment for binaries can be implemented with little overhead in hardware, and show that higher-overhead software only alternatives are possible. We use Perl and SQL to demonstrate the application of ISR in scripting environments with negligible overhead