Booby trapping software

Crane, Stephen; Larsen, Per; Brunthaler, Stefan; Franz, Michael

doi:10.1145/2535813.2535824

Cited by 38 publications

(19 citation statements)

References 39 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Crane et al [20] propose that diversified binaries be "boobytrapped" with code that detects guessing attacks. A booby-trap is an instruction sequence beginning with an unconditional branch past its last instruction so the trap is skipped during normal execution; attempts to execute code at random addresses, however, will eventually trigger the trap.…”

Section: Implementation Disclosurementioning

confidence: 99%

SoK: Automated Software Diversity

Larsen

Homescu

Brunthaler

et al. 2014

2014 IEEE Symposium on Security and Privacy

Self Cite

267

166

View full text Add to dashboard Cite

Abstract-The idea of automatic software diversity is at least two decades old. The deficiencies of currently deployed defenses and the transition to online software distribution (the "App store" model) for traditional and mobile computers has revived the interest in automatic software diversity. Consequently, the literature on diversity grew by more than two dozen papers since 2008.Diversity offers several unique properties. Unlike other defenses, it introduces uncertainty in the target. Precise knowledge of the target software provides the underpinning for a wide range of attacks. This makes diversity a broad rather than narrowly focused defense mechanism. Second, diversity offers probabilistic protection similar to cryptography-attacks may succeed by chance so implementations must offer high entropy. Finally, the design space of diversifying program transformations is large. As a result, researchers have proposed multiple approaches to software diversity that vary with respect to threat models, security, performance, and practicality.In this paper, we systematically study the state-of-the-art in software diversity and highlight fundamental trade-offs between fully automated approaches. We also point to open areas and unresolved challenges. These include "hybrid solutions", error reporting, patching, and implementation disclosure attacks on diversified software. I. MOTIVATIONAs modern society grows increasingly dependent on the digital domain, adversaries abound in cyberspace. In spite of the combined efforts of the security community, reports of major software vulnerabilities that put millions of users at risk continue to be the norm rather than the exception.Whereas diversity provides protection and resilience in nature, the commoditization of the computer systems has made them increasingly homogeneous with respect to hardware, operating systems, applications, and everything in between. Homogeneity and standardization provide economies of scale, consistent behavior, and simplify the logistics of distributing programs. We therefore live in a software mono-culture.Unfortunately, homogeneity has turned out to be a doubleedged sword [26]. An attacker can readily download an identical copy of the commodity software running on their victims' systems and probe it for vulnerabilities. After turning a vulnerability into an exploit, the attacker can target all systems running copies of the vulnerable program. In other words, the software mono-culture creates economies of scale for attackers, too.Artificial software diversity aims to increase the cost to attackers by randomizing implementation aspects of programs. This forces attackers to target each system individually, substantially raising the bar on mass scale exploitation. Without knowledge of the program implementation hosted on a particular system, targeted attacks become significantly harder, too.The idea of protecting programs with artificially generated diversity is at least two decades old [13]. However, compilerbased software diversity has only recently beco...

show abstract

Section: Implementation Disclosurementioning

confidence: 99%

SoK: Automated Software Diversity

Larsen

Homescu

Brunthaler

et al. 2014

2014 IEEE Symposium on Security and Privacy

Self Cite

267

166

View full text Add to dashboard Cite

show abstract

“…Section 5.3 elaborates on this step. Second, we insert booby trap entries [10] in the xvtables. We also insert booby traps into the PLT during linking.…”

Section: Overviewmentioning

confidence: 99%

“…Researchers have shown that brute-force attacks can bypass diversity, especially in services that automatically restart without rerandomization after crashing [6,15,33,34]. We use software booby traps to counter this threat [10]. The idea is that booby traps lie dormant during normal program operation but are likely triggered by adversarial probing.…”

Section: Countering Guessing Attacksmentioning

confidence: 99%

It's a TRaP

Crane

Volckaert

Schuster

et al. 2015

Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security

Self Cite

View full text Add to dashboard Cite

Code-reuse attacks continue to evolve and remain a severe threat to modern software. Recent research has proposed a variety of defenses with differing security, efficiency, and practicality characteristics. Whereas the majority of these solutions focus on specific code-reuse attack variants such as return-oriented programming (ROP), other attack variants that reuse whole functions, such as the classic return-into-libc, have received much less attention. Mitigating function-level code reuse is highly challenging because one needs to distinguish a legitimate call to a function from an illegitimate one. In fact, the recent counterfeit object-oriented programming (COOP) attack demonstrated that the majority of code-reuse defenses can be bypassed by reusing dynamically bound functions, i.e., functions that are accessed through global offset tables and virtual function tables, respectively.In this paper, we first significantly improve and simplify the COOP attack. Based on a strong adversarial model, we then present the design and implementation of a comprehensive code-reuse defense which is resilient against reuse of dynamically-bound functions. In particular, we introduce two novel defense techniques: (i) a practical technique to randomize the layout of tables containing code pointers resilient to memory disclosure and (ii) booby trap insertion to mitigate the threat of brute-force attacks iterating over the randomized tables. Booby traps serve the dual purpose of preventing fault-analysis side channels and ensuring that each table has sufficiently many possible permutations. Our detailed evaluation demonstrates that our approach is secure, effective, and practical. We prevent realistic, COOP-style attacks against the Chromium web browser and report an average overhead of 1.1% on the SPEC CPU2006 benchmarks.

show abstract

“…Because they can use information leakage to locate gadgets in the binaries, just moving the gadgets around is not enough to stop these attacks. The diversifying compiler currently uses booby traps [9] to counter this type of exploit, but we believe that further diversity could also be used to counter this type of attack. BROP depends on the forking mechanism to produce an exact duplicate of the current process, so diversifying when forking would remove this required feature of the attack.…”

Section: Diversificationmentioning

confidence: 99%

Software Profiling Options and Their Effects on Security Based Diversification

Murphy

Larsen

Brunthaler

et al. 2014

Proceedings of the First ACM Workshop on Moving Target Defense

Self Cite

View full text Add to dashboard Cite

Imparting diversity to binaries by inserting garbage instructions is an e↵ective defense against code-reuse attacks. Relocating and breaking up code gadgets removes an attacker's ability to craft attacks by merely studying the existing code on their own computer. Unfortunately, inserting garbage instructions also slows down program execution. The use of profiling enables optimizations that alleviate much of this overhead, while still maintaining the high level of security needed to deter attacks. These optimizations are performed by varying the probability for the insertion of a garbage instruction at any particular location in the binary. The hottest regions of code get the smallest amount of diversification, while the coldest regions get the most diversification.We show that static and dynamic profiling methods both reduce run-time overhead to under 2.5% while preventing over 95% of original gadgets from appearing in any diversified binary. We compare static and dynamic profiling and find that dynamic profiling has a slight performance advantage in a best-case scenario. But we also show that dynamic profiling results can su↵er greatly from bad training input. Additionally, we find that static profiling creates smaller binary files than dynamic profiling, and that the two methods o↵er nearly identical security characteristics.

show abstract

Booby trapping software

Cited by 38 publications

References 39 publications

SoK: Automated Software Diversity

SoK: Automated Software Diversity

It's a TRaP

Software Profiling Options and Their Effects on Security Based Diversification

Contact Info

Product

Resources

About