Control Jujutsu

Evans, Isaac; Long, Fan; Otgonbaatar, Ulziibayar; Shrobe, Howard; Rinard, Martin; Okhravi, Hamed; Sidiroglou-Douskos, Stelios

doi:10.1145/2810103.2813646

Cited by 134 publications

(16 citation statements)

References 48 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this article, we assume software that has memory-corruption vulnerabilities (aligned with similar research [48,57,65,70]), which may be transformed to powerful read and write primitives [73]. The particular software that we are interested in comes in the form of a mixed binary.…”

Section: Threat Modelmentioning

confidence: 99%

See 1 more Smart Citation

Exploiting Mixed Binaries

Papaevripides

Αθανασόπουλος

2021

ACM Trans. Priv. Secur.

View full text Add to dashboard Cite

Unsafe programming systems are still very popular, despite the shortcomings due to several published memory-corruption vulnerabilities. Toward defending memory corruption, compilers have started to employ advanced software hardening such as Control-flow Integrity (CFI) and SafeStack. However, there is a broad interest for realizing compilers that impose memory safety with no heavy runtime support (e.g., garbage collection). Representative examples of this category are Rust and Go, which enforce memory safety primarily statically at compile time. Software hardening and Rust/Go are promising directions for defending memory corruption, albeit combining the two is questionable. In this article, we consider hardened mixed binaries, i.e., machine code that has been produced from different compilers and, in particular, from hardened C/C++ and Rust/Go (e.g., Mozilla Firefox, Dropbox, npm, and Docker). Our analysis is focused on Mozilla Firefox, which outsources significant code to Rust and is open source with known public vulnerabilities (with assigned CVE). Furthermore, we extend our analysis in mixed binaries that leverage Go, and we derive similar results. The attacks explored in this article do not exploit Rust or Go binaries that depend on some legacy (vulnerable) C/C++ code. In contrast, we explore how Rust/Go compiled code can stand as a vehicle for bypassing hardening in C/C++ code. In particular, we discuss CFI and SafeStack, which are available in the latest Clang. Our assessment concludes that CFI can be completely nullified through Rust or Go code by constructing much simpler attacks than state-of-the-art CFI bypasses.

show abstract

Section: Threat Modelmentioning

confidence: 99%

“…Typically, these memory addresses contain control data and the primitives are granted by abusing spatial or temporal safety [73]. Notice, that several papers have employed similar bug functions [48,57,65,70] to demonstrate their attacks.…”

Section: Control-flow Integritymentioning

confidence: 99%

Exploiting Mixed Binaries

Papaevripides

Αθανασόπουλος

2021

ACM Trans. Priv. Secur.

View full text Add to dashboard Cite

show abstract

“…For instance; if arguments are overwritten directly, then that is considered as a data-only attack as it did not require to invade the control-flow for such operation, but if the overwritten data is non-control-data, then it has affected the control-flow. CFB implements fully-precise static CFG which can be undecidable [16]. CFB also violates certain functions at a high level and execution of such functions likely to alter the return address and corrupt control-flow [29].…”

Section: Control-flow Bending: On the Effectiveness Of Cfi (Cfb)mentioning

confidence: 99%

“…Beside that, Kernel CFI is able to build a minimal challenge to defend against ROP based attacks [33]. Table 3 also shows that IFCC is unable to mitigate control-flow exploitation and can be by-passable by control-flow attack [16]. Though CFB enhances strong CFI enforcement by imposing shadow stack.…”

Section: Software-based Cfimentioning

confidence: 99%

On the Effectiveness of Control-Flow Integrity Against Modern Attack Techniques

Sayeed

Marco-Gisbert

2019

IFIP Advances in Information and Communication Technology

View full text Add to dashboard Cite

Memory error vulnerabilities are still widely exploited by attackers despite the various protections developed. Attackers have adopted new strategies to successfully exploit well-known memory errors bypassing mature protection techniques such us the NX, SSP, and ASLR. Those attacks compromise the execution flow to gain control over the target successfully. Control-flow Integrity (CFI) is a protection technique that aims to eradicate memory error exploitation by ensuring that the instruction pointer (IP) of a running program cannot be controlled by a malicious attacker. In this paper, we assess the effectiveness of 14 CFI techniques against the most popular exploitation techniques including code reuse attacks, return-to-user, return-to-libc and replay attacks. Surveys are conducted to classify those 14 CFI techniques based on the security robustness and implementation feasibility. Our study indicates that the majority of the CFI techniques are primarily focused on restricting indirect branch instructions and cannot prevent all forms of vulnerability exploitation. Moreover, we show that the overhead and implementation requirement make some CFI techniques impractical. We conclude that the effort required to have those techniques in real systems, the high overhead, and also the partial attack coverage is discouraging the industry from adopting CFI protections.

show abstract

“…This attack [17] doesn't aim to create indirections inside the program in a way to give the attacker Turing complete capabilities, instead, it shows that programs usually have calls that, by corrupting them alone is enough to achieve what is desired. The paper proposes an attack on an Apache server protected by CFI which only corrupts one edge from a log function to make a system call that invokes the command shell to the attacker.…”

Section: Control-flow Jujutsumentioning

confidence: 99%

Including the dynamic context of execution to improve CFI policies evaluation

Terra Delboni

View full text Add to dashboard Cite

Programas desenvolvidos em linguagem de nível intermediário (como C e C++) são vulneráveis a ataques conhecidos como Sequestro de Fluxo de Controle (CFH). Esses ataques usam pequenas vulnerabilidades de memória para corromper um programa e permitir o atacante a executar instruções arbitrárias. Bloquear CFH atualmente exige que o programa seja desenvolvido usando ferramentas específicas que garantam que não será possível corromper a memória de dados, o que não é prático para códigos já existentes. Nesses casos, o ataque pode apenas ser mitigado. Entre as soluções mais populares está Integridade de Fluxo de Controle (CFI), porém diferentes implementações de CFI possuem eficiência diferente em relação a segurança oferecida. Os atuais avanços para CFI dependem de comparar as diferentes implementações para escolher a melhor e de melhorar as implementações já existentes.Nessa tese será explorado o contexto dinâmico de execução como parâmetro para comparar as implementações de CFI. Isso vai permitir um melhor entendimento de o quão protegida estão as áreas de mais fácil acesso para o atacante. Será proposto uma forma de alterar as implementações já existentes que foca em proteger essas regiões. A pesquisa será validada por experimentos onde atualiza-se uma solução chamada KCFI, que foi a primeira proposta de CFI capaz de proteger o kernel Linux. A atualização nos permite extrair o contexto dinâmico de execução, calcular as métricas propostas e aplicar as mudanças que protegem focam em proteger as zonas mais acessíveis aos atacantes.

show abstract

Control Jujutsu

Cited by 134 publications

References 48 publications

Exploiting Mixed Binaries

Exploiting Mixed Binaries

On the Effectiveness of Control-Flow Integrity Against Modern Attack Techniques

Including the dynamic context of execution to improve CFI policies evaluation

Contact Info

Product

Resources

About