Countering code-injection attacks with instruction-set randomization

Abstract

We describe a new, general approach for safeguarding systems against any type of code-injection attack. We apply Kerckhoff's principle, by creating process-specific randomized instruction sets (e.g., machine instructions) of the system executing potentially vulnerable software. An attacker who does not know the key to the randomization algorithm will inject code that is invalid for that randomized processor, causing a runtime exception. To determine the difficulty of integrating support for the proposed mechanism in the operating system, we modified the Linux kernel, the GNU binutils tools, and the bochs-x86 emulator. Although the performance penalty is significant, our prototype demonstrates the feasibility of the approach, and should be directly usable on a suitable-modified processor (e.g., the Transmeta Crusoe).Our approach is equally applicable against code-injecting attacks in scripting and interpreted languages, e.g., web-based SQL injection. We demonstrate this by modifying the Perl interpreter to permit randomized script execution. The performance penalty in this case is minimal. Where our proposed approach is feasible (i.e., in an emulated environment, in the presence of programmable or specialized hardware, or in interpreted languages), it can serve as a low-overhead protection mechanism, and can easily complement other mechanisms.

Design and implementation of instruction indirection for embedded software obfuscation

“…Compared to robust but costly modern ciphers, most of them are based on simple substitution ciphers for lower overhead. Both hardware [5,7,8] and software [3,4,6] implementations have been studied. Some methods utilize the characteristics of the target instruction set [5] .…”

“…• encryption of the machine codes to make them meaningless without a hidden key [1,2] , • obstruction of disassembly by confusing disassemblers or preventing them from accessing necessary information about the instructions [3][4][5][6][7][8][9][10] , and Instruction set randomization (ISR) [3][4][5][6][7][8] is an approach to protect software by obstructing disassembly, where each processor (or group of processors) has a different instruction set. Software is protected from analysis or plagiarism by different or additional instruction coding system that is hidden from attackers.…”

An efficient and easily deployable method for dealing with DoS in SIP services

“…Randomization was introduced in works [41,42] for defending against zero-day attacks. A similar approach can be followed for data anonymization.…”

Filter-resistant code injection on ARM

“…Some aim to prevent the vulnerability from becoming exploitable by verifying that an exploitation attempt has occurred: via bounds checking [21,34,48]; by inserting secret cookies, which must remain unmodified, before important memory locations [14,18]. Others will make it harder for an attacker to execute injected code by randomizing the base address of memory regions [7,9], encrypting pointers [13], code [5,22] or even all objects [8] while in memory and decrypting them before use. While yet other types of countermeasures will try and ensure that the program adheres to some predetermined policy [1,23,30].…”