Efficient Detection of the Return-Oriented Programming Malicious Code

Chen, Pïng; Xing, Xiao; Han, Hao; Mao, Bing; Xie, Lihua

doi:10.1007/978-3-642-17714-9_11

Cited by 20 publications

(12 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Another mitigation tactic for code reuse attacks is to detect and terminate the attack as it occurs. Examples of these include DROP [11], DynIMA [14], CCFIR [43], CFL [8], ROPdefender [15], [12] and [44]. The dynamic monitoring approach used by these techniques make them unsuitable for our target platform where the processor is already at 96% usage.…”

Section: B Defensesmentioning

confidence: 99%

MAVR: Code Reuse Stealthy Attacks and Mitigation on Unmanned Aerial Vehicles

Habibi¹,

Gupta²,

Carlsony

et al. 2015

2015 IEEE 35th International Conference on Distributed Computing Systems

View full text Add to dashboard Cite

As embedded systems have increased in performance and reliability, their applications have expanded into new domains such as automated drone-based delivery mechanisms. Security of these drones, also referred to as unmanned aerial vehicles (UAVs), is crucial due to their use in many different domains. In this paper, we present a stealthy attack strategy that allows the attacker to change sensor values and modify the UAV navigation path. As the attack is stealthy, the system will continue to execute normally and thus the ground station or other monitoring entities and systems will not be able to detect that an attack is undergoing. With respect to defense, we propose a strategy that combines software and hardware techniques. At software level, we propose a fine grained randomization based approach that modifies the layout of the executable code and hinders code-reuse attack. To strengthen the security of our defense, we leverage a custom hardware platform designed and built by us. The platform isolates the code binary and randomized binary in such a way that the actual code being executed is never exposed for an attacker to analyze. We have implemented a prototype of this defense technique and present results to demonstrate the effectiveness and efficiency of this defense strategy.

show abstract

Section: B Defensesmentioning

confidence: 99%

MAVR: Code Reuse Stealthy Attacks and Mitigation on Unmanned Aerial Vehicles

Habibi¹,

Gupta²,

Carlsony

et al. 2015

2015 IEEE 35th International Conference on Distributed Computing Systems

View full text Add to dashboard Cite

show abstract

“…Our work focuses on eliminating the need to transplant many of these dependencies. Return-oriented programming is a technique from computer security in which malicious software reuse "gadgets" from existing programs to confuse anti-virus software [18,4,5,3]. One key difference in our work is that we do not depend on blueprints of assembly instructions.…”

Section: Related Workmentioning

confidence: 99%

Reusable execution replay: execution record and replay for source code reuse

Armaly

Ferris

McMillan

2014

Companion Proceedings of the 36th International Conference on Software Engineering

View full text Add to dashboard Cite

A key problem during source code reuse is that, to reuse even a small section of code from a program, a programmer must include a huge amount of dependency source code from elsewhere in the same program. These dependencies are notoriously large and complex, and many can only be known at runtime. In this paper, we propose execution record/replay as a solution to this problem. We describe a novel reuse technique that allows programmers to reuse functions from a C or C++ program, by recording the execution of the program and selectively modifying how its functions are replayed. We have implemented our technique and evaluated it in a preliminary study in which two programmers used our tool to complete four tasks over four hours.

show abstract

“…The third approach detects the high frequency of returns resulting from executing a ROP attack [14]. While this approach may prevent basic ROP attacks, code-reuse attacks can avoid return instructions by using indirect jumps, which are also frequently executed by legitimate programs, such as interpreters.…”

Section: Defending Against Code-reuse Attacksmentioning

confidence: 99%

“…New defense mechanisms, such as return-less kernels by Li et al [31] and frequent return detection by Chen et al [14], were proposed to defeat return-oriented programming. The former technique aims to disrupt return-oriented programming by removing all gadgets, while the latter is a runtime technique that has high overheads without direct hardware support.…”

Section: Code-reuse Attacksmentioning

confidence: 99%

See 1 more Smart Citation

Booby trapping software

Crane

Larsen

Brunthaler

et al. 2013

Proceedings of the 2013 New Security Paradigms Workshop

View full text Add to dashboard Cite

Cyber warfare is asymmetric in the current paradigm, with attackers having the high ground over defenders. This asymmetry stems from the situation that attackers have the initiative, while defenders concentrate on passive fortifications. Defenders are constantly patching the newest hole in their defenses and creating taller and thicker walls, without placing guards on those walls to watch for the enemy and react to attacks. Current passive cyber security defenses such as intrusion detection, anti-virus, and hardened software are not sufficient to repel attackers. In fact, in conventional warfare this passivity would be entirely nonsensical, given the available active strategies, such as counterattacks and deception.Based on this observation, we have identified the technique of booby trapping software. This extends the arsenal of weaponry available to defenders with an active technique for directly reacting to attacks. Ultimately, we believe this approach will restore some of the much sought after equilibrium between attackers and defenders in the digital domain.

show abstract

Efficient Detection of the Return-Oriented Programming Malicious Code

Cited by 20 publications

References 13 publications

MAVR: Code Reuse Stealthy Attacks and Mitigation on Unmanned Aerial Vehicles

MAVR: Code Reuse Stealthy Attacks and Mitigation on Unmanned Aerial Vehicles

Reusable execution replay: execution record and replay for source code reuse

Booby trapping software

Contact Info

Product

Resources

About