Language-independent sandboxing of just-in-time compilation and self-modifying code

Ansel, Jason; Marchenko, Petr; Erlingsson, Úlfar; Taylor, Elijah; Chen, Brad; Schuff, Derek L.; Sehr, David; Biffle, Cliff L.; Yee, Bennet

doi:10.1145/1993316.1993540

Cited by 27 publications

(39 citation statements)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…One top priority is to write a verifier (similar to [28]) to remove the compiler from the TCB. Another interesting improvement to our SFI is to support Just-In-Time (JIT) compilation and self-modifying code, which can be done in a way similar to [7]. This is important to support language runtimes for high-level programming languages, e.g., Java and JavaScript.…”

Section: Discussionmentioning

confidence: 99%

To Isolate, or to Share? That is a Question for Intel SGX

Shen

Chen

et al. 2018

EasyChair Preprints

View full text Add to dashboard Cite

One cornerstone of computer security is hardware-based isolation mechanisms, among which an emerging technology named Intel Software Guard Extensions (SGX) offers arguably the strongest security on x86 architecture. Intel SGX enables user-level code to create trusted memory regions named enclaves, which are isolated from the rest of the system, including privileged system software. This strong isolation of SGX, however, forbids sharing any trusted memory between enclaves, making it difficult to implement any features or techniques that must share code or data between enclaves. This dilemma between isolation and sharing is especially challenging to system software for SGX (e.g., library OSes), to which both properties are highly desirable.To resolve the tension between isolation and sharing in system software for SGX, especially library OSes, we propose a singleaddress-space approach, which runs all (user-level) processes and the library OS in a single enclave. This single-enclave architecture enables various memory-sharing features or techniques, thus improving both performance and usability. To enforce inter-process isolation and user-privilege isolation inside the enclave, we design a multi-domain software fault isolation (SFI) scheme, which is unique in its support for two types of domains: 1) data domains, which enable process isolation, and 2) code domains, which enable shared libraries. Our SFI is implemented efficiently by leveraging Intel Memory Protection Extensions (MPX). Experimental results show an average overhead of 10%, thus demonstrating the practicality of our approach.

show abstract

Section: Discussionmentioning

confidence: 99%

To Isolate, or to Share? That is a Question for Intel SGX

Shen

Chen

et al. 2018

EasyChair Preprints

View full text Add to dashboard Cite

show abstract

“…In our future work, we plan to address some of the challenges introduced when supporting applications that allow for just-in-time (JIT) compilation and run-time code relocation [35]. One possibility is to include page hash generation both in software as well as in the hardware root-of-trust as an enrollment process for pages with code modifications.…”

Section: Discussionmentioning

confidence: 99%

“…Thus, if at any instance during the execution of the process, a new executable page is allocated, the hardware monitor will flag an alarm alerting the kernel that the new page does not have any corresponding golden hash. Therefore, our proposed architecture currently limits the support of applications that allow for just-in-time (JIT) compilation and run-time code relocation [35].…”

Section: Dynamically-linked Librariesmentioning

confidence: 99%

Hardware-Based Run-Time Code Integrity in Embedded Devices

2018

View full text Add to dashboard Cite

Attacks on embedded devices are becoming more and more prevalent, primarily due to the extensively increasing plethora of software vulnerabilities. One of the most dangerous types of these attacks targets application code at run-time. Techniques to detect such attacks typically rely on software due to the ease of implementation and integration. However, these techniques are still vulnerable to the same attacks due to their software nature. In this work, we present a novel hardware-assisted run-time code integrity checking technique where we aim to detect if executable code resident in memory is modified at run-time by an adversary. Specifically, a hardware monitor is designed and attached to the device's main memory system. The monitor creates page-based signatures (hashes) of the code running on the system at compile-time and stores them in a secure database. It then checks for the integrity of the code pages at run-time by regenerating the page-based hashes (with data segments zeroed out) and comparing them to the legitimate hashes. The goal is for any modification to the binary of a user-level or kernel-level process that is resident in memory to cause a comparison failure and lead to a kernel interrupt which allows the affected application to halt safely.

show abstract

“…However, like instruction set randomization, we are not aware of any research that shows the implications control flow integrity has on return-oriented programming. Ansel et al [4] optimized the execution of NOP padding in their extension to Native Client.…”

Section: Other Prevention Techniquesmentioning

confidence: 99%

Booby trapping software

Crane

Larsen

Brunthaler

et al. 2013

Proceedings of the 2013 New Security Paradigms Workshop

View full text Add to dashboard Cite

Cyber warfare is asymmetric in the current paradigm, with attackers having the high ground over defenders. This asymmetry stems from the situation that attackers have the initiative, while defenders concentrate on passive fortifications. Defenders are constantly patching the newest hole in their defenses and creating taller and thicker walls, without placing guards on those walls to watch for the enemy and react to attacks. Current passive cyber security defenses such as intrusion detection, anti-virus, and hardened software are not sufficient to repel attackers. In fact, in conventional warfare this passivity would be entirely nonsensical, given the available active strategies, such as counterattacks and deception.Based on this observation, we have identified the technique of booby trapping software. This extends the arsenal of weaponry available to defenders with an active technique for directly reacting to attacks. Ultimately, we believe this approach will restore some of the much sought after equilibrium between attackers and defenders in the digital domain.

show abstract

Language-independent sandboxing of just-in-time compilation and self-modifying code

Cited by 27 publications

References 38 publications

To Isolate, or to Share? That is a Question for Intel SGX

To Isolate, or to Share? That is a Question for Intel SGX

Hardware-Based Run-Time Code Integrity in Embedded Devices

Booby trapping software

Contact Info

Product

Resources

About