Randomized instruction set emulation

Abstract

Injecting binary code into a running program is a common form of attack. Most defenses employ a "guard the doors" approach, blocking known mechanisms of code injection. Randomized instruction set emulation (RISE) is a complementary method of defense, one that performs a hidden randomization of an application's machine code. If foreign binary code is injected into a program running under RISE, it will not be executable because it will not know the proper randomization. The paper describes and analyzes RISE, describing a proof-of-concept implementation built on the open-source Valgrind IA32-to-IA32 translator. The prototype effectively disrupts binary code injection attacks, without requiring recompilation, linking, or access to application source code. Under RISE, injected code (attacks) essentially executes random code sequences. Empirical studies and a theoretical model are reported which treat the effects of executing random code on two different architectures (IA32 and PowerPC). The paper discusses possible extensions and applications of the RISE technique in other contexts.

Global ISR: Toward a Comprehensive Defense Against Unauthorized Code Execution

“…While this will be generally true, there are a few permutations of injected code that will result in working code that performs the attacker's task. We argue that this number will be statistically insignificant [19], and it is comparable with the probability of creating a valid buffer-overflow exploit using the output of a random number generator as code.…”

“…Barrantes et al [19] performed a study on the faults exhibited by a compromised process running under ISR, and show that such a process executes 5 or less x86 instructions before causing a fatal exception. The instructions that get actually executed are essentially random bytes produced by the de-randomization of the attacker's injected code.…”

“…This capability implies that attackers know what "type" of code (e.g., x86) is understood by the system. This observation led us [17] (and concurrently others [18,19]) to introduce a general approach for preventing code-injection attacks, instruction-set randomization (ISR). Inspired by biology where genetic variation protects organisms from environmental threats, ISR proposes the randomization of the underlying system's instructions, so that "foreign" code introduced within a running process by an attack would fail to execute correctly, regardless of the injection approach.…”

Known/Chosen Key Attacks against Software Instruction Set Randomization

“…The probability of this event is 1 256 , which will require to repeat the attack about 256 times, well inside the acceptable range for bruteforcing without raising alarms in the target system. However, the overall probability of hitting a RET after some non-destructive instructions is even higher, as attested by the Markov-Chain analysis in [2]. After success, a new mask that is not covering real code is created, and the target process continues running, which allows the attacker to steal the mask for this (data) page using the techniques described in section 3.1.2 for tiled mode.…”

“…Randomize the location of the key. This solution, mentioned in [2], in reality requires the randomization of the position of any component that could indirectly lead to the mask address. That includes the table that contains the pointers to the masks, and anything that points to it from stack or heap, so it requires full address space layout randomization (ASLR) rather than just randomizing the key location.…”