Randomized instruction set emulation to disrupt binary code injection attacks

Abstract

Many remote attacks against computer systems inject binary code into the execution path of a running program, gaining control of the program's behavior. If each defended system or program could use a machine instruction set that was both unique and private, such binary code injection attacks would become extremely difficult if not impossible. A binary-to-binary translator provides an economic and flexible implementation path for realizing that idea. As a proof of concept, we describe a randomized instruction set emulator (RISE) based on the open-source Valgrind x86-to-x86 binary translator. Although currently very slow and memory-intensive, our prototype RISE can indeed disrupt binary code injection attacks against a program without requiring its recompilation, linking, or access to source code. We describe the RISE implementation, give evidence demonstrating that RISE defeats common attacks, consider consequences of the dense x86 instruction set on the method's effects, and discuss limitations of the RISE prototype as well as design tradeoffs and extensions of the underlying idea.

Global ISR: Toward a Comprehensive Defense Against Unauthorized Code Execution

“…They also demonstrate the applicability of the approach on interpreted languages such as Perl, and later SQL [36]. Concurrently, Barrantes et al [18] proposed a similar randomization technique for binaries (RISE), which builds on the Valgrind x86 emulator. RISE provides limited support for shared libraries by creating randomized copies of the libraries for each process.…”

“…This capability implies that attackers know what "type" of code (e.g., x86) is understood by the system. This observation led us [17] (and concurrently others [18,19]) to introduce a general approach for preventing code-injection attacks, instruction-set randomization (ISR). Inspired by biology where genetic variation protects organisms from environmental threats, ISR proposes the randomization of the underlying system's instructions, so that "foreign" code introduced within a running process by an attack would fail to execute correctly, regardless of the injection approach.…”

ValueGuard: Protection of Native Applications against Data-Only Buffer Overflows

“…Memory layout randomizers [34,6,36,8] randomize the layout of memory: by loading the stack and heap at random addresses and by placing random gaps between objects. Instruction set randomizers [5,17] encrypt the instructions while in memory and will decrypt them before execution. While our approach is also probabilistic, it is aimed at protecting locations from non-control-data attacks, while most of the above approaches are aimed at protecting either control data or preventing the attacker from injecting code, neither of which are useful for non-control data attacks.…”

Context Sensitive Anomaly Monitoring of Process Control Flow to Detect Mimicry Attacks and Impossible Paths

“…The second layer of defense is to prevent malicious code from being executed. Prevention methods include instruction set randomization [34,35], non-executable stack and heap pages [8,10], process image randomization [10,13], and stack integrity guarding [4,11]. The third layer of defense attempts to prevent the executing attack code from doing further harm though the system interface.…”

“…The third layer of defense attempts to prevent the executing attack code from doing further harm though the system interface. Existing work at this stage includes anomaly detection [5,6,12,24,25,27], process randomization [2,10,13,28,36], and instruction set randomization [34,35].…”