The Dynamic Buffer Overflow Detection and Prevent ion Tool for Yindows Executables Using Binary Rewr iting

Park, Seon-Ho; Han, Yunghsiang S.; Hong, Soonjwa; Kim, Hyoung‐Chun; Chung, Tai-Myoung

doi:10.1109/icact.2007.358715

Cited by 8 publications

(13 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A contigu- ous stack buffer overflow would overwrite the stack canary, which is checked for intactness before the RETs of vulnerable functions [50]. Shadow stacks are sometimes argued to be a type of stack canary: instead of checking whether an added canary value has been corrupted, the return addresses (and sometimes the saved frame pointers) are used as canaries [8,39]. For completeness, we investigated the overhead of stack canaries.…”

Section: Stack Canariesmentioning

confidence: 99%

The Performance Cost of Shadow Stacks and Stack Canaries

Dang

Maniatis

Wagner

2015

Proceedings of the 10th ACM Symposium on Information, Computer and Communications Security

172

View full text Add to dashboard Cite

Control flow defenses against ROP either use strict, expensive, but strong protection against redirected RET instructions with shadow stacks, or much faster but weaker protections without. In this work we study the inherent overheads of shadow stack schemes. We find that the overhead is roughly 10% for a traditional shadow stack. We then design a new scheme, the parallel shadow stack, and show that its performance cost is significantly less: 3.5%. Our measurements suggest it will not be easy to improve performance on current x86 processors further, due to inherent costs associated with RET and memory load/store instructions. We conclude with a discussion of the design decisions in our shadow stack instrumentation, and possible lighter-weight alternatives.

show abstract

Section: Stack Canariesmentioning

confidence: 99%

The Performance Cost of Shadow Stacks and Stack Canaries

Dang

Maniatis

Wagner

2015

Proceedings of the 10th ACM Symposium on Information, Computer and Communications Security

172

View full text Add to dashboard Cite

show abstract

“…Hence, we only focus on those techniques that use Binary Rewriting. We classify them into two groups according to the way they allocate return address stack: (1) static allocation [26,23] and (2) dynamic allocation [25,2]. The first group statically allocates a return address stack like adding a new section called return address stack into Portable Executable (PE) or Executable and Linking Format (ELF) file.…”

Section: Introductionmentioning

confidence: 99%

“…There is a class of techniques [26,34,23,8,25,2,32] which creates a safe area to backup return addresses to prevent stack smashing attacks. The safe area is called private stack, canary stack, or return address repository, etc.…”

Section: Introductionmentioning

confidence: 99%

An enhancement of return address stack for security

Chen

Ting

et al. 2015

Computer Standards & Interfaces

View full text Add to dashboard Cite

“…While these methods and tools are helpful in developing more secure programs, it is impossible to provide a full assurance that all buffer overflows vulnerabilities have been found because of C semantics features (Park et al, 2007). Moreover, such methods are useless when using legacy code and old libraries, which are common practice among software developers.…”

Section: Buffer Overflow Problemmentioning

confidence: 99%

“…However, if the attacker injects an arbitrary attack code in the executable stack area instead of 'A' and overwrite the return address by address of attack code, an attacker can redirect the execution flow of program to the attack code and may gain the control of the whole system. Defending against buffer overflow vulnerabilities and attacks can be classified into four basic approaches (Park et al, 2007): writing correct code, non-executable buffer, array bound checking, and code pointer integrity checking.…”

Section: Buffer Overflow Problemmentioning

confidence: 99%

A software approach for stack memory protection based on duplication and randomisation

Alouneh

Kharbutli

AlQurem

2016

IJITST

View full text Add to dashboard Cite

Abstract:With software systems continuously growing in size and complexity, the number and variety of security vulnerabilities in those systems is increasing in an alarming rate. Unfortunately, all previously proposed solutions that deal with this problem suffer from shortcomings and therefore highlighting the need for further research in this vital area. In this paper, a software-based solution for stack-based vulnerabilities and attacks is proposed, implemented, and tested. The basic idea of our approach is to implement a patch tool that makes multiple copies of the return addresses in the stack, and then randomises the location of all copies in addition to their number. All duplicate copies are updated and checked in parallel such that any mismatch between any of these copies would indicate a possible attack attempt and would trigger an exception. The results of our implementation show high protection against integer overflow and buffer overflow attacks.Keywords: stack-based protection; buffer overflow; security.Reference to this paper should be made as follows: Alouneh, S., Kharbutli, M. and AlQurem, R. (2016) 'A software approach for stack memory protection based on duplication and randomisation', Int.

show abstract

The Dynamic Buffer Overflow Detection and Prevent ion Tool for Yindows Executables Using Binary Rewr iting

Cited by 8 publications

References 2 publications

The Performance Cost of Shadow Stacks and Stack Canaries

The Performance Cost of Shadow Stacks and Stack Canaries

An enhancement of return address stack for security

A software approach for stack memory protection based on duplication and randomisation

Contact Info

Product

Resources

About