ValueGuard: Protection of Native Applications against Data-Only Buffer Overflows

Acker, Steven Van; Nikiforakis, Nick; Philippaerts, Pieter; Younan, Yves; Piessens, Frank

doi:10.1007/978-3-642-17714-9_12

Cited by 17 publications

(10 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…StackGuard is a compiler extension that offers protection against overwriting of return address using canaries. ValueGuard extends the use of canaries to all variables through a source-to-source transformation [3]. All data items are replaced with a pointer to a combination of an equivalent data item and a canary.…”

Section: Prior Workmentioning

confidence: 99%

Stack layout transformation: Towards diversity for securing binary programs

Rodes

2012

2012 34th International Conference on Software Engineering (ICSE)

View full text Add to dashboard Cite

Despite protracted efforts by both researchers and practitioners, security vulnerabilities remain in modern software. Artificial diversity is an effective defense against many types of attack, and one form, address-space randomization, has been widely applied. Present artificial diversity implementations are either coarse-grained or require source code. Because of the widespread use of software of unknown provenance, e.g., libraries, where no source code is provided or available, building diversity into the source code is not always possible. I investigate an approach to stack layout transformation that operates on x86 binary programs, which would allow users to obfuscate vulnerabilities and increase their confidence in the software's dependability. The proposed approach is speculative: the stack frame layout for a function is inferred from the binary and assessed by executing the transformed program. Upon assessment failure, the inferred layout is refined in hopes to better reflect the actual function layout.

show abstract

Section: Prior Workmentioning

confidence: 99%

Stack layout transformation: Towards diversity for securing binary programs

Rodes

2012

2012 34th International Conference on Software Engineering (ICSE)

View full text Add to dashboard Cite

show abstract

“…Unfortunately this meant that an attacker could still perform a successful heap-based buffer overflow as long as a sensitive value in the overflowed object was used before the object was deallocated. Van Acker et al [37] wrap all variables in canary-protected structures, but require access to source code and incur a significant overhead.…”

Section: Canary-based Approachesmentioning

confidence: 99%

HeapSentry: Kernel-Assisted Protection against Heap Overflows

Nikiforakis

Piessens

Joosen

2013

Detection of Intrusions and Malware, and Vulnerability Assessment

Self Cite

View full text Add to dashboard Cite

The last twenty years have witnessed the constant reaction of the security community to memory corruption attacks and the evolution of attacking techniques in order to circumvent the newly-deployed countermeasures. In this evolution, the heap of a process received little attention and thus today, the problem of heap overflows is largely unsolved.In this paper we present HeapSentry, a system designed to detect and stop heap overflow attacks through the cooperation of the memory allocation library of a program and the operating system's kernel. HeapSentry places unique random canaries at the end of each heap object which are later checked by the kernel, before system calls are allowed to proceed. HeapSentry operates on binaries (no source code needed) and has, by design, no false-positives. At the same time, the active involvement of the kernel provides stronger security guarantees than the current state of the art in heap protection mechanisms for a modest performance overhead.

show abstract

“…ProPolice-like countermeasures are widely used in modern operating systems. Variations of the canary-principle have also been proposed to protect a program's heap [24,37] and individual program variables [31].…”

Section: More Defensive Execution Of Unsafe Languagesmentioning

confidence: 99%

Recent Developments in Low-Level Software Security

Agten

Nikiforakis

Strackx

et al. 2012

Information Security Theory and Practice. Security, Privacy and Trust in Computing Systems and Ambient Intelligent Ecosystems

Self Cite

View full text Add to dashboard Cite

Abstract. An important objective for low-level software security research is to develop techniques that make it harder to launch attacks that exploit implementation details of the system under attack. Baltopoulos and Gordon have summarized this as the principle of source-based reasoning for security: security properties of a software system should follow from review of the source code and its source-level semantics, and should not depend on details of the compiler or execution platform.Whether the principle holds -or to what degree -for a particular system depends on the attacker model. If an attacker can only provide input to the program under attack, then the principle holds for any safe programming language. However, for more powerful attackers that can load new native machine code into the system, the principle of sourcebased reasoning typically breaks down completely.In this paper we discuss state-of-the-art approaches for securing code written in C-like languages for both attacker models discussed above, and we highlight some very recent developments in low-level software security that hold the promise to restore source-based reasoning even against attackers that can provide arbitrary machine code to be run in the same process as the program under attack.

show abstract

ValueGuard: Protection of Native Applications against Data-Only Buffer Overflows

Cited by 17 publications

References 19 publications

Stack layout transformation: Towards diversity for securing binary programs

Stack layout transformation: Towards diversity for securing binary programs

HeapSentry: Kernel-Assisted Protection against Heap Overflows

Recent Developments in Low-Level Software Security

Contact Info

Product

Resources

About