VIPER: Spotting Syscall-Guard Variables for Data-Only Attacks
VIPER: Spotting Syscall-Guard Variables for Data-Only Attacks
复制标题
DOI：
--
复制
发表时间：
2023
期刊：
影响因子：
--
通讯作者：
Hengkai Ye;Song Liu;Zhechang Zhang;Hong Hu
中科院分区：
文献类型：
--
作者：
Hengkai Ye;Song Liu;Zhechang Zhang;Hong Hu
随着控制流保护技术的广泛应用，攻击者很难通过修改函数指针等控制数据来劫持程序控制流。相反，纯数据攻击会破坏对安全至关重要的非控制数据（关键数据），并且可以绕过所有控制流保护来恢复严重的攻击。以前的工作已经探索了各种方法来帮助构建或防止仅数据攻击。但是，没有任何解决方案可以自动检测特定于程序的关键数据。在本文中，我们确定了一类重要的关键数据，系统调用保护变量，并提出了一套解决方案，以可扩展的方式自动检测这些变量。sycall -guard变量决定调用与安全相关的系统调用（sycall），更改它们将允许攻击者从操作系统请求额外的特权。我们提出分支强制，它在执行期间有意地翻转每个条件分支，并检查是否调用了新的与安全相关的系统调用。如果是这样，我们进行数据流分析，以估计通过常见内存错误翻转此类分支的可行性。我们建立了一个工具，V IPER，来实现我们的想法。V IPER成功地从13个程序中检测到34个以前未知的系统调用保护变量。我们在sqlite和v8上构建了四种新的纯数据攻击，它们执行任意命令或删除任意文件。V IPER在5分钟内完成了对大多数程序的分析，显示了它在发现系统调用保护变量方面的实用性。
As control-flow protection techniques are widely deployed, it is difficult for attackers to modify control data, like function pointers, to hijack program control flow. Instead, data-only attacks corrupt security-critical non-control data (critical data), and can bypass all control-flow protections to revive severe attacks. Previous works have explored various methods to help construct or prevent data-only attacks. However, no solution can automatically detect program-specific critical data. In this paper, we identify an important category of critical data, syscall-guard variables , and propose a set of solutions to automatically detect such variables in a scalable manner. Syscall-guard variables determine to invoke security-related system calls (syscalls), and altering them will allow attackers to request extra privileges from the operating system. We propose branch force , which intentionally flips every conditional branch during the execution and checks whether new security-related syscalls are invoked. If so, we conduct data-flow analysis to estimate the feasibility to flip such branches through common memory errors. We build a tool, V IPER , to implement our ideas. V IPER successfully detects 34 previously unknown syscall-guard variables from 13 programs. We build four new data-only attacks on sqlite and v8, which execute arbitrary command or delete arbitrary file. V IPER completes its analysis within five minutes for most programs, showing its practicality for spotting syscall-guard variables.