Evaluating the Effectiveness of Current Anti-ROP Defenses
Evaluating the Effectiveness of Current Anti-ROP Defenses
复制标题
DOI：
10.1007/978-3-319-11379-1_5
复制
发表时间：
2014-09
期刊：
影响因子：
--
通讯作者：
Felix Schuster;Thomas Tendyck;Jannik Pewny;A. Maaß;Martin Steegmanns;Moritz Contag;Thorsten Holz
中科院分区：
文献类型：
--
作者：
Felix Schuster;Thomas Tendyck;Jannik Pewny;A. Maaß;Martin Steegmanns;Moritz Contag;Thorsten Holz
近年来，针对面向返回的编程（ROP）的攻击性技术的许多防御措施已经被开发出来。其中最突出的是KBouncer，ROPecker和ROPGuard，它们都针对遗留的二进制软件，而不需要或只需要最小的二进制代码重写。我们的基本见解是，这三种方法都只分析应用程序控制流中某些事件的有限数量的最近（和即将到来的）分支。因此，对手可以执行虚拟操作以绕过所有采用的反间谍技术。我们表明，在实践中，一般绕过kBouncer，ROPecker和ROPGuard是可能的。在Windows上的kBouncer和ROPGuard的情况下，我们表明，所有需要的代码序列已经可以在一个最小的32位C/C++应用程序的可执行模块中找到一个空的main（）函数。为了证明我们的攻击方法的可行性，我们针对流行应用程序中的最新漏洞实施了几个概念验证漏洞;例如，Windows 8上的Internet Explorer 10。
Recently, many defenses against the offensive technique ofreturn-oriented programming(ROP) have been developed. Prominently among them arekBouncer,ROPecker, andROPGuardwhich all target legacy binary software while requiring no or only minimal binary code rewriting.In this paper, we evaluate the effectiveness of these Anti-ROP defenses. Our basic insight is that all three only analyze a limited number of recent (and upcoming) branches in an application’s control flow on certain events. As a consequence, an adversary can perform dummy operations to bypass all employed heuristics. We show that it is possible to generically bypass kBouncer, ROPecker, and ROPGuard with little extra effort in practice. In the cases of kBouncer and ROPGuard on Windows, we show that all required code sequences can already be found in the executable module of a minimal 32-bit C/C++ application with an empty main() function. To demonstrate the viability of our attack approaches, we implemented several proof-of-concept exploits for recent vulnerabilities in popular applications; e.g., Internet Explorer 10 on Windows 8.