Randezvous: Making Randomization Effective on MCUs
Randezvous: Making Randomization Effective on MCUs
复制标题
DOI：
10.1145/3564625.3567970
复制
发表时间：
2022-12
期刊：
影响因子：
--
通讯作者：
Zhuojia Shen;Komail Dharsee;J. Criswell
中科院分区：
文献类型：
--
作者：
Zhuojia Shen;Komail Dharsee;J. Criswell
诸如自动驾驶汽车传感器，医疗设备和工业网络物理系统之类的设备通常依赖于小的，资源约束的微控制器（MCU）（MCU）。通过远程攻击者启动代码攻击和代码/控制数据泄漏攻击。 - 只有代码方法，在存储器中创建诱饵指针，以堆栈中的代码指针受到多元化的阴影堆栈的保护重新启动机制减慢持续的攻击并通过全球卫队减轻控制数据喷涂攻击。 -World CVE。
Internet-of-Things devices such as autonomous vehicular sensors, medical devices, and industrial cyber-physical systems commonly rely on small, resource-constrained microcontrollers (MCUs). MCU software is typically written in C and is prone to memory safety vulnerabilities that are exploitable by remote attackers to launch code reuse attacks and code/control data leakage attacks. We present Randezvous, a highly performant diversification-based mitigation to such attacks and their brute force variants on ARM MCUs. Atop code/data layout randomization and an efficient execute-only code approach, Randezvous creates decoy pointers to camouflage control data in memory; code pointers in the stack are then protected by a diversified shadow stack, local-to-global variable promotion, and return address nullification. Moreover, Randezvous adds a novel delayed reboot mechanism to slow down persistent attacks and mitigates control data spraying attacks via global guards. We demonstrate Randezvous’s security by statistically modeling leakage-equipped brute force attacks under Randezvous, crafting a proof-of-concept exploit that shows Randezvous’s efficacy, and studying a real-world CVE. Our evaluation of Randezvous shows low overhead on three benchmark suites and two applications.