Track Conventions, Not Attack Signatures: Fortifying X86 ABI and System Call Interfaces to Mitigate Code Reuse Attacks
Track Conventions, Not Attack Signatures: Fortifying X86 ABI and System Call Interfaces to Mitigate Code Reuse Attacks
复制标题
DOI：
10.1109/seed51797.2021.00029
复制
发表时间：
2021-09
期刊：
影响因子：
--
通讯作者：
Sarp Özdemir;Rutvik Saptarshi;Aravind Prakash;D. Ponomarev
中科院分区：
文献类型：
--
作者：
Sarp Özdemir;Rutvik Saptarshi;Aravind Prakash;D. Ponomarev
代码重用攻击（CRA）是一种危险的利用策略，它允许攻击者在不需要代码注入的情况下，利用现有的应用程序和库代码小工具编写恶意程序。此前，研究人员探索了硬件辅助的保护方案，这些方案可以跟踪攻击签名以识别恶意行为。本文有两个主要贡献。首先，我们表明，以前提出的基于签名的计划是不切实际的，因为他们并不总是区分攻击模式的良性程序的行为。其次，我们证明，而不是跟踪攻击签名，一个更强大的防御机制是跟踪合法使用的系统调用和ABI合规性的硬件，并检测偏离既定的公约可能的攻击。我们提出了两个具体的跟踪机制：系统调用的参数设置和跨函数调用的寄存器使用。我们证明，我们的解决方案严重阻碍了实际的CRA和完全停止代码重用执行敏感的系统调用，如mprotect。我们的解决方案要求非常低的性能开销和适度的设计复杂性。
Code Reuse Attacks (CRAs) are dangerous exploitation strategies that allow attackers to compose malicious programs out of existing application and library code gadgets, without requiring code injection. Previously, researchers explored hardware-assisted protection schemes that track attack signatures to identify malicious behavior. This paper makes two main contributions. First, we show that previously proposed signature-based schemes are impractical because they do not always distinguish attack patterns from the behavior of benign programs. Second, we demonstrate that instead of tracking attack signatures, a more robust defense mechanism is to track legitimate usage of system calls and ABI compliance in hardware, and detect deviations from established conventions as possible attacks. We propose two specific tracking mechanisms: the setting of arguments for system calls and register usage across function calls. We demonstrate that our solution severely hinders practical CRAs and completely stops code-reuse execution of sensitive system calls like mprotect. Our solution imposes very low performance overhead and modest design complexity.