SaTC: CORE: Small: New Defenses for Data-Only Attacks

保护软件系统免受内存篡改攻击至关重要，这些攻击可以窃取敏感数据、提升权限，甚至在远程系统上执行任意代码。然而，大多数现有的防御机制只关注控制数据攻击（例如控制劫持），而无法防御诸如Heartbleed之类的仅篡改程序数据流的纯数据攻击。一旦控制流完整性（例如控制流完整性）得到广泛部署，纯数据攻击将变得普遍。该项目将研究针对纯数据攻击的新的原则性解决方案，并在实践中部署可接受的开销。该项目的技术目标分为两个主旨。第一个重点开发了一种新颖的编译器分析和一种运行时方法，以确保跨源数据流完整性（X-DFI），它可以有效地防御通过一个或多个入口点（例如读取外部数据的函数或攻击者控制的事件的事件处理程序）感染受害者系统的现实攻击。通过将每个入口点建模为单独的来源，X-DFI 可以防止恶意来源的攻击通过利用缓冲区溢出或悬空指针等内存漏洞来访问属于无辜来源的数据。第二个重点是开发指针算术完整性（PAI），它可以进一步减少运行时开销，并通过确保内存不安全语言（例如C/C）中指针算术的安全来应对同源攻击。 确保 PAI 是轻量级的，因为涉及算术的指针通常只占程序中所有指针的一小部分。通过自动编译器和轻量级运行时技术来共同实施 X-DFI 和 PAI，该项目旨在确保大型复杂软件免受纯数据攻击，无需对源代码进行任何更改，不会出现误报，并且性能开销最小。该奖项反映了 NSF 的法定使命，并通过使用基金会的智力优点和更广泛的影响审查标准进行评估，被认为值得支持。

It is critical to defend software systems against memory-tampering attacks that can steal sensitive data, escalate privilege, or even execute arbitrary code on a remote system. However, most existing defense mechanisms have focused only on control-data attacks (e.g., control- hijacking), but cannot defend data-only attacks such as Heartbleed, which only tamper with the program's data flow. Data-only attacks will become common once control-flow defenses such as control-flow integrity are widely deployed. This project will investigate new, principled solutions to data-only attacks with acceptable overhead for deployment in practice.The technical aims of the project are divided into two thrusts. The first thrust develops a novel compiler analysis and a runtime approach for ensuring cross-origin data flow integrity (X-DFI), which can effectively defend real-world attacks that infect the victim system through one or more ingress points, e.g., a function that reads external data or an event handler for events controlled by attackers. By modeling each of these ingress points as a separate origin, X-DFI can prevent attacks from malicious origins from accessing data belonging to innocent origins through exploiting memory vulnerabilities such as buffer overflows or dangling pointers. The second thrust develops pointer-arithmetic integrity (PAI), which can further reduce the runtime overhead and to also deal with attacks within the same origin through ensuring the safety of pointer arithmetics in memory unsafe languages such as C/C++. Ensuring PAI is lightweight since pointers that involve arithmetics typically account for only a small fraction of all pointers in the program. Through automated compiler and lightweight runtime techniques to enforce X-DFI and PAI together, the project aims to secure large complex software against data-only attacks without requiring any change to the source code, with no false positives, and with minimal performance overhead.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.