SaTC: CORE: Small: New Defenses for Data-Only Attacks

保护软件系统免受可能窃取敏感数据、提升权限甚至在远程系统上执行任意代码的内存篡改攻击至关重要。然而，大多数现有的防御机制只专注于控制数据攻击(例如，控制劫持)，而不能防御仅针对数据的攻击，例如心脏出血，这些攻击只会篡改程序的数据流。一旦控制流完整性等控制流防御措施得到广泛部署，纯数据攻击将变得常见。这个项目将研究新的、原则性的解决方案，以在实践中以可接受的开销部署纯数据攻击。该项目的技术目标分为两个方面。第一个推力开发了一种新的编译器分析和运行时方法，用于确保跨源数据流完整性(X-DFI)，它可以有效地防御通过一个或多个入口点感染受害者系统的真实世界攻击，例如，读取外部数据的函数或由攻击者控制的事件处理程序。通过将这些入口点建模为单独的来源，X-DFI可以通过利用缓冲区溢出或悬挂指针等内存漏洞，防止来自恶意来源的攻击访问属于无辜来源的数据。第二个推力是开发指针算术完整性(PAI)，它可以进一步减少运行时开销，并通过确保内存不安全语言(如C/C)中指针算法的安全性来应对同一来源内的攻击。确保PAI是轻量级的，因为涉及算术的指针通常只占程序中所有指针的一小部分。通过自动化编译器和轻量级运行时技术来共同实施X-DFI和PAI，该项目旨在保护大型复杂软件免受仅数据攻击，而不需要对源代码进行任何更改，没有误报，并且性能开销最小。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

It is critical to defend software systems against memory-tampering attacks that can steal sensitive data, escalate privilege, or even execute arbitrary code on a remote system. However, most existing defense mechanisms have focused only on control-data attacks (e.g., control- hijacking), but cannot defend data-only attacks such as Heartbleed, which only tamper with the program's data flow. Data-only attacks will become common once control-flow defenses such as control-flow integrity are widely deployed. This project will investigate new, principled solutions to data-only attacks with acceptable overhead for deployment in practice.The technical aims of the project are divided into two thrusts. The first thrust develops a novel compiler analysis and a runtime approach for ensuring cross-origin data flow integrity (X-DFI), which can effectively defend real-world attacks that infect the victim system through one or more ingress points, e.g., a function that reads external data or an event handler for events controlled by attackers. By modeling each of these ingress points as a separate origin, X-DFI can prevent attacks from malicious origins from accessing data belonging to innocent origins through exploiting memory vulnerabilities such as buffer overflows or dangling pointers. The second thrust develops pointer-arithmetic integrity (PAI), which can further reduce the runtime overhead and to also deal with attacks within the same origin through ensuring the safety of pointer arithmetics in memory unsafe languages such as C/C++. Ensuring PAI is lightweight since pointers that involve arithmetics typically account for only a small fraction of all pointers in the program. Through automated compiler and lightweight runtime techniques to enforce X-DFI and PAI together, the project aims to secure large complex software against data-only attacks without requiring any change to the source code, with no false positives, and with minimal performance overhead.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.