Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
skip to main content
10.1145/3552326.3587439acmconferencesArticle/Chapter ViewAbstractPublication PageseurosysConference Proceedingsconference-collections
research-article

R2C: AOCR-Resilient Diversity with Reactive and Reflective Camouflage

Published: 08 May 2023 Publication History

Abstract

Address-oblivious code reuse, AOCR for short, poses a substantial security risk, as it remains unchallenged. If neglected, adversaries have a reliable way to attack systems, offering an operational and profitable strategy. AOCR's authors conclude that software diversity cannot mitigate AOCR, because it exposes fundamental limits to diversification.
Reactive and reflective camouflage, or R2C for short, is a full-fledged, LLVM-based defense that thwarts AOCR by combining code and data diversification with reactive capabilities through booby traps. R2C includes optimizations using AVX2 SIMD instructions, compiles complex real-world software, such as browsers, and offers full support of C++. R2C thus proves that AOCR poses no fundamental limits to software diversification, but merely indicates that code diversification without data diversification is a dead end.
An extensive evaluation along multiple dimensions proves the practicality of R2C. We evaluate the impact of our defense on performance, and find that R2C shows low performance impacts on compute-intensive benchmarks (6.6 -- 8.5% geometric mean on SPEC CPU 2017). A security evaluation indicates R2C's resistance against different types of code-reuse attacks.

References

[1]
2022. Chromium. https://www.chromium.org/
[2]
2022. WebKit. https://webkit.org/
[3]
Martín Abadi, Mihai Budiu, Úlfar Erlingsson, and Jay Ligatti. 2005. A Theory of Secure Control Flow. In Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Vol. 3785 LNCS. 111--124.
[4]
Martín Abadi, Mihai Budiu, Úlfar Erlingsson, and Jay Ligatti. 2009. Control-flow integrity principles, implementations, and applications. ACM Transactions on Information and System Security 13, 1 (Oct. 2009), 1--40.
[5]
Misiker Tadesse Aga and Todd Austin. 2019. Smokestack: Thwarting DOP Attacks with Runtime Stack Layout Randomization. In 2019 IEEE/ACM International Symposium on Code Generation and Optimization (CGO). IEEE, 26--36.
[6]
Michael Backes and Stefan Nürnberger. 2014. Oxymoron: Making Fine-Grained Memory Randomization Practical by Allowing Code Sharing. In Proceedings of the 23rd USENIX Conference on Security Symposium (SEC '14). USENIX Association, USA, 433--447.
[7]
Emery D Berger and Benjamin G Zorn. 2006. DieHard: Probabilistic Memory Safety for Unsafe Languages. In Proceedings of the 27th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI '06). Association for Computing Machinery, New York, NY, USA, 158--168.
[8]
Sandeep Bhatkar and R. Sekar. 2008. Data space randomization. In Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), Vol. 5137 LNCS. Springer, Berlin, Heidelberg, 1--22.
[9]
Joe Bialek. 2018. The Evolution of CFI Attacks and Defenses. In OffensiveCon 2018.
[10]
David Bigelow, Thomas Hobson, Robert Rudd, William Streilein, and Hamed Okhravi. 2015. Timely Rerandomization for Mitigating Memory Disclosures. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS '15, Vol. 2015-Octob. ACM Press, New York, New York, USA, 268--279.
[11]
Andrea Bittau, Adam Belay, Ali Mashtizadeh, David Mazières, and Dan Boneh. 2014. Hacking Blind. In 2014 IEEE Symposium on Security and Privacy. IEEE, 227--242.
[12]
Kjell Braden, Stephen Crane, Lucas Davi, Michael Franz, Per Larsen, Christopher Liebchen, and Ahmad-Reza Sadeghi. 2016. Leakage-Resilient Layout Randomization for Mobile Devices. In Proceedings 2016 Network and Distributed System Security Symposium. Internet Society, Reston, VA.
[13]
Danilo Bruschi, Lorenzo Cavallaro, and Andrea Lanzi. 2007. Diversified process replicæ; for defeating memory error exploits. In Conference Proceedings of the IEEE International Performance, Computing, and Communications Conference. 434--441.
[14]
Nathan Burow, Scott A Carr, Joseph Nash, Per Larsen, Michael Franz, Stefan Brunthaler, and Mathias Payer. 2017. Control-Flow Integrity. Comput. Surveys 50, 1 (April 2017), 1--33.
[15]
Nathan Burow, Xinping Zhang, and Mathias Payer. 2019. SoK: Shining Light on Shadow Stacks. In 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 985--999. arXiv:1811.03165
[16]
Cristian Cadar, Periklis Akritidis, Manuel Costa, Jean-Phillipe Martin, and Miguel Castro. 2008. Data Randomization. Technical Report.
[17]
Nicholas Carlini, Antonio Barresi, Mathias Payer, David Wagner, and Thomas R. Gross. 2015. Control-Flow Bending: On the Effectiveness of Control-Flow Integrity. In USENIX Security Symposium. 161--176.
[18]
Scott A Carr and Mathias Payer. 2017. DataShield: Configurable Data Confidentiality and Integrity. In Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security - ASIA CCS '17. ACM Press, New York, New York, USA, 193--204.
[19]
Xi Chen, Herbert Bos, and Cristiano Giuffrida. 2017. CodeArmor: Virtualizing the Code Space to Counter Disclosure Attacks. In Proceedings - 2nd IEEE European Symposium on Security and Privacy, EuroS and P 2017. 514--529.
[20]
Xi Chen, Asia Slowinska, Dennis Andriesse, Herbert Bos, and Cristiano Giuffrida. 2015. StackArmor: Comprehensive Protection from Stack-based Memory Error Vulnerabilities for Binaries.
[21]
Frederick B. Cohen. 1993. Operating system protection through program evolution. Computers and Security 12, 6 (Oct. 1993), 565--584.
[22]
Benjamin Cox and David Evans. 2006. N-Variant Systems: A Secret-less Framework for Security through Diversity. In 15th USENIX Security Symposium (USENIX Security 06). USENIX Association, Vancouver, B.C. Canada.
[23]
Stephen Crane, Michael Franz, Stijn Volckaert, Felix Schuster, Christopher Liebchen, Per Larsen, Lucas Davi, Ahmad-Reza Sadeghi, Thorsten Holz, and Bjorn De Sutter. 2015. It's a TRaP. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS '15. ACM Press, New York, New York, USA, 243--255.
[24]
Stephen Crane, Per Larsen, Stefan Brunthaler, and Michael Franz. 2013. Booby trapping software. In Proceedings of the 2013 workshop on New security paradigms workshop - NSPW '13. ACM Press, New York, New York, USA, 95--106.
[25]
Stephen Crane, Christopher Liebchen, Andrei Homescu, Lucas Davi, Per Larsen, Ahmad-Reza Sadeghi, Stefan Brunthaler, and Michael Franz. 2015. Readactor: Practical Code Randomization Resilient to Memory Disclosure. In 2015 IEEE Symposium on Security and Privacy, Vol. 2015-July. IEEE, 763--780.
[26]
Lucas Davi, Christopher Liebchen, Ahmad-Reza Sadeghi, Kevin Z. Snow, and Fabian Monrose. 2015. Isomeron: Code Randomization Resilient to (Just-In-Time) Return-Oriented Programming. In Proceedings 2015 Network and Distributed System Security Symposium. Internet Society, Reston, VA.
[27]
Isaac Evans, Fan Long, Ulziibayar Otgonbaatar, Howard Shrobe, Martin Rinard, Hamed Okhravi, and Stelios Sidiroglou-Douskos. 2015. Control Jujutsu. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, Vol. 2015-Octob. ACM, New York, NY, USA, 901--913.
[28]
Michael Franz. 2010. E unibus pluram. In Proceedings of the 2010 workshop on New security paradigms - NSPW '10. ACM Press, New York, New York, USA, 7.
[29]
Robert Gawlik and Thorsten Holz. 2014. Towards automated integrity protection of C++ virtual function tables in binary programs. In Proceedings of the 30th Annual Computer Security Applications Conference on - ACSAC '14. ACM Press, New York, New York, USA, 396--405.
[30]
Jason Gionta, William Enck, and Peng Ning. 2015. HideM: Protecting the contents of userspace memory in the face of disclosure vulnerabilities. In CODASPY 2015 - Proceedings of the 5th ACM Conference on Data and Application Security and Privacy. 325--336.
[31]
Enes Göktaş, Benjamin Kollenda, Philipp Koppe, Erik Bosman, Georgios Portokalidis, Thorsten Holz, Herbert Bos, and Cristiano Giuffrida. 2018. Position-Independent Code Reuse: On the Effectiveness of ASLR in the Absence of Information Disclosure. In 2018 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 227--242.
[32]
Enes Göktaş, Kaveh Razavi, Georgios Portokalidis, Herbert Bos, and Cristiano Giuffrida. 2020. Speculative Probing. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. ACM, New York, NY, USA, 1871--1885.
[33]
David Grove and Craig Chambers. 2001. A framework for call graph construction algorithms. ACM Transactions on Programming Languages and Systems 23, 6 (Nov. 2001), 685--746.
[34]
Jason Hiser, Anh Nguyen-Tuong, Michele Co, Matthew Hall, and Jack W. Davidson. 2012. ILR: Where'd my gadgets go?. In Proceedings - IEEE Symposium on Security and Privacy. IEEE, 571--585.
[35]
Andrei Homescu, Stefan Brunthaler, Per Larsen, and Michael Franz. 2013. Librando. In Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security - CCS '13. ACM Press, New York, New York, USA, 993--1004.
[36]
Hong Hu, Shweta Shinde, Sendroiu Adrian, Zheng Leong Chua, PrateekSaxena, and Zhenkai Liang. 2016. Data-Oriented Programming: On the Expressiveness of Non-control Data Attacks. In Proceedings - 2016 IEEE Symposium on Security and Privacy, SP 2016. IEEE, 969--986.
[37]
Intel. 2022. Intel Advanced Vector Extensions. https://www.intel.com/content/dam/develop/external/us/en/documents/36945
[38]
Intel. 2022. Intel CET. https://software.intel.com/content/www/us/en/develop/articles/technical-look-control-flow-enforcement-technology.html
[39]
Todd Jackson, Babak Salamat, Andrei Homescu, Karthikeyan Manivannan, Gregor Wagner, Andreas Gal, Stefan Brunthaler, Christian Wimmer, and Michael Franz. 2011. Compiler-Generated Software Diversity. In Moving Target Defense: Creating Asymmetric Uncertainty for Cyber Threats. Springer, New York, NY, 77--98.
[40]
Yoongu Kim, Ross Daly, Jeremie Kim, Chris Fallin, Ji Hye Lee, Donghyuk Lee, Chris Wilkerson, Konrad Lai, and Onur Mutlu. 2014. Flipping bits in memory without accessing them. ACM SIGARCH Computer Architecture News 42, 3 (10 2014), 361--372.
[41]
Paul Kocher, Jann Horn, Anders Fogh, Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz, and Yuval Yarom. 2019. Spectre Attacks: Exploiting Speculative Execution. In 2019 IEEE Symposium on Security and Privacy (SP), Vol. 2019-May. IEEE, 1--19.
[42]
Hyungjoon Koo, Yaohui Chen, Long Lu, Vasileios P Kemerlis, and Michalis Polychronakis. 2018. Compiler-Assisted Code Randomization. In 2018 IEEE Symposium on Security and Privacy (SP), Vol. 2018-May. IEEE, 461--477.
[43]
Sebastian Krahmer. 2005. x86-64 buffer overflow exploits and the borrowed code chunks exploitation technique. (2005).
[44]
Volodymyr Kuznetsov, Laszlo Szekeres, Mathias Payer, George Candea, R. Sekar, and Dawn Song. 2014. Code-Pointer Integrity. In Proceedings of the 11th USENIX Symposium on Operating Systems Design and Implementation, Vol. 14. 147--163.
[45]
Per Larsen, Andrei Homescu, Stefan Brunthaler, and Michael Franz. 2014. SoK: Automated Software Diversity. In 2014 IEEE Symposium on Security and Privacy. IEEE, 276--291.
[46]
Per Larsen and Ahmad-Reza Sadeghi (Eds.). 2018. The Continuing Arms Race: Code-Reuse Attacks and Defenses. ACM.
[47]
Chris Lattner and Vikram Adve. 2004. LLVM: A compilation framework for lifelong program analysis & transformation. In International Symposium on Code Generation and Optimization, 2004. CGO 2004. IEEE, 75--86.
[48]
Moritz Lipp, Michael Schwarz, Daniel Gruss, Thomas Prescher, Werner Haas, Anders Fogh, Jann Horn, Stefan Mangard, Paul Kocher, Daniel Genkin, Yuval Yarom, and Mike Hamburg. 2018. Meltdown: Reading Kernel Memory from User Space. In 27th USENIX Security Symposium (USENIX Security 18). USENIX Association, Baltimore, MD, 973--990.
[49]
Kangjie Lu, Chengyu Song, Byoungyoung Lee, Simon P. Chung, Taesoo Kim, and Wenke Lee. 2015. ASLR-Guard. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS '15, Vol. 2015-Octob. ACM Press, New York, New York, USA, 280--291.
[50]
Ali Jose Mashtizadeh, Andrea Bittau, Dan Boneh, and David Mazières. 2015. CCFI. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS '15, Vol. 2015-Octob. ACM Press, New York, New York, USA, 941--951.
[51]
Microsoft. 2022. Data Execution Prevention. https://docs.microsoft.com/en-us/windows/win32/memory/data-execution-prevention
[52]
Microsoft. 2022. Microsoft Control Flow Guard. https://docs.microsoft.com/en-us/windows/win32/secbp/control-flow-guard
[53]
Vishwath Mohan, Per Larsen, Stefan Brunthaler, Kevin W Hamlen, and Michael Franz. 2015. Opaque Control-Flow Integrity. In Proceedings 2015 Network and Distributed System Security Symposium. Internet Society, Reston, VA.
[54]
Vasilis Pappas, Michalis Polychronakis, and Angelos D. Keromytis. 2012. Smashing the Gadgets: Hindering Return-Oriented Programming Using In-place Code Randomization. In 2012 IEEE Symposium on Security and Privacy. IEEE, 601--615.
[55]
Mathias Payer, Antonio Barresi, and Thomas R. Gross. 2015. Fine-Grained Control-Flow Integrity Through Binary Hardening. In Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Vol. 9148. Springer Verlag, 144--164.
[56]
Marios Pomonis, Theofilos Petsios, Angelos D. Keromytis, Michalis Polychronakis, and Vasileios P. Kemerlis. 2017. kR^X: Comprehensive Kernel Protection against Just-In-Time Code Reuse. In Proceedings of the Twelfth European Conference on Computer Systems (Belgrade, Serbia) (EuroSys '17). Association for Computing Machinery, New York, NY, USA, 420--436.
[57]
Aravind Prakash, Xunchao Hu, and Heng Yin. 2015. vfGuard: Strict Protection for Virtual Function Calls in COTS C++ Binaries. In Proceedings 2015 Network and Distributed System Security Symposium. Internet Society, Reston, VA.
[58]
Benjamin D. Rodes, Anh Nguyen-Tuong, Jason D. Hiser, John C. Knight, Michele Co, and Jack W. Davidson. 2013. Defense against Stack-Based Attacks Using Speculative Stack Layout Transformation. In Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Vol. 7687 LNCS. Springer Verlag, 308--313.
[59]
Robert Rudd, Richard Skowyra, David Bigelow, Veer Dedhia, Thomas Hobson, Stephen Crane, Christopher Liebchen, Per Larsen, Lucas Davi, Michael Franz, Ahmad-Reza Sadeghi, and Hamed Okhravi. 2017. Address Oblivious Code Reuse: On the Effectiveness of Leakage-Resilient Diversity. In Proceedings 2017 Network and Distributed System Security Symposium. Internet Society, Reston, VA.
[60]
Felix Schuster, Thomas Tendyck, Christopher Liebchen, Lucas Davi, Ahmad-Reza Sadeghi, and Thorsten Holz. 2015. Counterfeit Object-oriented Programming: On the Difficulty of Preventing Code Reuse Attacks in C++ Applications. In 2015 IEEE Symposium on Security and Privacy, Vol. 2015-July. IEEE, 745--762.
[61]
Hovav Shacham. 2007. The geometry of innocent flesh on the bone. In Proceedings of the 14th ACM conference on Computer and communications security - CCS '07, Vol. 22. ACM Press, New York, New York, USA, 552.
[62]
K. Z. Snow, F. Monrose, L. Davi, A. Dmitrienko, C. Liebchen, and A. Sadeghi. 2013. Just-In-Time Code Reuse: On the Effectiveness of Fine-Grained Address Space Layout Randomization. In 2013 IEEE Symposium on Security and Privacy. IEEE, 574--588.
[63]
Alexander Sotirov. 2007. Heap Feng Shui in JavaScript. In Black Hat Europe.
[64]
Adrian Tang, Simha Sethumadhavan, and Salvatore Stolfo. 2015. Heisenbyte. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security - CCS '15, Vol. 2015-Octob. ACM Press, New York, New York, USA, 256--267.
[65]
Caroline Tice, Tom Roeder, Peter Collingbourne, Stephen Checkoway, Úlfar Erlingsson, Luis Lozano, and Geoff Pike. 2014. Enforcing Forward-Edge Control-Flow Integrity in GCC & LLVM. In 23rd USENIX Security Symposium (USENIX Security 14). USENIX Association, San Diego, CA, 941--955.
[66]
Erik van der Kouwe, Gernot Heiser, Dennis Andriesse, Herbert Bos, and Cristiano Giuffrida. 2019. SoK: Benchmarking Flaws in Systems Security. In 2019 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 310--325.
[67]
Victor Van Der Veen, Dennis Andriesse, Enes Göktaş, Ben Gras, Lionel Sambuc, Asia Slowinska, Herbert Bos, and Cristiano Giuffrida. 2015. Practical context-sensitive CFI. In Proceedings of the ACM Conference on Computer and Communications Security, Vol. 2015-Octob. 927--940.
[68]
Victor van der Veen, Enes Göktaş, Moritz Contag, Andre Pawoloski, Xi Chen, Sanjay Rawat, Herbert Bos, Thorsten Holz, Elias Athanasopoulos, and Cristiano Giuffrida. 2016. A Tough Call: Mitigating Advanced Code-Reuse Attacks at the Binary Level. In 2016 IEEE Symposium on Security and Privacy (SP). IEEE, 934--953.
[69]
Stijn Volckaert, Bart Coppens, Alexios Voulimeneas, Andrei Homescu, Per Larsen, Bjorn De Sutter, and Michael Franz. 2016. Secure and Efficient Application Monitoring and Replication. In 2016 USENIX Annual Technical Conference (USENIX ATC 16). USENIX Association, Denver, CO, 167--179. https://www.usenix.org/conference/atc16/technical-sessions/presentation/volckaert
[70]
Alexios Voulimeneas, Dokyung Song, Fabian Parzefall, Yeoul Na, Per Larsen, Michael Franz, and Stijn Volckaert. 2020. Distributed Heterogeneous N-Variant Execution. In Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Vol. 12223 LNCS. Springer, 217--237.
[71]
Robert Wahbe, Steven Lucco, Thomas E Anderson, and Susan L Graham. 1993. Efficient software-based fault isolation. In Proceedings of the fourteenth ACM symposium on Operating systems principles - SOSP '93 (SOSP '93). ACM Press, New York, New York, USA, 203--216.
[72]
Jan Werner, George Baltas, Rob Dallara, Nathan Otterness, Kevin Z Snow, Fabian Monrose, and Michalis Polychronakis. 2016. No-Execute-After-Read. In Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security - ASIA CCS '16. ACM Press, New York, New York, USA, 35--46.
[73]
David Williams-King, Graham Gobieski, Kent Williams-King, James P Blake, Xinhao Yuan, Patrick Colp, Michelle Zheng, Vasileios P Kemerlis, Junfeng Yang, and William Aiello. 2016. Shuffler: Fast and Deployable Continuous Code Re-Randomization. In 12th USENIX Symposium on Operating Systems Design and Implementation (OSDI 16). USENIX Association, Savannah, GA, 367--382.
[74]
Chao Zhang, Chengyu Song, Kevin Zhijie Chen, Zhaofeng Chen, and Dawn Song. 2015. VTint: Protecting Virtual Function Tables' Integrity. In Proceedings 2015 Network and Distributed System Security Symposium. Internet Society, Reston, VA, 8--11.
[75]
Mingwei Zhang and Ravi Sahita. 2018. eXecutable-Only-Memory-Switch (XOM-Switch): Hiding Your Code From Advanced Code Reuse Attacks in One Shot. In Black Hat Asia Briefings (Black Hat Asia).

Index Terms

  1. R2C: AOCR-Resilient Diversity with Reactive and Reflective Camouflage

      Recommendations

      Comments

      Information & Contributors

      Information

      Published In

      cover image ACM Conferences
      EuroSys '23: Proceedings of the Eighteenth European Conference on Computer Systems
      May 2023
      910 pages
      ISBN:9781450394871
      DOI:10.1145/3552326
      Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

      Sponsors

      Publisher

      Association for Computing Machinery

      New York, NY, United States

      Publication History

      Published: 08 May 2023

      Permissions

      Request permissions for this article.

      Check for updates

      Badges

      Author Tags

      1. language-based security
      2. software diversity
      3. booby traps
      4. booby-trapped pointers
      5. reactive defenses
      6. code-reuse attacks
      7. address-oblivious code reuse
      8. position-independent code reuse
      9. randomization-based defenses

      Qualifiers

      • Research-article

      Conference

      EuroSys '23
      Sponsor:

      Acceptance Rates

      Overall Acceptance Rate 241 of 1,308 submissions, 18%

      Upcoming Conference

      EuroSys '25
      Twentieth European Conference on Computer Systems
      March 30 - April 3, 2025
      Rotterdam , Netherlands

      Contributors

      Other Metrics

      Bibliometrics & Citations

      Bibliometrics

      Article Metrics

      • 0
        Total Citations
      • 191
        Total Downloads
      • Downloads (Last 12 months)52
      • Downloads (Last 6 weeks)3
      Reflects downloads up to 12 Jan 2025

      Other Metrics

      Citations

      View Options

      Login options

      View options

      PDF

      View or Download as a PDF file.

      PDF

      eReader

      View online with eReader.

      eReader

      Media

      Figures

      Other

      Tables

      Share

      Share

      Share this Publication link

      Share on social media