Buffer overflow attack mitigation via Trusted Platform Module (TPM)

• Main Authors: Teh, Jia Yew, Samsudin, Khairulmizam, Udzir, Nur Izura, Hashim, Shaiful Jahari
• Format: Article
• Language: English
• Published: IKRAM Education 2014
• Online Access: http://psasir.upm.edu.my/id/eprint/51814/1/Buffer%20overflow%20attack%20mitigation%20via%20Trusted%20Platform%20Module%20%28TPM%29.pdf; http://psasir.upm.edu.my/id/eprint/51814/; http://iukl.edu.my/iukl-research-journal/archives/
• Institution: Universiti Putra Malaysia

As of the date of writing of this paper, we found no effort whatsoever in the employment of Trusted Computing (TC)'s Trusted Platform Module (TPM) security features in Buffer Overflow Attack (BOA) mitigation. Such is despite the extensive application of TPM in providing security based solutions, especially in key exchange protocols deemed to be an integral part of cryptographic solutions. In this paper we propose the use of TPM's Platform Configuration Register (PCR) in the detection and prevention of stack based buffer overflow attacks. Detection is achieved via the integrity validation (of SHA1 hashses) of both return address and call instruction opcodes. Prevention is achieved via encrypting the memory location addresses of both the return and call instruction above using RSA encryption. An exception is raised should integrity violations occur. Based on effectiveness tests conducted, our proposed solution has successfully detected 6 major variants of buffer overflow attacks attempted in conventional application codes, while incurring overheads that pose no major obstacles in the normal, continued operation of conventional application codes.