Hardware-Assisted Fine-Grained Code-Reuse Attack Detection

Hardware-Assisted Fine-Grained Code-Reuse Attack Detection

Code-reuse attacks have become the primary exploitation technique for system compromise despite of the recently introduced Data Execution Prevention technique in modern platforms. Different from code injection attacks, they result in unintended control-flow transfer to victim programs without adding...

Full description

Saved in:
Bibliographic Details
Main Authors: YUAN, Pinghai, ZENG, Qingkai, DING, Xuhua
Format: text
Language:English
Published: Institutional Knowledge at Singapore Management University 2015
Subjects:
Code-reuse attack
Control flow integrity
Indirect branch tracing
Computer Sciences
Information Security
Online Access:https://ink.library.smu.edu.sg/sis_research/3116
Tags: Add Tag
No Tags, Be the first to tag this record!
Institution: Singapore Management University
Language: English
Description
Summary:Code-reuse attacks have become the primary exploitation technique for system compromise despite of the recently introduced Data Execution Prevention technique in modern platforms. Different from code injection attacks, they result in unintended control-flow transfer to victim programs without adding malicious code. This paper proposes a practical scheme named as CFIGuard to detect code-reuse attacks on user space applications. CFIGuard traces every branch execution by leveraging hardware features of commodity processors, and then validates the traces based on fine-grained control flow graphs. We have implemented a prototype of CFIGuard on Linux and the experiments show that it only incurs around 2.9 % runtime overhead for a set of typical server applications.

Similar Items