Modelo Multicamadas para Detecção de Ataques ROP
Resumo
Esse artigo apresenta um sistema de proteção multicamadas para defesa de programas contra ataques de Return-Oriented Programming (ROP). Camadas superiores têm custo computacional baixo; assim, elas não comprometem o tempo de execução de programas que não estão sob ataque. Camadas inferiores proveem garantias muito fortes; assim, elas são difíceis de contornar. Nosso sistema multicamadas combina várias técnicas já descritas na literatura; entretanto, para serem práticas, nós tivemos que estendê-las com uma verificação extra, que consiste em checar se o endereço alvo de uma instrução de chamada de função (call) está em um segmento executável da memória. Nós demonstramos a eficiência da nossa proteção multicamadas em aplicações bancárias de dois dos principais bancos brasileiros: Banco do Brasil e Bradesco. Nossos experimentos nesses dois sistemas e em vários benchmarks populares indicam que podemos proteger programas em tempo de execução com custo quase nulo na prática.
Referências
Abadi, M., Budiu, M., Erlingsson, U., and Ligatti, J. (2005). Control-flow integrity. In CCS, pages 340–353, New York, NY, USA. ACM.
Akritidis, P., Cadar, C., Raiciu, C., Costa, M., and Castro, M. (2008). Preventing memory error exploits with wit. In Security and Privacy, 2008. SP 2008. IEEE Symposium on, pages 263–277. IEEE.
Banco Central do Brasil (2018). Bancos e financeiras com mais de quatro milhões de clientes. [link].
Carlini, N., Barresi, A., Payer, M., Wagner, D., and Gross, T. R. (2015). Control-flow bending: On the effectiveness of control-flow integrity. In SEC, pages 161–176, Berkeley, CA, USA. USENIX Association.
Cha, S. K., Avgerinos, T., Rebert, A., and Brumley, D. (2012). Unleashing mayhem on binary code. In S&P, pages 380–394, Washington, DC, USA. IEEE.
Checkoway, S., Feldman, A. J., Kantor, B., Halderman, J. A., Felten, E. W., and Shacham, H. (2009). Can dres provide long-lasting security? the case of return-oriented programming and the avc advantage. In EVT/WOTE, pages 6–6, Berkeley, CA, USA. USENIX Association.
Corelan Team (2011). mona.py - the manual. [link].
Egele, M., Scholte, T., Kirda, E., and Kruegel, C. (2012). A survey on automated dynamic malware-analysis techniques and tools. ACM computing surveys (CSUR), 44(2):6.
Estes, A. C. (2017). Um novo tipo de malware está invadindo bancos de todo o mundo, inclusive do brasil. [link].
F-Secure Response Labs (2013). Threat report. [link].
13 Göktas, E., Athanasopoulos, E., Bos, H., and Portokalidis, G. (2014). Out of control: Overcoming control-flow integrity. In Security and Privacy (SP), 2014 IEEE Symposium on, pages 575–589. IEEE.
Intel (2016). Control-flow enforcement technology preview. [link].
Kiriansky, V., Bruening, D., Amarasinghe, S. P., et al. (2002). Secure execution via program shepherding. In USENIX Security Symposium, volume 92, page 84.
Kleen, A. (2016). Advanced usage of last branch records. [link].
Kolbitsch, C., Comparetti, P. M., Kruegel, C., Kirda, E., Zhou, X., and Wang, X. (2009). Effective and efficient malware detection at the end host. In SSYM, pages 351–366, Berkeley, CA, USA. USENIX Association.
Lattner, C. and Adve, V. (2004). LLVM: A compilation framework for lifelong program analysis & transformation. In CGO, pages 75–, Washington, USA. IEEE.
Luk, C.-K., Cohn, R., Muth, R., Patil, H., Klauser, A., Lowney, G., Wallace, S., Reddi, V. J., and Hazelwood, K. (2005). Pin: Building customized program analysis tools with dynamic instrumentation. In PLDI, pages 190–200, New York, NY, USA. ACM.
Schwartz, E. J., Avgerinos, T., and Brumley, D. (2011). Q: Exploit hardening made easy. In SEC, pages 25–25, Berkeley, CA, USA. USENIX Association.
Shacham, H. (2007). The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86). In CCS, pages 552–561, New York, USA. ACM.
Shacham, H., Page, M., Pfaff, B., Goh, E., Modadugu, N., and Boneh, D. (2004). On the effectiveness of address-space randomization. In CSS, pages 298–307, New York, NY, USA. ACM.
Shi, Y. and Lee, G. (2007). Augmenting branch predictor to secure program execution. In DSN, pages 10–19, Washington, DC, USA. IEEE Computer Society.
Szekeres, L., Payer, M., Wei, T., and Song, D. (2013). Sok: Eternal war in memory. In S&P, pages 48–62, Washington, DC, USA. IEEE Computer Society.
van der Veen, V., Andriesse, D., Stamatogiannakis, M., Chen, X., Bos, H., and Giuffrdia, C. (2017). The dynamics of innocent flesh on the bone: Code reuse ten years later. In CCS, pages 1675–1689, New York, NY, USA. ACM.
Vendicator (2000). Stack shield: A stack smashing technique protection tool for linux. [link].
Xia, Y., Liu, Y., Chen, H., and Zang, B. (2012). CFIMon: Detecting violation of control flow integrity using performance counters. In Dependable Systems and Networks (DSN), 2012 42nd Annual IEEE/IFIP International Conference on, pages 1–12. IEEE.
Akritidis, P., Cadar, C., Raiciu, C., Costa, M., and Castro, M. (2008). Preventing memory error exploits with wit. In Security and Privacy, 2008. SP 2008. IEEE Symposium on, pages 263–277. IEEE.
Banco Central do Brasil (2018). Bancos e financeiras com mais de quatro milhões de clientes. [link].
Carlini, N., Barresi, A., Payer, M., Wagner, D., and Gross, T. R. (2015). Control-flow bending: On the effectiveness of control-flow integrity. In SEC, pages 161–176, Berkeley, CA, USA. USENIX Association.
Cha, S. K., Avgerinos, T., Rebert, A., and Brumley, D. (2012). Unleashing mayhem on binary code. In S&P, pages 380–394, Washington, DC, USA. IEEE.
Checkoway, S., Feldman, A. J., Kantor, B., Halderman, J. A., Felten, E. W., and Shacham, H. (2009). Can dres provide long-lasting security? the case of return-oriented programming and the avc advantage. In EVT/WOTE, pages 6–6, Berkeley, CA, USA. USENIX Association.
Corelan Team (2011). mona.py - the manual. [link].
Egele, M., Scholte, T., Kirda, E., and Kruegel, C. (2012). A survey on automated dynamic malware-analysis techniques and tools. ACM computing surveys (CSUR), 44(2):6.
Estes, A. C. (2017). Um novo tipo de malware está invadindo bancos de todo o mundo, inclusive do brasil. [link].
F-Secure Response Labs (2013). Threat report. [link].
13 Göktas, E., Athanasopoulos, E., Bos, H., and Portokalidis, G. (2014). Out of control: Overcoming control-flow integrity. In Security and Privacy (SP), 2014 IEEE Symposium on, pages 575–589. IEEE.
Intel (2016). Control-flow enforcement technology preview. [link].
Kiriansky, V., Bruening, D., Amarasinghe, S. P., et al. (2002). Secure execution via program shepherding. In USENIX Security Symposium, volume 92, page 84.
Kleen, A. (2016). Advanced usage of last branch records. [link].
Kolbitsch, C., Comparetti, P. M., Kruegel, C., Kirda, E., Zhou, X., and Wang, X. (2009). Effective and efficient malware detection at the end host. In SSYM, pages 351–366, Berkeley, CA, USA. USENIX Association.
Lattner, C. and Adve, V. (2004). LLVM: A compilation framework for lifelong program analysis & transformation. In CGO, pages 75–, Washington, USA. IEEE.
Luk, C.-K., Cohn, R., Muth, R., Patil, H., Klauser, A., Lowney, G., Wallace, S., Reddi, V. J., and Hazelwood, K. (2005). Pin: Building customized program analysis tools with dynamic instrumentation. In PLDI, pages 190–200, New York, NY, USA. ACM.
Schwartz, E. J., Avgerinos, T., and Brumley, D. (2011). Q: Exploit hardening made easy. In SEC, pages 25–25, Berkeley, CA, USA. USENIX Association.
Shacham, H. (2007). The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86). In CCS, pages 552–561, New York, USA. ACM.
Shacham, H., Page, M., Pfaff, B., Goh, E., Modadugu, N., and Boneh, D. (2004). On the effectiveness of address-space randomization. In CSS, pages 298–307, New York, NY, USA. ACM.
Shi, Y. and Lee, G. (2007). Augmenting branch predictor to secure program execution. In DSN, pages 10–19, Washington, DC, USA. IEEE Computer Society.
Szekeres, L., Payer, M., Wei, T., and Song, D. (2013). Sok: Eternal war in memory. In S&P, pages 48–62, Washington, DC, USA. IEEE Computer Society.
van der Veen, V., Andriesse, D., Stamatogiannakis, M., Chen, X., Bos, H., and Giuffrdia, C. (2017). The dynamics of innocent flesh on the bone: Code reuse ten years later. In CCS, pages 1675–1689, New York, NY, USA. ACM.
Vendicator (2000). Stack shield: A stack smashing technique protection tool for linux. [link].
Xia, Y., Liu, Y., Chen, H., and Zang, B. (2012). CFIMon: Detecting violation of control flow integrity using performance counters. In Dependable Systems and Networks (DSN), 2012 42nd Annual IEEE/IFIP International Conference on, pages 1–12. IEEE.
Publicado
25/10/2018
Como Citar
SOUSA, Hugo Araújo de; TYMBURIBÁ, Mateus; PEREIRA, Fernando Magno Quintão.
Modelo Multicamadas para Detecção de Ataques ROP. In: SIMPÓSIO BRASILEIRO DE SEGURANÇA DA INFORMAÇÃO E DE SISTEMAS COMPUTACIONAIS (SBSEG), 18. , 2018, Natal.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2018
.
p. 239-252.
DOI: https://doi.org/10.5753/sbseg.2018.4256.
