Securing Statically and Dynamically Compiled Programs Using Software Diversity PDF Download
Are you looking for read ebook online? Search for your book and save it on your Kindle device, PC, phones or tablets. Download Securing Statically and Dynamically Compiled Programs Using Software Diversity PDF full book. Access full book title Securing Statically and Dynamically Compiled Programs Using Software Diversity by Andrei Homescu. Download full books in PDF and EPUB format.
Author: Andrei Homescu
Publisher:
ISBN: 9781321964363
Category :
Languages : en
Pages : 113
Get Book Here
Book Description
Code-reuse attacks are notoriously hard to defeat, and many current solutions to the problem focus on automated software diversity. This is a promising area of research, as diversity attacks one cause of code reuse attacks0́4the software monoculture. Software diversity raises the costs of an attack by providing users with different variations of the same program. However, modern software diversity implementations are still vulnerable to certain threats: code disclosure attacks and attacks targeted at JIT (just-in-time) compilers for dynamically compiled languages. In this dissertation, we address the pressing problem of building secure systems out of programs written in unsafe languages. Specifically, we use software diversity to present attackers with an unpredictable attack surface. This dissertation contributes new techniques that improve the security, efficiency, and coverage of software diversity. We discuss three practical aspects of software diversity deployment: (i) performance optimization using profile guided code randomization, (ii) transparent code randomization for JIT compilers, and (iii) code hiding support for JIT compilers. We make the following contributions: we show a generic technique to reduce the runtime cost of software diversity, describe the first technique that diversifies the output of JIT compilers and requires no source code changes to the JIT engine, and contribute new techniques to prevent disclosure of diversified code. Specifically, we demonstrate how to switch between execute-only and read-write page permissions to efficiently and comprehensively prevent JIT-oriented exploits. Our in-depth performance and security evaluation shows that software diversity can be efficiently implemented with low overhead (as low as 1% for profile-guided NOP insertion and 7.8% for JIT code hiding) and is an effective defense against a large class of code reuse and code disclosure attacks.
Author: Andrei Homescu
Publisher:
ISBN: 9781321964363
Category :
Languages : en
Pages : 113
Get Book Here
Book Description
Code-reuse attacks are notoriously hard to defeat, and many current solutions to the problem focus on automated software diversity. This is a promising area of research, as diversity attacks one cause of code reuse attacks0́4the software monoculture. Software diversity raises the costs of an attack by providing users with different variations of the same program. However, modern software diversity implementations are still vulnerable to certain threats: code disclosure attacks and attacks targeted at JIT (just-in-time) compilers for dynamically compiled languages. In this dissertation, we address the pressing problem of building secure systems out of programs written in unsafe languages. Specifically, we use software diversity to present attackers with an unpredictable attack surface. This dissertation contributes new techniques that improve the security, efficiency, and coverage of software diversity. We discuss three practical aspects of software diversity deployment: (i) performance optimization using profile guided code randomization, (ii) transparent code randomization for JIT compilers, and (iii) code hiding support for JIT compilers. We make the following contributions: we show a generic technique to reduce the runtime cost of software diversity, describe the first technique that diversifies the output of JIT compilers and requires no source code changes to the JIT engine, and contribute new techniques to prevent disclosure of diversified code. Specifically, we demonstrate how to switch between execute-only and read-write page permissions to efficiently and comprehensively prevent JIT-oriented exploits. Our in-depth performance and security evaluation shows that software diversity can be efficiently implemented with low overhead (as low as 1% for profile-guided NOP insertion and 7.8% for JIT code hiding) and is an effective defense against a large class of code reuse and code disclosure attacks.
Author: Alessandro Fantechi
Publisher: Springer
ISBN: 3319231294
Category : Computers
Languages : en
Pages : 154
Get Book Here
Book Description
This book constitutes the refereed proceedings of the 7th International Workshop on Software Engineering for Resilient Systems, SERENE 2015, held in Paris, France, in September 2015. The 10 revised technical papers presented were carefully reviewed and selected from 18 submissions. The papers are organized in topical sections on development of resilient systems, verification, validation and evaluation of resilience, case studies and applications.
Author: Per Larsen
Publisher: Springer Nature
ISBN: 3031023463
Category : Computers
Languages : en
Pages : 76
Get Book Here
Book Description
Whereas user-facing applications are often written in modern languages, the firmware, operating system, support libraries, and virtual machines that underpin just about any modern computer system are still written in low-level languages that value flexibility and performance over convenience and safety. Programming errors in low-level code are often exploitable and can, in the worst case, give adversaries unfettered access to the compromised host system. This book provides an introduction to and overview of automatic software diversity techniques that, in one way or another, use randomization to greatly increase the difficulty of exploiting the vast amounts of low-level code in existence. Diversity-based defenses are motivated by the observation that a single attack will fail against multiple targets with unique attack surfaces. We introduce the many, often complementary, ways that one can diversify attack surfaces and provide an accessible guide to more than two decades worth of research on the topic. We also discuss techniques used in conjunction with diversity to prevent accidental disclosure of randomized program aspects and present an in-depth case study of one of our own diversification solutions.
Author: Pil Joong Lee
Publisher: Springer Science & Business Media
ISBN: 3642007295
Category : Business & Economics
Languages : en
Pages : 444
Get Book Here
Book Description
This book constitutes the refereed proceedings of the 11th International Conference on Information Security and Cryptology, ICISC 2008, held in Seoul, Korea, during December 3-5, 2008. The 26 revised full papers presented have gone through two rounds of reviewing and improvement and were carefully selected from 131 submissions. The papers are organized in topical sections on public key encryption, key management and secret sharing, privacy and digital rights, digital signature and voting, side channel attack, hash and mac, primitives and foundations, as well as block and stream ciphers.
Author: Occam User Group. Technical Meeting
Publisher: IOS Press
ISBN: 9789051990416
Category : Computers
Languages : en
Pages : 368
Get Book Here
Book Description
Author: Kim Sehun
Publisher: Springer
ISBN: 3540775358
Category : Computers
Languages : en
Pages : 399
Get Book Here
Book Description
Complete with Springer’s trademark online files and updates, this fascinating text constitutes the refereed proceedings of the 8th International Workshop on Information Security Applications, WISA 2007, held in Jeju Island, Korea, in August 2007. The 27 revised full papers presented were carefully selected during two rounds of reviewing and improvement from 95 submissions. The papers are organized in topical sections on a wide range of subjects from secure systems to P2P security.
Author: Jan Camenisch
Publisher: Springer
ISBN: 364221424X
Category : Computers
Languages : en
Pages : 341
Get Book Here
Book Description
This book constitutes the refereed proceedings of the 26th IFIP TC 11 International Information Security Conference, SEC 2011, held in Lucerne, Switzerland, in June 2011. The 24 revised full papers presented together with a keynote talk were carefully reviewed and selected from 100 submissions. The papers are organized in topical sections on malware, information flow and DoS attacks, authentication, network security and security protocols, software security, policy compliance and obligations, privacy attacks and privacy-enhancing technologies, risk analysis and security metrics, and intrusion detection.
Author: Per Larsen
Publisher: Morgan & Claypool
ISBN: 1970001828
Category : Computers
Languages : en
Pages : 386
Get Book Here
Book Description
As human activities moved to the digital domain, so did all the well-known malicious behaviors including fraud, theft, and other trickery. There is no silver bullet, and each security threat calls for a specific answer. One specific threat is that applications accept malformed inputs, and in many cases it is possible to craft inputs that let an intruder take full control over the target computer system. The nature of systems programming languages lies at the heart of the problem. Rather than rewriting decades of well-tested functionality, this book examines ways to live with the (programming) sins of the past while shoring up security in the most efficient manner possible. We explore a range of different options, each making significant progress towards securing legacy programs from malicious inputs. The solutions explored include enforcement-type defenses, which excludes certain program executions because they never arise during normal operation. Another strand explores the idea of presenting adversaries with a moving target that unpredictably changes its attack surface thanks to randomization. We also cover tandem execution ideas where the compromise of one executing clone causes it to diverge from another thus revealing adversarial activities. The main purpose of this book is to provide readers with some of the most influential works on run-time exploits and defenses. We hope that the material in this book will inspire readers and generate new ideas and paradigms.
Author: Stephen Crane
Publisher:
ISBN: 9781321995763
Category :
Languages : en
Pages : 146
Get Book Here
Book Description
Software immunity through diversity is a promising research direction. Address Space Layout Randomization has been widely deployed to defend against code-reuse attacks and significantly raises the bar for attackers. However, automated software diversity is still exploitable by adroit and adaptable adversaries. Using powerful memory disclosure attacks, offensive researchers have demonstrated weaknesses in conventional randomization techniques. In addition, current defenses are largely passive and allow attackers to continuously brute-force randomized defenses with little impediment. Building on the foundation of automated software diversity, we propose novel techniques to strengthen the security and broaden the impact of code randomization. We first discuss software booby traps, a new active defense technique enabled by randomized program contents. We then propose, implement, and evaluate a comprehensive randomization-based system, Readactor++, which is resilient to all types of memory disclosure attacks. Readactor++ enforces execute-only memory protections on commodity x86 processors, thus preventing direct disclosure of randomized code. We also identify the indirect disclosure attack, a new class of code leakage via data disclosure, and mitigate this attack as well. By integrating booby traps into our system, we protect against brute-force memory disclosure attempts. In our evaluation we find that Readactor++ compares favorably to other memory-disclosure resilient code-reuse defenses and that it scales effectively to complex, real-world software. Finally, we propose a novel extension of code randomization to mitigate side-channel rather than code-reuse attacks. Using control-flow diversity, a novel control-flow transformation, we introduce dynamic behavior into program side effects with fast, static code. As an example, we apply this technique to mitigate an AES cache side-channel attack. With our techniques, software diversity can now be efficiently secured against advanced attacks, including memory disclosure and function table reuse, and is adaptable to combat new classes of threats, such as side-channel attacks.
Author: Antonios Andreatos
Publisher: Academic Conferences and publishing limited
ISBN: 1914587707
Category : Language Arts & Disciplines
Languages : en
Pages : 756
Get Book Here
Book Description
