Shuffler：抵御代码重用攻击的实时代码随机化技术

85 浏览量更新于2024-07-14 收藏 386KB PDF 举报

"Shuffler - Fast and Deployable Continuous Code Re-Randomization - 2016 (shuffler-osdi16)" 论文详细介绍了针对现代系统中日益严重的代码重用攻击问题，特别是Just-In-Time ROP (JIT-ROP) 技术的防御策略。Shuffler是一种高效且可部署的连续代码随机化技术，旨在通过实时地对代码位置进行重新随机化，以在攻击者能够构建完整利用链之前设定一个时间限制，从而极大地增加攻击的难度。论文作者包括来自哥伦比亚大学、英属哥伦比亚大学和布朗大学的研究人员。他们提出了Shuffler这个防御系统，该系统的核心特点是快速、自托管以及对最终用户非侵入性。为了实现速度这一目标，Shuffler在后台异步地对代码进行随机化，避免了对程序运行的直接影响。 Just-In-Time ROP（JIT-ROP）攻击是利用内存泄露漏洞，在运行时发现代码片段（gadgets）来构造攻击链的攻击方式。由于其动态性和灵活性，JIT-ROP成为了一种难以防御的威胁。Shuffler的出现就是为了应对这种攻击，它以毫秒级的时间间隔不断重新打乱代码位置，使得攻击者在短时间内无法构建出稳定的利用链。 Shuffler的设计考虑到服务器程序的特性，它们通常会远离攻击者的机器，这意味着攻击者需要花费更多时间来收集信息和构造攻击。通过设定实时性限制，Shuffler提高了攻击成功的门槛，使得那些需要长时间准备的攻击变得极其困难。此外，Shuffler的自我托管意味着它可以在不依赖外部工具或服务的情况下运行，这减少了系统的复杂性和潜在的脆弱点。对于终端用户来说，Shuffler的运行应该是透明的，不会影响到他们的正常使用体验。 Shuffler是一种创新的安全防御机制，通过持续的代码随机化，有效地提高了软件的抗攻击能力，特别是在抵御JIT-ROP攻击方面表现出显著的优势。它的设计和实现考虑到了性能和用户体验，使其成为一个理想的实用安全解决方案。

Figure 1: Shufﬂer architecture. We use symbols and re-

locations (0) for augmented binary analysis (1), rewrite

code into shufﬂable form (2), and asynchronously create

new code copies at runtime (3), while self-hosting (4).

3.1 Goals

The main goals of Shufﬂer are:

• Deployability: We aim to reduce the burden on

end-users as much as possible. Thus, we require no

direct access to source code, no static binary rewrit-

ing on disk, and no modiﬁcations to system compo-

nents (except our small loader patch).

• Security: Our goal is to defeat all known code reuse

attacks, without expanding the trusted computing

base. We constrain the lifetime of leaked informa-

tion by providing a conﬁgurable shufﬂing period,

mitigating code reuse and JIT-ROP attacks.

• Performance: Because time is an integral part of

our security model, speed is of the essence. We aim

to provide low runtime overhead, and also low total

shufﬂing latency to allow for high shufﬂing rates.

3.2 Architecture

Shufﬂer is designed to require minimal system modi-

ﬁcations. To avoid kernel changes, it runs entirely in

userspace; to avoid requiring source or a modiﬁed com-

piler, it operates on program binaries. Performing re-

randomization soundly requires complete and precise

pointer analysis. Rather than attempting arbitrary binary

analysis, we leverage symbol and relocation information

from the (unmodiﬁed) compiler and linker. Options to

preserve this information exist in every major compiler.

Thus, we are able to achieve completely accurate disas-

sembly in what we call augmented binary analysis—as

shown in Figure 1 part (1) and detailed in Section 3.3.

At load-time, Shufﬂer transforms the program’s code

using binary rewriting (Figure 1 part (2)). The goal of

rewriting is to be able to track and update all code point-

ers at runtime. We avoid the taint tracking used by related

work [7,42] because it is expensive and would introduce

races during asynchronous pointer updates. Instead, we

leverage our complete and accurate disassembly to trans-

form all code pointers into unique identiﬁers—indices

into a code pointer table. These indices cannot be altered

after load time (the potential security implications of this

choice are discussed in Section 6), but they trade off very

favorably against performance and ease of implementa-

tion. We handle return addresses (dynamically generated

code pointers) differently, encrypting them on the stack

rather than using indices, thereby preventing disclosure

while maintaining good performance.

Our system performs re-randomization at the level of

functions within a speciﬁc shufﬂe period, a randomiza-

tion deadline speciﬁed in milliseconds. Shufﬂer runs in a

separate thread and prepares a new shufﬂed copy of code

within this deadline, as shown in Figure 1 part (3). This

step is accelerated using a Fenwick tree (see Section 4.4).

The vast majority of the re-randomization process is per-

formed asynchronously: creating new copies of code,

ﬁxing up instruction displacements, updating pointers in

the code table, etc. The threads are globally paused only

to atomically update return addresses. Since any existing

return addresses reference the old copy of code, we must

revisit saved stack frames and update them. Each thread

walks its own stack in parallel, following base point-

ers backwards to iterate through stack frames (a process

known as stack unwinding); see Section 3.3 for details.

Shufﬂer runs in an egalitarian manner, at the same

level of privilege as target programs, and within the same

address space. To prevent our own code from being used

in a code reuse attack, Shufﬂer randomizes it the same

way it does all other code (Figure 1 part (4)). In fact,

our scheme uses binary rewriting to transform all code

in a userspace application (the program, Shufﬂer, and all

shared libraries) into a single code sandbox, essentially

turning it into a statically linked application at runtime.

Bootstrapping from original code into this self-hosting

environment is challenging, particularly without substan-

tially changing the system loader.

3.3 Challenges

Changing function pointer behaviour Normal binary

code is generated under the assumption that the pro-

gram’s memory layout remains consistent and function

pointers have indeﬁnite lifetime. Re-randomization in-

troduces an arbitrary lifetime for each block of code,

and so re-randomization becomes an exercise in avoid-

ing dangling code pointers. Failing to update even one

such pointer may cause the program to crash, or worse,

fall victim to a use-after-free attack.

Hence, we need to accurately track and update every

code pointer during the re-randomization process. We

opt to statically transform all code pointers into unique

identiﬁers—namely, indices into a hidden code pointer

table. Relying on accurate and complete disassembly

(discussed next), we transform all initialization points to

use indices. Then, wherever the code pointer is copied

剩余15页未读，继续阅读

weixin_38682406

粉丝: 5
资源: 910

Shuffler：抵御代码重用攻击的实时代码随机化技术

shuffler-discord-bot

PDF-Shuffler-开源

Shuffler-crx插件

Dominion Card Shuffler-开源

Tinycards Shuffler-crx插件

Stock Shuffler-crx插件

LifeInTheUKTestWeb Answer Shuffler-crx插件

Jira Swimlane Shuffler-crx插件

Deck-Shuffler-C：这是一种纸牌游戏，将显示有序的纸牌，然后将其洗牌，然后将纸牌提供给打算玩游戏的玩家。 重要的是要了解游戏要求用户输入纸牌数和玩家数的初始输入

blik-shuffler

最新资源

Deck-Shuffler-C：这是一种纸牌游戏，将显示有序的纸牌，然后将其洗牌，然后将纸牌提供给打算玩游戏的玩家。重要的是要了解游戏要求用户输入纸牌数和玩家数的初始输入