堆栈透视防御的脆弱性分析：基线问题与对策

35 浏览量更新于2024-08-27 收藏 416KB PDF 举报

"堆栈透视防御的有效性研究" 在当前的网络安全环境中，返回导向编程（Return-Oriented Programming, ROP）已经成为软件漏洞利用中的常见技术。由于ROP攻击的普遍存在，各种防御策略应运而生，其中包括随机化和控制流完整性（Control-Flow Integrity, CFI）等方法。尽管这些防御措施在一定程度上提高了系统的安全性，但ROP攻击并未被彻底消除。最近，基于堆栈透视检测的防御机制成为了新的研究焦点。本文深入研究了现有的堆栈透视防御机制，如ROPGuard、微软的EMET（Enhanced Mitigation Experience Toolkit）以及PBlocker等防御工具，还有基于检测设备的设计。这些防御策略的核心是通过检查栈指针的有效性来阻止攻击，它们依赖于存储在系统结构（例如，Windows操作系统中的线程信息块(Thread Information Block, TIB)）中的栈边界信息来判断栈指针是否合法。这些堆栈透视检查器在理论上能有效地检测到基于ROP的攻击，前提是基线存储的安全性。然而，作者们发现了这一假设的潜在脆弱性。他们指出，如果攻击者能够破坏或篡改栈边界信息，那么这些基于堆栈透视的防御机制就可能失效。攻击者可以通过各种手段，如注入恶意代码或者利用其他已知的漏洞，来改变系统结构中的信息，使得栈指针检查失去作用，从而绕过防御机制。这种对基线安全性的依赖性成为了防御策略的一个重要弱点。为了进一步探讨这个问题，作者们进行了详尽的分析和实验，揭示了这些防御策略在实际攻击面前的局限性。他们模拟了多种攻击场景，并展示了如何利用这些弱点来成功实施ROP攻击。这些发现对于理解和改进现有的堆栈透视防御机制具有重要意义，同时也提醒研究人员和安全专家需要关注防御策略的全面性和韧性，而不只是单一的技术点。这篇研究论文揭示了当前堆栈透视防御的有效性问题，强调了对基线安全性的依赖可能会导致防御策略的失效。这为未来的研究提供了新的方向，即开发更健壮的防御策略，以应对不断演变的ROP攻击和其他类似的高级威胁。同时，这也对软件开发者提出了挑战，要求他们在设计和实现系统时考虑到防御的多层面性和复杂性，以提高整体的安全水平。

Baseline is Fragile: On the Effectiveness of Stack Pivot Defense

Fei Yan, Fan Huang, Lei Zhao, Huirong Peng and Qian Wang

Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, Wuhan, Hubei, China

School of Computer, Wuhan University, Wuhan, 430072, China

Email: yanfei@whu.edu.cn, huangfana7@whu.edu.cn

Abstract—Return-Oriented Programming (ROP) has become

a widespread technique in recent software exploits. Various

defenses have been proposed to thwart ROP, including ran-

domization, Control-Flow Integrity (CFI), etc. However, ROP

attacks have not been eliminated completely yet. Recently, ROP

defenses based on stack pivot detection are put forward. In

this paper, we investigate the checking mechanism in existing

stack pivot defenses, including ROPGuard, Microsoft EMET,

PBlocker and a detecting device design. They check validity of

stack pointer with stack boundary information stored in system

structure, e.g., Thread Information Block (TIB) in Windows.

These stack pivot checkers are effective to detect ROP attacks

on the premise that the baseline is safely stored. However, we

ﬁnd this assumption is unreliable because users have read-write

access to TIB structure, which means stack range information

can be tampered in user mode by an attacker, while existing

solutions don’t mention how to protect these baseline data. In

this paper, we propose an attack method to bypass stack pivot

checks through corrupting stack border value in TIB and prove

that our attack can overcome current solutions indeed through

case studies. Further, we discuss possible countermeasures to

enhance security of current stack pivot defenses.

Keywords-Code reuse attack, Return-Oriented Program-

ming, Stack pivot, Thread Information Block, Enhanced Mit-

igation Experience Toolkit

I. INTRODUCTION

In modern computer systems, there are various mem-

ory corruption vulnerabilities, such as buffer overﬂow, in-

teger overﬂow, format string vulnerability, and use-after-

free (UAF), which are often exploited in software exploits.

Originally, an attacker typically hijacks the control ﬂow of

a program and switches to injected shellcode. Since data

execution prevention (DEP) [1] is widely used, code reuse

attack has become a new option. Currently, Return-Oriented

Programming (ROP) [2] is a prevalent code-reuse technique

where an attacker combines short instruction sequences

called “gadgets” originated from existing code pieces.

ROP has been successfully applied to different architec-

tures, such as x86 [2], SPARC [3], ARM [4], Atmel [5],

PowerPC [6], and ARM/iOS [7]. To defeat ROP, many solu-

tions have been put forward, such as software randomization

and control-ﬂow integrity (CFI) [8].

This work is supported by National Natural Science Foundation of

China (No. 61272452, 61003268, 61303024), Natural Science Foundation

of Jiangsu Province (No. BK20130372), National High-tech R&D Program

of China (863 Program) 2015AA016002, and National Basic Research

Program of China (973 Program) 2014CB340601.

Software randomization diversiﬁes the code, data, or

address space of a program so that the space layouts of

the same entities are different when running in different

system or during different execution. For example, Address

Space Layout Randomization (ASLR) [9] randomizes the

base address of modules. Besides, there are ﬁne-grained

randomization solutions such as basic block randomization

[10] and instruction randomization [11]. However, defenses

based on diversiﬁcation are commonly vulnerable when

faced with different information leakage attacks.

CFI [8] computes a Control-Flow Graph (CFG) of a pro-

gram and force the control ﬂow to obey the rules speciﬁed

in the CFG. Depending on the accuracy of target address

set deﬁned in speciﬁc solutions, CFI solutions are classiﬁed

as ﬁne-grained and coarse-grained. Practical CFI solutions

[12, 13] often implement coarse-grained policies to keep

performance, leaving open the possibility of being attacked

[14]. Fine-grained CFI suffers from heavy overhead, and

CFB [15] and Control Jujutsu [16] shows that current ﬁne-

grained CFI protections may not be secure enough.

Although above defenses indeed raise the thresholds for

ROP attack, they have different limitations and cannot

eliminate ROP attacks completely. Therefore, some re-

searchers have changed their concentration to other defense

techniques, for example, detecting the abnormity of stack

pointer [17–20], which is caused by stack pivoting in ROP

attacks. Such solutions usually have low run-time overhead

and support incremental deployment which means protected

modules can interact with unprotected modules normally.

This paper makes four contributions:

• We investigate existing stack pivot defenses and ﬁnd

a weakness in their solutions where stack information

stored in TIB is the baseline to determine abnormity of

stack pointer. TIB, a read-write structure in user space,

can be compromised with some tricks, while current

solutions don’t mention how to protect it.

• Exploiting the weakness, we present an attack method

to bypass stack pivot defenses through constructing a

special ROP chain to rewrite stack boundary values.

• To verify the effectiveness of our attack, we implement

a proof of concept (POC) program and give case studies

on existing solutions. The cases show that our attack

can successfully manipulate the stack boundary value

and bypass these solutions.

2016 IEEE 22nd International Conference on Parallel and Distributed Systems

DOI 10.1109/ICPADS.2016.60

406

下载后可阅读完整内容，剩余7页未读，立即下载

weixin_38666753

粉丝: 7
资源: 909

堆栈透视防御的脆弱性分析：基线问题与对策

2021在华企业与可持续发展基线调研：走向零碳，在华企业可持续发展行动.pdf

操作系统基线管理

基线分析：用于确定允许的基线变异性的脚本。 与脚本轴突分析一起使用。-matlab开发

稳定基线3：稳定基线的PyTorch版本，强化学习算法的可靠实现

baseline:基线角度开发堆栈

拉曼光谱基线去除：估算给定拉曼光谱的基线和校正光谱。-matlab开发

基线拟合：基线拟合从选定的点插入，然后应用于数据。-matlab开发

使用 ECG 或 PPPG 删除基线漂移：Matlab 中的程序使用“小波”删除基线漂移-matlab开发

需求基线管理：整合、评估与依赖性分析

SecAny安全基线平台：自动化脆弱点分析与风险评估

最新资源

基线分析：用于确定允许的基线变异性的脚本。与脚本轴突分析一起使用。-matlab开发