Abstract
Buffer overflow(BOF) has been the most common form of vulnerability in software systems today, and many methods exist to defend software systems against BOF attacks. Among them, the instruction set randomization scheme, which makes attacker not to know the specific instruction set of the target machine, is the most promising defense scheme because it defends all typical code-injection BOF attacks. However, this defense scheme can not cover data-injection BOF attacks like return-into-libc attacks. In order to defend against the data-injection BOF attacks as well as the code-injection BOF attacks, we propose an enhanced defense scheme randomizing not only the instruction sets but also the return addresses. Implementation results show that the proposed scheme can defend software systems against data-injection BOF attacks as well as code-injection BOF attacks without significant extra overheads.
This research was supported by the MIC(Ministry of Information and Communication), Korea, under the ITRC (Information Technology Research Center) support program supervised by the IITA (Institue of Information Technology Assessment)(IITA-2005-C1090-0501-0018).
This is a preview of subscription content, log in via an institution to check access.
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Cert: Cert coordination center (2006), http://www.cert.org/
Bugtraq: Bugtraq mailing list (2006), http://www.securityfocus.com/archive/1
Barrantes, E.G., Ackley, D.H., Forrest, S., Palmer, T.S., Stefanovic, D., Zovi, D.D.: Intrusion detection: Randomized instruction set emulation to disrupt binary code injection attacks. In: Proceedings of the 10th ACM Conference on Computer and Communication Security (2003)
Kc, G.S., Keromytis, A.D., Prevelakis, V.: Countering code-injection attacks with instruction-set randomization. In: Proceedings of 10th ACM International Conference on Computer and Communications Security (2003)
Seward, J., Nethercote, N.: Valgrind: A program supervision framework. Electronic Notes in Theoretical Computer Science (2003)
Nergal: The advanced return-into-lib(c) exploits (pax case study). Phrack Magazine 58(4) (2001), http://www.phrack.org/phrack/58/p58-0x04
Cowan, C., Pu, C., Maier, D., Walpole, J., Bakke, P., Beattie, S., Grier, A., Wagle, P., Zhang, Q., Hinton, H.: Stackguard: Automatic adaptive detection and prevention of buffer overflow attacks. In: Proceedings of 7th USENIX Security Conference (1998)
Vendicator: Stackshield: A stack smashing technique protection tool for linux (2000), http://www.angelfire.com/sk/stackshield
Bulba, Kil3r: Bypassing stackguard and stackshield. Phrack Magazine 56(5) (2000), http://www.phrack.org/phrack/56/p56-0x05
Designer, S.: Openwall project, non-executable user stack (2005), http://www.openwall.com/linux
Team, P.: Pax aslr (address space layout randomization) (2003), http://pax.grsecurity.net/
Shacham, H., Page, M., Pfaff, B., Goh, E.J., Modadugu, N., Boneh, D.: On the effectiveness of address-space randomization. In: 11th ACM Conference on Computer and Communications Security (2004)
Johnson, S.C.: Lint: a c program checker. Bell Laboratories Computer Science Technical Report 65 (1977)
Evans, D., Larochelle, D.: Improving security using extensible lightweight static analysis. IEEE Software magazine (2002), http://www.splint.org/
Jones, R.: Bounds checking patches for gcc (2005), http://sourceforge.net/projects/boundschecking/
Baratloo, A., Tsai, T., Singh, N.: Libsafe: Protecting critical elements of stacks (1999), http://www.research.avayalabs.com/project/libsafe/
Newsome, J., Song, D.: Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In: Proceedings of the 12th Annual Network and Distributed System Security Symposium (2005)
Barrantes, E.G., Ackley, D.H., Forrest, S., Stefanovic, D.: Randomized instruction set emulation. ACM Transactions on Information and System Security (2005)
Team, P.: Pax noexec (2003), http://pax.grsecurity.net/
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2006 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Kim, D.J., Kim, T.H., Kim, J., Hong, S.J. (2006). Return Address Randomization Scheme for Annuling Data-Injection Buffer Overflow Attacks. In: Lipmaa, H., Yung, M., Lin, D. (eds) Information Security and Cryptology. Inscrypt 2006. Lecture Notes in Computer Science, vol 4318. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11937807_19
Download citation
DOI: https://doi.org/10.1007/11937807_19
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-49608-3
Online ISBN: 978-3-540-49610-6
eBook Packages: Computer ScienceComputer Science (R0)