Transparent runtime randomization for security

Proceedings of the IEEE Symposium on Reliable Distributed Systems

Volumn , Issue , 2003, Pages 260-269

  Xu, Jun ^a   Kalbarczyk, Zbigniew ^a   Iyer, Ravishankar K ^a  

^a University of Illinois at Urbana Champaign   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

DYNAMIC PROGRAM LOADER; PROGRAM'S MEMORY LAYOUT; SECURITY ATTACKS; TRANSPARENT RUNTIME RANDOMIZATION (TRR);

COMPUTER CRIME; COMPUTER SOFTWARE; DIGITAL LIBRARIES; DISTRIBUTED COMPUTER SYSTEMS; DYNAMIC PROGRAMMING; RANDOM PROCESSES; RELIABILITY;

SECURITY OF DATA;

EID: 27644457078     PISSN: 10609857     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/RELDIS.2003.1238076     Document Type: Conference Paper

References (26)

1. System V Application Binary Interface - Intel386(TM) Arhcitecture Processor Supplement. 4th edition, 1997.
2. Aleph One. Smashing the stack for fun and profit. Phrack Magazine, 49(7), Nov. 1996.
3. Anonymous. Once upon a free(). Phrack Magazine, 57(9), Aug. 2001.
4. A. A. Avizienis. The methodology of n-version programming. In M. R. Lyu, editor, Software Fault Tolerance, chapter 2, pages 23-46. John Wiley and Sons, 1995.
5. C. Bain, D. Faatz, A. Fayad, and D. Williams. Diversity as a defense strategy in information. In MITRE Corporation Technical Paper, 2001.
6. A. Baratloo, T. Tsai, and N. Singh. Transparent run-time defense against stack smashing attacks. In Proceedings, of the USENIX Annual Technical Conference, June 2000.
7. CERT. Cert advisory ca-2000-13 two input validation problems in FTPD. http://www.cert.org/advisories/CA-2000-13. html, 2000.
8. S. Chen, J. Zymla, and Z. Yang. N-version programming for stack overflow detection. ECE442 Design of Reliable Systems and Networks Class Project Report, University of Illinois at Urbana-Champaign, Dec. 2000.
9. C. Cowan, M. Barringer, S. Seattle, , and G. Kroah-Hartman. Formatguard: Automatic protection from printf format string vulnerabilities. In Proceedings of the 10th USENIX Security Conference, 2001.
10. C. Cowan, C. Pu, D. Maier, H. Hinton, P. Bakke, S. Beattie, A. Grier, P. Wagle, and Q. Zhang. StackGuard: Automatic adaptive detection and prevention of buffer-overflow attacks. In Proceedings of the 7th USENIX Security Conference, 1998.
11. Y. Deswarte, K. Kanoun, and J.-C. Laprie. Diversity against accidental and deliberate faults. In Computer Security, Dependability, and Assurance: From Needs to Solutions, Nov. 1998.
12. D. Evans. Static detection of dynamic memory errors. In Proc. ACM SIGPLAN Conference on Programming Language Design and Implementation, 1996.
13. S. Forrest, A. Somayaji, and D. H. Ackley. Building diverse computer systems. In Workshop on Hot Topics in Operating Systems, pages 67-72, 1997.
14. S. C. Johnson. Lint, a C Program Checker. Bell Laboratories Computer Science Technical Report 65, Dec. 1977.
15. M. M. Kaempf. Vudo - An object supersitiously believed to embody magical powers. Phrack Magazine, 57(12), Aug. 2001.
16. D. Larochelle and D. Evans. Statically detecting likely buffer overflow vulnerabilities. In Proc. 10th USENIX Security Symposium, Aug. 2001.
17. NetCraft. Netcraft web server survey, http://www.netcraft.com/survey/, Oct. 2002.
18. Open Wall Project. Linux kernel patch from the Openwall project. http://www.openwall.com/linux/.
19. PaX Team. Homepage of The PaX Team. http://pageexec. virtualave.net/.
20. C. Pu, T. Autrey, A. Black, C. Consel, C. Cowan, J. Inouye, L. Kethana, J. Walpole, and K. Zhang. Optimistic incremental specialization: Streamlining a commercial operating system. In Proceedings of the 15th ACM Symposium on Operating Systems Principles (SOSP'95), Copper Mountain, Colorado, 1995.
21. C. Pu, A. Black, C. Cowan, J. Walpole, and C. Consel. A specialization toolkit to increase the diversity of operating systems. In ICMAS Workshop on Immunity-Based Systems, 1996.
22. Sendmail Consortium. Sendmail home page. http://www.sendmail.org/.
23. Unix System Labs. Executable and Linkable Format (ELF) Version 1.1. Tool Interface Standards.
24. Vendicator. Stack Shield. http://www.angelfire.com/sk/stackshield/, 2000.
25. D. Wagner, J. S. Foster, E. A. Brewer, and A. Aiken. A first step towards automated detection of buffer overrun vulnerabilities. In Proceedings of 7th Network and Distributed System Security Symposium, Feb. 2000.
26. R. Wojtczuk. Defeating Solar Designer non-executable stack patch. http://www.insecure.org/sploits/non-executable.stack. problems.html, Jan. 1998.