Improving software security via runtime instruction-level taint checking

ASID'06: 1st Workshop on Architectural and System Support for Improving Software Dependability

Volumn , Issue , 2006, Pages 18-24

  Kong, Jingfei ^a   Zou, Cliff C ^a   Zhou, Huiyang ^a  

^a University of Central Florida   (United States)

Author keywords

Buffer overflow; Format string; Hardware tagging

Indexed keywords

BUFFER STORAGE; COMPUTER PROGRAM LISTINGS; DATA TRANSFER; SECURITY OF DATA; SOFTWARE ARCHITECTURE;

BUFFER OVERFLOW; FORMAT STRINGS; HARDWARE TAGGING;

SOFTWARE RELIABILITY;

EID: 34547203977     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1181309.1181313     Document Type: Conference Paper

References (18)

1. Shuo Chen, Jun Xu, Emre C. Sezer, Prachi Gauriar, and Ravi Iyer. "Non-Control-Data Attacks Are Realistic Threats". In Proceedings of USENIX Security Symposium, August 2005.
2. Shuo Chen, Jun Xu, Nithin Nakka, Zbigniew Kalbarczyk, Ravi Iyer. "Defeating Memory Corruption Attacks via Pointer Taintedness Detection". In Proceedings of IEEE International Conference on Dependable Systems and Networks (DSN), June, 2005.
3. Jonathan Pincus and Brandon Baker. "Mitigations for Low-level Coding Vulnerabilities: Incomparability and Limitations". http://research. microsoft.com/users/jpincus/mitigations.pdf, 2004.
4. th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS-XI), Oct 2004.
5. Jedidiah R. Crandall, Frederic T. Chong. "Minos: Control Data Attack Prevention Orthogonal to Memory Model". in the 37th International Symposium on Microarchitecture, December 2004.
6. John Wilander and Mariam Kamkar, "A Comparison of Publicly Available Tools for Dynamic Buffer Overflow Prevention", In Proceedings of the 10th Network and Distributed System Security Symposium (NDSS'03), February 2003.
7. Jonathan Pincus and Brandon Baker. "Beyond stack smashing: Recent advances in exploiting buffer overruns". IEEE Security and Privacy, 2004.
8. James Newsome and Dawn Song. "Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software". In Proceedings of the 12th Annual Network and Distributed System Security Symposium (NDSS 05), February 2005.
9. D. Burger and T. M. Austin. "The Simplescalar Tool Set Version 2.0". Technical Report, Computer Science Department, University of Wisconsin-Madison, 1997.
10. M. Costa, J. Crowcroft, M. Castro, A. Rowstron, L. Zhou, L. Zhang, and P. Barham, "Vigilante: End-to-End Containment of Internet Worms", 20th ACM Symposium on Operating Systems Principles (SOSP), Brighton, UK, October 2005.
11. Georgios Portokalidis, Asia, Slowinska and Herbert Bos. "Argos: an Emulator for Fingerprinting Zero-Day Attacks". In proceedings of ACM SIGOPS EUROSYS 2006, Leuven, Belgium, April 2006.
12. Alex Ho, Michael Fetterman, Christopher Clark, Andrew Warfield and Steven Hand. "Practical Taint-based Protection using Demand Emulation". In proceedings of ACM SIGOPS EUROSYS 2006, Leuven, Belgium, April 2006.
13. C. Cowan, C. Pu, D. Maier, H. Hinton, J. Walpole, P. Bakke, A. Grier, S. Beattie, P. Wagle, and Q. Zhang. "StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks". In Proceedings in the 7th USENIX Security Symposium, January 1998.
14. Etoh, Hiroaki and Yoda, K. "Protecting from stack-smashing attacks", http://www.research.ibm.com/trl/projects/security/ssp/main.html (2004).
15. SSH CRC-32 Compensation Attack Detector Vulnerability. http://www.securityfocus.com/bid/2347
16. W. Robertson, C. Kruegel, D. Mutz, F. Valeur. "Run-time Detection of Heap-based Overflows". In the Proceedings of the 17th USENIX Large Installation Systems Administration Conference (LISA). October 2003, San Diego, CA USA.
17. Olatunji Ruwase and Monica S. Lam. "A Practical Dynamic Buffer Overflow Detector". In Proceedings of the 11th Annual Network and Distributed System Security Symposium, February 2004.
18. Michael Dalton, Hari Kannan, Christos Kozyrakis, "Deconstructing Hardware Architectures for Security". 5th Annual Workshop on Duplicating, Deconstructing, and Debunking (WDDD) at ISCA, Boston, MA, June 2006.