Diversified process replicæ; for defeating memory error exploits

Conference Proceedings of the IEEE International Performance, Computing, and Communications Conference

Volumn , Issue , 2007, Pages 434-441

  Bruschi, Danilo ^a   Cavallaro, Lorenzo ^a,b   Lanzi, Andrea ^a  

^a UNIVERSITY OF MILAN   (Italy)

^b STONY BROOK UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER CRIME; ERROR ANALYSIS; SIGNAL ANALYSIS; SOFTWARE PROTOTYPING; USER INTERFACES;

MEMORY CORRUPTION; MEMORY MANAGEMENT; SOFTWARE DIVERSITY; SYNCHRONOUS SIGNALS DELIVERY;

DATA STORAGE EQUIPMENT;

EID: 36348949033     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/PCCC.2007.358924     Document Type: Conference Paper

References (23)

1. Ana Nora Sovarel and David Evans and Nathanael Paul. Where's the FEEB? The Effectiveness of Instruction Set Randomization. In 14th USENIX Security Symposium, August 2005.
2. Benjamin Cox, David Evans, Adrian Filipi, Jonathan Rowanhill, Wei Hu, Jack Davidson, John Knight, Anh Nguyen-Tuong, and Jason Hiser. N-Variant Systems: A Secretless Framework for Security through Diversity. In 15th USENIX Security Symposium, 2006.
3. S. Chen, J. Xu, E. C. Sezer, P. Gauriar, and R. K. Iyer. Non-Control-Data Attacks Are Realistic Threats. In 14th USENIX Security Symposium, August 2005.
4. D. Mosberger (main author), S. Eranian, and D. Carter, httperf - HTTP performance measurement tool. http://www.hpl.hp.com/research/linux/httperf/ - Hewlett-Packard Research Laboratories.
5. Daniel R. Edelson. Fault Interpretation: Fine-Grain Monitoring of Page Accesses. In USENIX Winter, pages 395-404, 1993.
6. Danilo Bruschi, Lorenzo Cavallaro, and Andrea Lanzi. Diversified Process Replicæ for Defeating Memory Error Exploits. Technical Report RT 14-06, Università degli Studi di Milano, 2006.
7. Elena Gabriela Barrantes and David H. Ackley and Stephanie Forrest and Darko Stefanovic. Randomized instruction set emulation. ACM Trans. Inf. Syst. Secur., 8(1):3-40, 2005.
8. Elias "Aleph One" Levy. Smashing the Stack for Fun and Profit. Phrack Magazine, Volume 0x07, Issue #49, Phile 14 of 16, December 1998.
9. H. Feng, O. Kolesnikov, P. Fogla, W. Lee, and W. Gong. Anomaly Detection using Call Stack Information. IEEE Symposium on Security and Privacy, Oakland, California, 2003.
10. Gaurav S. Kc, Angelos D. Keromytis, and Vassilis Prevelakis. Countering Code-Injection Attacks With InstructionSet Randomization. In ACM Conference on Computer and Communications Security (CCS), 2003.
11. George W. Dunlap Samuel T. King Sukru Cinar Murtaza Basrai Peter M. Chen. ReVirt: Enabling Intrusion Analysis through Virtual-Machine Logging and Replay. In Symposium on Operating Systems Design and Implementation (OSDI), 2002. http://www.eecs.umich.edu/kingst/revirt.pdf.
12. Hovav Shacham and Matthew Page and Ben Pfaff and Eu-Jin Goh and Nagendra Modadugu and Dan Boneh. On the Effectiveness of Address-Space Randomization. In CCS '04: Proceedings of the 11th ACM Conference on Computer and Communications Security, pages 298-307, New York, NY, USA, 2004. ACM Press.
13. J. Poskanzer. thttpd - tiny/turbo/throttling HTTP server. http://www.acme.com/software/thttpd/ - version 2.23betal-3sargel.
14. M. Chew and D. Song. Mitigating Buffer Overflows by Operating System Randomization. Technical Report CMU-CS-02-197, Carnegie Mellon University, December 2002.
15. Rafal "Nergal" Wojtczuk. The Advanced return-into-lib(c) Exploits: PaX Case Study. Phrack Magazine, Volume 0x0b, Issue 0x3a, Phile #0x04 of 0x0e, December 2001.
16. S. Forrest and A. Somayaji and D. Ackley. Building Diverse Computer Systems. In HOTOS '97: Proceedings of the 6th Workshop on Hot Topics in Operating Systems (HotOS-VI), page 67, Washington, DC, USA, 1997. IEEE Computer Society.
17. Sandeep Bhatkar, Daniel C. DuVarney, and R. Sekar. Address Obfuscation: An Efficient Approach to Combat a Broad Range of Memory Error Exploits. In 12th USENIX Security Symposium, 2003.
18. Sandeep Bhatkar, R. Sekar, and Daniel C. DuVarney. Efficient Techniques for Comprehensive Protection from Memory Error Exploits. In 14th USENIX Security Symposium, 2005.
19. scut / team teso. Exploiting Format String Vulnerabilities, September 2001. version 1.2.
20. W. R. Stevens. UNIX Network Programming: Inter Process Communi cations, volume 2, chapter 12, page 303. Prentice-Hall, 1999.
21. The PaX Team. PaX: Address Space Layout Randomization (ASLR). http://pax.grsecurity.net.
22. Thomas C. Bressoud Fred B. Schneider. Hypervisor-based fault tolerance. In ACM Transactions on Computer Systems, pages 14(1):80-107, February 1996.
23. TIS Committee. Tool Interface Standard (TIS), Executable and Linking Format (ELF) Specification, May 1995. Version 1.2.