Preventing memory error exploits with WIT

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2008, Pages 263-277

  Akritidis, Periklis ^a,b   Cadar, Cristian ^a,c   Raiciu, Costin ^a,d   Costa, Manuel ^a   Castro, Miguel ^a  

^a MICROSOFT RESEARCH   (United Kingdom)

^b UNIVERSITY OF CAMBRIDGE   (United Kingdom)

^c STANFORD UNIVERSITY   (United States)

^d UNIVERSITY COLLEGE LONDON   (United Kingdom)

Author keywords

[No Author keywords available]

Indexed keywords

CODES (SYMBOLS); COMPUTER SOFTWARE; GRAPH THEORY; RELIABILITY; STATIC ANALYSIS; WEIGHT CONTROL;

COMPILE-TIME; CONTROL FLOWS; EFFICIENT IMPLEMENTATION; FALSE POSITIVES; INDIRECT CONTROL; INTEGRITY TESTING; LOW OVERHEAD; MEMORY ERRORS; POINTS-TO-ANALYSIS; RUN-TIME; SECURITY AND PRIVACY; SPACE AND TIME;

CONCURRENCY CONTROL;

EID: 50249149602     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2008.30     Document Type: Conference Paper

References (47)

1. GHttpd Log() Function Buffer Overflow Vulnerability. http://www. securityfocus.com/bid/5960.
2. Null HTTPd Remote Heap Overflow Vulnerability. http://www.securityfocus. com/bid/5774.
3. Portable Network Graphics (PNG) Specification and Extensions. http://www.libpng.org/pub/png/spec/.
4. STunnel Client Negotiation Protocol Format String Vulnerability. http://www.securityfocus.com/bid/3748.
5. Smashing the stack for fun and profit. Phrack 7, 49 (Nov. 1996).
6. ABADI, M., BUDIU, M., ERLINGSSON, U., AND LIGATTI, J. Control-Flow Integrity: Principles, Implementations, and Applications. In ACM Conference on Computer and Communications Security (Nov. 2005).
7. AFEK, J., AND SHARABANI, A. Dangling Pointer: Smashing the pointer for fun and profit. Watchfire white paper, Aug. 2007.
8. ANDERSEN, L. Program analysis and specialization for the C programming language. PhD thesis, University of Copenhagen, 1994.
9. AVOTS, D., DALTON, M., LIVSHITS, V. B., AND LAM, M. S. Improving software security with a C pointer analysis. In ACM/IEEE International Conference on Software Engineering (May 2005).
10. BERGER, E., AND ZORN, B. DieHard: Probabilistic Memory Safety for Unsafe Languages. In ACM Conference on Programming Language Design and Implementation (June 2006).
11. BHATKAR, S., SEKAR, R., AND DUVARNEY, D. Efficient techniques for comprehensive protection from memory error exploits. In USENIX Security Symposium (July 2005).
12. CARLISLE, M. C. Olden: Parallelizing Programs with Dynamic Data Structures on Distributed-Memory Machines. PhD thesis, Princeton University, 1996.
13. CASTRO, M., COSTA, M., AND HARRIS, T. Securing software by enforcing data-flow integrity. In USENIX Symposium on Operating Systems Design and Implementation (Nov. 2006).
14. CHEN, K., AND WAGNER, D. Large-scale analysis of format string vulnerabilities in Debian Linux. In Workshop on Programming Languages and Analysis for Security (June 2007).
15. CHEN, S., XU, J., SEZER, E. C., GAURIAR, P., AND IYER, R. K. Non-control-data attacks are realistic threats. In USENIX Security Symposium (July 2005).
16. CLAUSE, J., DOUDALIS, I., ORSO, A., AND PRVULOVIC, M. Effective Memory Protection Using Dynamic Tainting. In International Conference on Automated Software Engineering (Nov. 2007).
17. COSTA, M., CROWCROFT, J., CASTRO, M., ROWSTRON, A., ZHOU, L., ZHANG, L., AND BARHAM, P. Vigilante: End-to-End Containment of Internet Worms. In Symposium on Operating System Principles (Oct. 2005).
18. COWAN, C., BARRINGER, M., BEATTIE, S., KROAHHARTMAN, G., FRANTZEN, M., AND LOKIER, J. Format-Guard: automatic protection from printf format string vulnerabilities. In USENIX Security Symposium (Aug. 2001).
19. COWAN, C., BEATTIE, S., JOHANSEN, J., AND WAGLE, P. Pointguard: Protecting pointers from buffer overflow vulnerabilities. In USENIX Security Symposium (Aug. 2003).
20. COWAN, C., PU, C., MAIER, D., HINTON, H., WADPOLE, J., BAKKE, P., BEATTIE, S., GRIER, A., WAGLE, P., AND ZHANG, Q. Stackguard: Automatic detection and prevention of buffer-overrun attacks. In USENIX Security Symposium (Jan. 1998).
21. DHURJATI, D., AND ADVE, V. Backwards-compatible array bounds checking for C with very low overhead. In ACM/IEEE International Conference on Software Engineering (May 2006).
22. DHURJATI, D., AND ADVE, V. Efficiently Detecting All Dangling Pointer Uses in Production Servers. In International Conference on Dependable Systems and Networks (June 2006).
23. HEINTZE, N., AND TARDIEU, O. Ultra-fast Aliasing Analysis using CLA: A Million Lines of C Code in a Second. In ACM Conference on Programming Language Design and Implementation (June 2001).
24. JIM, T., MORRISETT, G., GROSSMAN, D., HICKS, M., CHENEY, J., AND WANG, Y. Cyclone: A safe dialect of C. In USENIX Annual Technical Conference (June 2002).
25. JONES, R., AND KELLY, P. Backwards-Compatible Bounds Checking for Arrays and Pointers in C Programs. In Workshop on Automated Debugging (May 1997).
26. JP. Advanced Doug Lea's malloc exploits. Phrack, 61 (Sep. 2003).
27. KC, G. S., KEROMYTIS, A. D., AND PREVELAKIS, V. Countering code-injection attacks with instruction-set randomization. In ACM CCS (Oct. 2003).
28. KIRIANSKY, V., BRUENING, D., AND AMARASINGHE, S. P. Secure execution via program shepherding. In USENIX Security Symposium (Aug. 2002).
29. LAROCHELLE, D., AND EVANS, D. Statically detecting likely buffer overflow vulnerabilities. In USENIX Security Symposium (Aug. 2001).
30. MICROSOFT. Phoenix compiler framework. http://research. microsoft.com/phoenix/ phoenixrdk.aspx.
31. MITRE CORPORATION. Multiple buffer overflows in libpng 1.2.5. CVE-2004-0597, June 2004.
32. MOORE, D., PAXSON, V., SAVAGE, S., SHANNON, C., STANIFORD, S., AND WEAVER, N. Inside the Slammer worm. IEEE Security and Privacy 1, 4 (July 2003).
33. NECULA, G., CONDIT, J., HARREN, M., MCPEAK, S., AND WEIMER, W. CCured: Type-Safe Retrofitting of Legacy Software. ACM Transactions on Programming Languages and Systems 27, 3 (May 2005).
34. NEWSOME, J., AND SONG, D. Dynamic taint analysis for automatic detection, analysis and signature generation of exploits on commodity software. In NDSS (Feb. 2005).
35. PINCUS, J., AND BAKER, B. Beyond stack smashing: Recent advances in exploiting buffer overruns. IEEE Security and Privacy 2, 4 (2004), 20-27.
36. ROBERTSON, W., KRUEGEL, C., MUTZ, D., AND VALEUR, F. Run-time Detection of Heap-based Overflows. In USENIX conference on System administration (2003).
37. RUWASE, O., AND LAM, M. A practical dynamic buffer overflow detector. In NDSS (Feb. 2004).
38. SHANKAR, U., TALWAR, K., FOSTER, J. S., AND WAGNER, D. Detecting format string vulnerabilities with type qualifiers. In USENIX Security Symposium (Aug. 2001).
39. SMIRNOV, A., AND CHIUEH, T. DIRA: Automatic detection, identification, and repair of control-hijacking attacks. In NDSS (Feb. 2005).
40. SPEC. SPEC Benchmarks. http://www.spec.org.
41. WAGNER, D., AND DEAN, D. Intrusion Detection via Static Analysis. In IEEE Symposium on Security and Privacy (May 2001).
42. WAGNER, D., FOSTER, J. S., BREWER, E. A., AND AIKEN, A. A first step towards automated detection of buffer overrun vulnerabilities. In NDSS (2000).
43. WILANDER, J., AND KAMKAR, M. A comparison of publicly available tools for dynamic buffer overflow prevention. In NDSS (Feb. 2003).
44. XU, W., BHATKAR, S., AND SEKAR, R. Taint-enhanced policy enforcement: A practical approach to defeat a wide range of attacks. In USENIX Security (2006).
45. XU, W., DUVARNEY, D. C., AND SEKAR, R. An efficient and backwards-compatible transformation to ensure memory safety of c programs. SIGSOFT Softw. Eng. Notes 29, 6 (2004), 117-126.
46. YONG, S. H., AND HORWITZ, S. Protecting C programs from attacks via invalid pointer dereferences. In European Software Engineering Conference (2003).
47. YONG, S. H., AND HORWITZ, S. Pointer-Range Analysis. In Static Analysis Symposium (2004).