Dynamic integrity measurement and attestation: Towards defense against return-oriented programming attacks

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2009, Pages 49-54

  Davi, Lucas ^a   Sadeghi, Ahmad Reza ^a   Winandy, Marcel ^a  

^a RUHR UNIVERSITY BOCHUM   (Germany)

Author keywords

Attestation systems; Integrity monitoring; Return oriented programming

Indexed keywords

BUFFER OVERFLOWS; COMPUTING PLATFORM; DYNAMIC INTEGRITY; INTEGRITY MONITORING; OPERATING SYSTEMS; PROGRAM BINARY; RUNTIMES; STATIC LOADS; TRUSTED COMPUTING;

COMPUTER OPERATING SYSTEMS; DYNAMIC ANALYSIS; FIBER OPTIC SENSORS; NETWORK SECURITY; QUALITY ASSURANCE; SPACE TIME ADAPTIVE PROCESSING;

MONITORING;

EID: 74049136385     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1655108.1655117     Document Type: Conference Paper

References (36)

1. M. Abadi, M. Budiu, U. Erlingsson, and J. Ligatti. Control-fow integrity: Principles, implementations, and applications. In CCS '05: Proceedings of the 12th ACM Conference on Computer and Communications Security, pages 340-353. ACM, 2005.
2. Aleph One. Smashing the stack for fun and profit. Phrack Magazine, 49(14), 1996.
3. W. A. Arbaugh, D. J. Farber, and J. M. Smith. A secure and reliable bootstrap architecture. In Proceedings of the IEEE Symposium on Research in Security and Privacy, pages 65-71, Oakland, CA, May 1997. IEEE Computer Society.
4. S. Bratus, M. E. Locasto, A. Ramaswamy, and S. W. Smith. New directions for hardware-assisted trusted computing policies. In Conference on the Future of Trust in Computing (FTC 2008), June 2008. http: //www.cs.dartmouth.edu/ ~sws/pubs/berlin.pdf.
5. E. Buchanan, R. Roemer, H. Shacham, and S. Savage. When good instructions go bad: generalizing return-oriented programming to RISC. In CCS '08: Proceedings of the 15th ACM conference on Computer and communications security, pages 27-38. ACM, 2008.
6. B. M. Cantrill, M. W. Shapiro, and A. H. Leventhal. Dynamic instrumentation of production systems. In Proceedings of USENIX 2004 Annual Technical Conference, pages 15-28, Berkeley, CA, USA, 2004. USENIX Association.
7. W. Chang, B. Streiff, and C. Lin. Efficient and extensible security enforcement using dynamic data flow analysis. In CCS '08: Proceedings of the 15th ACM Conference on Computer and Communications Security, pages 39-50. ACM, 2008.
8. W. Cheng, Q. Zhao, B. Yu, and S. Hiroshige. Tainttrace: Efficient flow tracing with dynamic binary rewriting. In Proceedings of the 11th IEEE Symposium on Computers and Communications (ISCC 2006), pages 749-754. IEEE, 2006.
9. J. Clause, W. Li, and A. Orso. Dytan: A generic dynamic taint analysis framework. In Proceedings of the 2007 International Symposium on Software Testing, pages 196-206, 2007.
10. J. R. Crandall and F. T. Chong. Minos: Control data attack prevention orthogonal to memory model. In Proceedings of the 37th International Symposium on Microarchitecture, pages 221-232, 2004.
11. M. Dalton, H. Kannan, and C. Kozyrakis. Raksha: A exible information flow architecture for software security. In Proceedings of the 34th International Symposium on Computer Architecture, pages 482-493, 2007.
12. V. Haldar, D. Chandra, and M. Franz. Semantic remote attestation: A virtual machine directed approach to trusted computing. In USENIX Virtual Machine Research and Technology Symposium, 2004.
13. Internet Crime Complaint Center. 2008 Internet Crime Report. http://www.ic3.gov/media/annualreport/2008-IC3Report.pdf, 2008.
14. T. Jaeger, R. Sailer, and U. Shankar. Prima: policy-reduced integrity measurement architecture. In SACMAT '06: Proceedings of the eleventh ACM symposium on Access control models and technologies, pages 19-28, New York, NY, USA, 2006. ACM.
15. S. Jiang, S. Smith, and K. Minami. Securing web servers against insider attack. In 17th Annual Computer Security Applications Conference (ACSAC), pages 265-276, 2001.
16. C. Kil, E. C. Sezer, A. M. Azab, P. Ning, and X. Zhang. Remote attestation to dynamic system properties: Towards providing complete system integrity evidence. In Proceedings of the 39th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN 2009), 2009. to appear.
17. U. Kühn, M. Selhorst, and C. Stüble. Realizing property-based attestation and sealing with commonly available hard- and software. In STC '07: Proceedings of the 2nd ACM Workshop on Scalable Trusted Computing, pages 50-57. ACM Press, 2007.
18. L. C. Lam and T.-C. Chiueh. A general dynamic information flow tracking framework for security applications. In Proceedings of the 22nd Annual Computer Security Applications Conference, pages 463-472. IEEE Computer Society, 2006.
19. P. A. Loscocco, P. W. Wilson, J. A. Pendergrass, and C. D. McDonell. Linux kernel integrity measurement using contextual inspection. In Proceedings of the 2nd ACM Workshop on Scalable Trusted Computing (STC'07), pages 21-29. ACM, 2007.
20. C.-K. Luk, R. Cohn, R. Muth, H. Patil, A. Klauser, G. Lowney, S. Wallace, V. J. Reddi, and K. Hazelwood. Pin: building customized program analysis tools with dynamic instrumentation. In PLDI '05: Proceedings of the 2005 ACM SIGPLAN conference on Programming language design and implementation, volume 40, pages 190-200, New York, NY, USA, June 2005. ACM Press.
21. R. Macdonald, S. Smith, J. Marchesini, and O. Wild. Bear: An open-source virtual secure coprocessor based on TCPA. Technical Report TR2003-471, Department of Computer Science, Dartmouth College, 2003.
22. Microsoft Corporation. Bitlocker drive encryption, July 2007. http://www.microsoft.com/technet/ windowsvista/security/bitlockr.mspx.
23. J. Newsome and D. Song. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In Proceedings of the Network and Distributed Security Symposium, 2005.
24. PaX Team. http://pax.grsecurity.net/.
25. N. L. Petroni, Jr. and M. Hicks. Automated detection of persistent kernel control-flow attacks. In CCS '07: Proceedings of the 14th ACM Conference on Computer and Communications Security, pages 103-115. ACM, 2007.
26. J. Poritz, M. Schunter, E. Van Herreweghen, and M. Waidner. Property attestation - scalable and privacy-friendly security assessment of peer computers. Technical Report RZ 3548, IBM Research, May 2004.
27. F. Qin, C. Wang, Z. Li, H. seop Kim, Y. Zhou, and Y. Wu. LIFT: A low-overhead information flow tracking system for detecting security attacks. In Proceedings of the 39th Annual IEEE/ACM Symposium on Microarchitecture, pages 135-148, 2006.
28. A.-R. Sadeghi and C. Stüble. Property-based attestation for computing platforms: Caring about properties, not mechanisms. In The 2004 New Security Paradigms Workshop, pages 67-77. ACM, 2004.
29. R. Sailer, X. Zhang, T. Jaeger, and L. van Doorn. Design and implementation of a TCG-based integrity measurement architecture. In Proceedings of the 13th USENIX Security Symposium, pages 223-238, 2004.
30. SANS Institute. SANS Top-20 2007 Security Risks. http://www.sans.org/ top20/2007/top20.pdf, Nov. 2007.
31. H. Shacham. The geometry of innocent esh on the bone: Return-into-libc without function calls (on the x86). In CCS '07: Proceedings of the 14th ACM Conference on Computer and Communications Security, pages 552-561. ACM, 2007.
32. Solar Designer. "return-to-libc" attack. Bugtraq, 1997.
33. G. E. Suh, J. W. Lee, D. Zhang, and S. Devadas. Secure program execution via dynamic information ow tracking. In ASPLOS-XI: Proceedings of the 11th International Conference on Architectural Support for Programming Languages and Operating Systems, pages 85-96. ACM, 2004.
34. Tiller Beauchamp and David Weston. Dtrace: The reverse engineer's unexpected swiss army knife. http://www.poppopret.org/ DTrace-Beauchamp-Weston. pdf, 2008.
35. Trusted Computing Group. TPM main specification. Specification Version 1.2 rev. 103, July 2007. https: //www.trustedcomputinggroup.org/specs/TPM/.
36. W. Xu, S. Bhatkar, and R. Sekar. Taint-enhanced policy enforcement: A practical approach to defeat a wide range of attacks. In Proceedings of the 15th USENIX Security Symposium, pages 121-136, 2006.