Locking down insecure indirection with hardware-based control-data isolation

Proceedings of the Annual International Symposium on Microarchitecture, MICRO

Volumn 05-09-December-2015, Issue , 2015, Pages 115-127

  Arthur, William ^a   Madeka, Sahil ^a   Das, Reetuparna ^a   Austin, Todd ^a  

^a UNIVERSITY OF MICHIGAN   (United States)

Author keywords

CFG inegrity; control data isolation; control flow attack; indirect control flow; program transformation; secure computation; security architectures; security policies; software vulnerabilities

Indexed keywords

COMPUTER ARCHITECTURE; LOCKS (FASTENERS); PROGRAM COMPILERS; SECURITY OF DATA; SECURITY SYSTEMS;

CFG INEGRITY; CONTROL DATA; CONTROL FLOWS; INDIRECT CONTROL; PROGRAM TRANSFORMATIONS; SECURE COMPUTATION; SECURITY ARCHITECTURE; SECURITY POLICY; SOFTWARE VULNERABILITIES;

METADATA;

EID: 84959886547     PISSN: 10724451     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2830772.2830801     Document Type: Conference Paper

References (29)

1. J. Demme, M. Maycock, J. Schmitz, A. Tang, A. Waksman, S. Sethumadhavan, and S. Stolfo, "On the feasibility of online malware detection with performance counters, " in Proceedings of the 40th Annual International Symposium on Computer Architecture, ISCA '13, (New York, NY, USA), pp. 559-570, ACM, 2013.
2. Gartner [online], " 2013.
3. W. Arthur, B. Mehne, R. Das, and T. Austin, "Getting in control of your control ow with control-data isolation, " in Code Generation and Optimization (CGO), 2015 IEEE/ACM International Symposium on, pp. 79-90, Feb 2015.
4. C. Cowan, C. Pu, D. Maier, J. Walpole, P. Bakke, S. Beattie, A. Grier, P. Wagle, and Q. Zhang, "Stackguard: Automatic adaptive detection and prevention of buffer-overow attacks, " in Proceedings of the 7th USENIX Security Symposium, (Berkeley, CA, USA), USENIX Association, 1998.
5. C. Cowan, S. Beattie, J. Johansen, and P. Wagle, "Pointguardtm: Protecting pointers from buffer overow vulnerabilities, " in Proceedings of the 12th Conference on USENIX Security Symposium-Volume 12, SSYM'03, (Berkeley, CA, USA), pp. 7-7, USENIX Association, 2003.
6. V. Kiriansky, D. Bruening, S. P. Amarasinghe, et al., "Secure execution via program shepherding., " in USENIX Security Symposium, vol. 92, 2002.
7. M. Abadi, M. Budiu, U. Erlingsson, and J. Ligatti, "Control-ow integrity, " in ACM Conference on Computer and Communication Security (CCS), no. MSR-TR-2005-18, (Alexandria, VA), pp. 340-353, November 2005.
8. Y. Cheng, Z. Zhou, M. Yu, X. Ding, and R. H. Deng, "A generic and practical approach for defending against rop attacks, " in Symposium on Network and Distributed System Security (NDSS 2014), 2014.
9. I. Fratric, "Ropguard: Runtime prevention of return-oriented programming attacks, " 2012.
10. Microsoft enhanced mitigation experience toolkit [online], " 2014.
11. V. Pappas, M. Polychronakis, and A. D. Keromytis, "Transparent rop exploit mitigation using indirect branch tracing., " in USENIX Security, pp. 447-462, 2013.
12. Y. Shi, S. Dempsey, and G. Lee, "Architectural support for run-time validation of control ow transfer, " in Computer Design, 2006. ICCD 2006. International Conference on, pp. 506-513, Oct 2006.
13. Y. Xia, Y. Liu, H. Chen, and B. Zang, "Cfimon: Detecting violation of control ow integrity using performance counters, " in Dependable Systems and Networks (DSN), 2012 42nd Annual IEEE/IFIP International Conference on, pp. 1-12, June 2012.
14. C. Zhang, T. Wei, Z. Chen, L. Duan, L. Szekeres, S. McCamant, D. Song, and W. Zou, "Practical control ow integrity and randomization for binary executables, " in Security and Privacy (SP), 2013 IEEE Symposium on, pp. 559-573, May 2013.
15. J. Pewny and T. Holz, "Control-ow restrictor: Compiler-based cfi for ios, " in Proceedings of the 29th Annual Computer Security Applications Conference, ACSAC '13, (New York, NY, USA), pp. 309-318, ACM, 2013.
16. M. Farooq, K. Khubaib, and L. John, "Store-load-branch (slb) predictor: A compiler assisted branch prediction for data dependent branches, " in High Performance Computer Architecture (HPCA2013), 2013 IEEE 19th International Symposium on, pp. 59-70, Feb 2013.
17. E. Rohou, B. Swamy, and A. Seznec, "Branch prediction and the performance of interpreters; don't trust folklore, " in Code Generation and Optimization (CGO), 2015 IEEE/ACM International Symposium on, pp. 103-114, Feb 2015.
18. A. Seznec, "A 64-kbytes ittage indirect branch predictor, " in JWAC-2: Championship Branch Prediction, 2011.
19. L. Davi, A.-R. Sadeghi, D. Lehmann, and F. Monrose, "Stitching the gadgets: On the ineffiective ness of coarse-grained control-ow integrity protection, " in 23rd USENIX Security Symposium (USENIX Security 14), (San Diego, CA), pp. 401-416, USENIX Association, Aug. 2014.
20. M. Zhang and R. Sekar, "Control ow integrity for cots binaries, " in Presented as part of the 22nd USENIX Security Symposium (USENIX Security 13), (Washington, D. C.), pp. 337-352, USENIX, 2013.
21. H. Kim, J. Joao, O. Mutlu, C. J. Lee, Y. Patt, and R. Cohn, "Virtual program counter (vpc) prediction: Very low cost indirect branch prediction using conditional branch prediction hardware, " Computers, IEEE Transactions on, vol. 58, pp. 1153-1170, Sept 2009.
22. W. Ghandour and N. Ghandour, "Leveraging dynamic slicing to enhance indirect branch prediction, " in Computer Design (ICCD), 2014 32nd IEEE International Conference on, pp. 292-299, Oct 2014.
23. Z. Xie, D. Tong, M. Huang, X. Wang, Q. Shi, and X. Cheng, "Tap prediction: Reusing conditional branch predictor for indirect branches with target address pointers, " in Computer Design (ICCD), 2011 IEEE 29th International Conference on, pp. 119-126, Oct 2011.
24. N. Binkert, B. Beckmann, G. Black, S. K. Reinhardt, A. Saidi, A. Basu, J. Hestness, D. R. Hower, T. Krishna, S. Sardashti, R. Sen, K. Sewell, M. Shoaib, N. Vaish, M. D. Hill, and D. A. Wood, "The gem5 simulator, " SIGARCH Comput. Archit. News, vol. 39, pp. 1-7, Aug. 2011.
25. Standard performance evaluation corporation[online]. "
26. C. Lattner and V. Adve, "Llvm: A compilation framework for lifelong program analysis transformation, " in Code Generation and Optimization, 2004. CGO 2004. International Symposium on, pp. 75-86, March 2004.
27. S. Li, J. H. Ahn, R. Strong, J. Brockman, D. Tullsen, and N. Jouppi, "Mcpat: An integrated power, area, and timing modeling framework for multicore and manycore architectures, " in Microarchitecture, 2009. MICRO-42. 42nd Annual IEEE/ACM International Symposium on, pp. 469-480, Dec 2009.
28. S. Thoziyoor, N. Muralimanohar, J. H. Ahn, and N. P. Jouppi, "Cacti 5. 1, " HP Laboratories, April, vol. 2, p. 24, 2008.
29. L. Davi, P. Koeberl, and A.-R. Sadeghi, "Hardware-assisted fine-grained control-ow integrity: Towards efficient protection of embedded systems against software exploitation, " in Design Automation Conference (DAC), 2014 51st ACM/EDAC/IEEE, pp. 1-6, June 2014.