Novel Techniques in Recovering, Embedding, and Enforcing Policies for Control-Flow Integrity

Control-Flow Integrity (CFI) is an attractive security property with which most injected and code-reuse attacks can be defeated, including advanced attacking techniques like return-oriented programming. CFI extracts a control-flow graph (CFG) for a given program, with checks inserted before indirect branch instructions. Before executed during runtime, the checks consult the CFG to ensure that the indirect branch is allowed to reach the intended target. Hence, any sort of control-flow hijacking can be prevented. This concise volume proposes novel solutions to handle the fundamental components of CFI enforcement: accurately recovering the policy (CFG); embedding the CFI policy securely; and efficiently enforcing the CFI policy. Addressing the first component, the book systematically studies two methods that recover CFI policy based on function signature matching at the binary level, then offers a unique rule-and heuristic-based mechanism to more accurately recover function signature. To embed CFI policy securely, the book advocates a new platform that encodes the policy into the machine instructions directly without relying on consulting any read-only data structure. Finally, the work prescribes a mature dynamic-code-optimization platform called DynamoRIO to enforce the policy when needed. Key features:

• Provides deep understanding of Control-Flow Integrity
• Offers new insights on the relationship between function signature and compiler optimization
• Demonstrates how CFI can be more efficient than Data Execution Prevention This focused, distinctive volume will appeal to researchers, scientists, lecturers, as well as postgraduates with a background in binary analysis. Libraries, practitioners, and professionals will also benefit, depending on their missions and programs. Yan Lin is at the School of Computing and Information Systems, Singapore Management University. Her extensive foundational studies have focused on the area of cybersecurity, and her current research focuses on software security and system security.

Auteur
Yan Lin is at the School of Computing and Information Systems, Singapore Management University. Her extensive studies have focused on the area of cybersecurity, and her current researches focus on software security and system security.

Résumé
There are three fundamental components in Control-Flow Integrity (CFI) enforcement. The first component is accurately recovering the policy (CFG). Usually, the more precise the policy is, the more security CFI improves, but precise CFG generation was considered hard without the support of source code. The second component is embedding the CFI policy securely. Current CFI enforcement usually inserts checks before indirect branches to consult a read-only table which stores the valid CFG information. However, this kind of read-only table can be overwritten by some kinds of attacks (e.g., the Rowhammer attack and data-oriented programming). The third component is to efficiently enforce the CFI policy. In current approaches CFI checks are always executed whenever there is an indirect control flow transfer. Therefore, it is critical to minimize the performance impact of CFI checks.
In this book, we propose novel solutions to handle these three fundamental components. To generate a precise CFI policy without the support of the source code, we systematically study two methods which recover CFI policy based on function signature matching at the binary level and propose our novel rule- and heuristic-based mechanism to more accurately recover function signature. To embed CFI policy securely, we design a novel platform which encodes the policy into the machine instructions directly without relying on consulting any read-only data structure, by making use of the idea of instruction-set randomization. Each basic block is encrypted with a key derived from the CFG. To efficiently enforce CFI policy, we make use of a mature dynamic code optimization platform called DynamoRIO to enforce the policy so that we are only required to do the CFI check when needed.

Contenu
{draft, needs completion}

1 Introduction

1.1 Overview of Control-Flow Integrity 1.2 Practicality of Recovering Fine-grained CFI Policies

1.3 Control-Flow Carrying Code

1.4 Control-Flow Integrity Enforcement Based on Dynamic Code Optimization

2 Literature Review

2.1 Control-Flow Hijacking

2.2 Deployed Defenses

2.3 Control-Flow Integrity

3 When Function Signature Recovery Meets Compiler Optimization

3.1 Introduction

3.2 Background and Unified Notation

3.3 Eight Ways in Which Compiler Optimization Impacts Function Signature Recovery

3.4 Evaluation

3.5 Revised Policy

3.6 Evaluation on revised policy

3.7 Summary

4 Control-Flow Carrying Code

4.1 Introduction

4.2 Overview of C^3

4.3 Detailed Designed of C^3

4.4 Implementation

4.5 Evaluation

4.6 Discussion

4.7 Summary

5 Control-Flow Integrity Enforcement with Dynamic Code Optimization

5.1 Introduction

5.2 Design, Implementation, and Security Comparison

5.3 Detailed Performance Profiling

5.4 Security Evaluation

5.5 Summary

6 Conclusion

Bibliography