International Journal of Information Technology and Computer Science (IJITCS)
IJITCS Vol. 1, No. 1, 8 Oct. 2009
Cover page and Table of Contents: PDF (size: 194KB)
A System Call Randomization Based Method for Countering Code-Injection Attacks
Full Text (PDF, 194KB), PP.1-7
Views: 0 Downloads: 0
Author(s)
Zhaohui Liang
1,*
Bin Liang
1
Lupin Li
2
Index Terms
Information security, code-injection attack, system call randomization
Abstract
Code-injection attacks pose serious threat to today’s Internet. The existing code-injection attack defense methods have some deficiencies on performance overhead and effectiveness. To this end, we propose a method that uses system called randomization to counter code injection attacks based on instruction set randomization idea. System calls must be used when an injected code would perform its actions. By creating randomized system calls of the target process, an attacker who does not know the key to the randomization algorithm will inject code that isn’t randomized like as the target process and is invalid for the corresponding de-randomized module. The injected code would fail to execute without calling system calls correctly. Moreover, with extended complier, our method creates source code randomization during its compiling and implements binary executable files randomization by feature matching. Our experiments on built prototype show that our method can effectively counter variety code injection attacks with low-overhead.
Cite This Paper
Zhaohui Liang, Bin Liang, Lupin Li, "A System Call Randomization Based Method for Countering Code-Injection Attacks", International Journal of Information Technology and Computer Science(IJITCS), vol.1, no.1, pp.1-7, 2009. DOI: 10.5815/ijitcs.2009.01.01
Reference
[1] Elena Gabriela Barrantes, David H. Ackley,Stephanie Forrest, Trek S. Palmer, Darko Stefanovi′c, and Dino Dai Zovi. Randomized Instruction Set Emulation to Disrupt Binary Code Injection Attacks. In Proceedings of the 10th ACM Conference on Computer and Communications Security (CCS 2003), P. 281–289, Washington DC, Oct. 2003.
[2] Gaurav S. Kc, Angelos D. Keromytis, and Vassilis Prevelakis. Countering Code-Injection Attacks With Instruction-Set Randomization. In Proceedings of the 10th ACM Conference on Computerand Communications Security (CCS 2003), P.272–280, Washington DC, Oct. 2003.
[3] Elena Gabriela Barrantes, David H. Ackley, Stephanie Forrest, Darko Stefanovic, and Dino Dai Zovi, “Randomized Instruction Set Emulation to Disrupt Binary Code Injection Attacks,” ACM Transactions on Information and System Security, 2005.
[4] Stelios Sidiroglou, Michael E. Locasto, Stephen W. Boyd, and Angelos D. Keromytis, “Building a Reactive Immune System for Software Services,” In Proceedings of the USENIX Annual Technical Conference, P.149 - 161, Anaheim, CA, April 2005.
[5] Noritaka Osawa. A Smart Virtual Machine for Heterogeneous Distributed Environments: PivotVM. Transactions on Information Processing Society of Japan, 40(6):2543–2552, June 1999.
[6] PaX Team: PaX address space layout randomization (ASLR). http://pax.grsecurity.net/docs/aslr.txt.
[7] Sandeep Bhatkar, Daniel C. DuVarney, and R. Sekar. Address Obfuscation: An Ef_cient Approach to Combat a Broad Range of Memory Error Exploits. Proceedings of the 12th USENIX Security Symposium, Washington, DC, USA, August 2003.
[8] Sandeep Bhatkar, R. Sekar, and Daniel C. DuVarney. Ef_cient Techniques for Comprehensive Protection from Memory Error Exploits. Proceedings of the 14th USENIX Security Symposium 2005 , Baltimore, August 2005.
[9] Jun Xu, Zbigniew Kalbarczyk, and Ravishankar K. Iyer. Transparent Runtime Randomization for Security. In Proc. of 22nd Symposium on Reliable and Distributed Systems (SRDS) , Florence, Italy, October 2003.
[10] Michal Bucko, Exploitation for Phun and Profit, HACKPL Security Lab
[11] Xuxian Jiang, Helen J.Wang et al, RandSys:Thwarting Code Injection Attacks with System Service Interface Randomization, Reliable Distributed Systems, page 209-218, 2007
[12] Crispan Cowan, Calton Pu, Dave Maier, Jonathan Walpole, Peat Bakke, Steve Beattie, Aaron Grier, Perry Wagle, and Qian Zhang. StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks. In Proceedings of the 7th USENIX Security Symposium, pages 63–78, San Antonio, January 1998.
[13] Perry Wagle and Crispin Cowan. StackGuard:Simple Stack Smash Protection for GCC. In Proceedings of the GCC Developers Summit, pages 243–255, Ottawa, Canada, May 2003.
[14] Perry Wagle and Crispin Cowan. StackGuard: Simple Stack Smash Protection for GCC. In Proceedings of the GCC Developers Summit, P.243–255, Ottawa, Canada, May 2003.
[15] Monica Chew and Dawn Song. Mitigating Buffer Overflows by Operating System Randomization.Technical Report CMU-CS-02-197, Carnegie Mellon University, December 2002.
[16] Yoshihiro Oyama, Akinori Yonezawa, Prevention of Code-Injection Attacks by Encrypting System Call Arguments, Technical Report TR06-01,The Univ. of Tokyo,2006