AVRAND: A Software-Based Defense Against Code Reuse Attacks for AVR Embedded Devices

Abstract

Abstract. Code reuse attacks are advanced exploitation techniques that constitute a serious threat for modern systems. They profit from a control flow hijacking vulnerability to maliciously execute one or more pieces of code from the targeted application. ASLR and Control Flow Integrity are two mechanisms commonly used to deter automated attacks based on code reuse. Unfortunately, none of these solutions are suitable for modified Harvard architectures such as AVR microcontrollers. In this work, we present a code reuse attack against embedded AVR devices that shows how an adversary can execute arbitrary code reused from the firmware and other external libraries. We then propose a software-based defense based on fine-grained random permutations of the code memory. Our solution is installed in the bootloader section of the embedded device and thus executes during every device reset. We also propose a self-obfuscation technique to hinder code-reuse attacks against the bootloader.

Securing Real-Time Microcontroller Systems through Customized Memory View Switching

“…In this respect, we believe that such security threats against real-time MCS are realistic and require immediate attentions from security communities. There have been numerous memory corruption vulnerabilities in such systems [1]-[4], [40], [49]. In addition to the memory corruption issues that we discovered from the real-time MCS that we tested ( §VI-B1), we also observed that almost 50% of all security-related patches on the MCS firmware were related to resolving memory corruption vulnerabilities [19].…”

“…In addition, all software modules, such as applications, libraries, device drivers, and the OS, are executed in the same privilege mode (i.e., the privileged mode) and have access to the entire shared memory space. This makes the memory space a large attack surface open to attackers who could successfully compromise any of the software modules by exploiting a memory corruption vulnerability in real-time MCS, as demonstrated in previous incidents [1]-[4], [40], [49]. For instance, an attacker may exploit a buffer overflow vulnerability in a telnet server through Wi-Fi in a UAV [40] and navigate through the memory space to corrupt critical software and hardware components, such as the flight control program and actuators, to maliciously operate the vehicle.…”

CFI CaRE: Hardware-Supported Call and Return Enforcement for Commercial Microcontrollers

“…Francillon et al [22] propose a similar hardware architecture in which the safe-stack is accessible only to return and call instructions. AVRAND by Pastrana et al [44] constitutes a software-based defense against code reuse attacks for AVR devices. HAFIX [15] is a hardware-based CFI solution for the Intel Siskiyou Peak and SPARC embedded system architectures.…”