Counterfeit Object-oriented Programming: On the Difficulty of Preventing Code Reuse Attacks in C++ Applications

Abstract

Code reuse attacks such as return-oriented programming (ROP) have become prevalent techniques to exploit memory corruption vulnerabilities in software programs. A variety of corresponding defenses has been proposed, of which some have already been successfully bypassed-and the arms race continues.In this paper, we perform a systematic assessment of recently proposed CFI solutions and other defenses against code reuse attacks in the context of C++. We demonstrate that many of these defenses that do not consider object-oriented C++ semantics precisely can be generically bypassed in practice. Our novel attack technique, denoted as counterfeit object-oriented programming (COOP), induces malicious program behavior by only invoking chains of existing C++ virtual functions in a program through corresponding existing call sites. COOP is Turing complete in realistic attack scenarios and we show its viability by developing sophisticated, real-world exploits for Internet Explorer 10 on Windows and Firefox 36 on Linux. Moreover, we show that even recently proposed defenses (CPS, T-VIP, vfGuard, and VTint) that specifically target C++ are vulnerable to COOP. We observe that constructing defenses resilient to COOP that do not require access to source code seems to be challenging. We believe that our investigation and results are helpful contributions to the design and implementation of future defenses against controlflow hijacking attacks.

VTrust: Regaining Trust on Virtual Calls

“…The COOP (Counterfeit Object-oriented Programming) attack proposed by Schuster et.al. [28] introduces a specific type of VTable reuse attack. By stitching several virtual functions, attackers may execute arbitrary code.…”

“…Modern compilers place VTables in read-only sections, defeating VTable corruption attacks by default. But VTable injection attacks are still one of the most popular attacks, and VTable reuse attacks are also practical and hard to defeat [28].…”

“…VTint [27] uses binary rewriting to protect the integrity of VTables, and blocks corrupted or injected VTables from being used, but fails to protect against VTable reuse attacks. The research paper COOP [28] shows that VTable reuse attacks are practical and even Turing-complete in real applications. Illustration of VTrust's overall defense.…”

“…It introduces a very low performance overhead, e.g., 0.31% for Firefox and 0.72% for SPEC2006. It is able to defeat all VTable reuse attacks, including the COOP attack [28]. It is also able to defeat all VTable injection attacks, if target applications do not have writable code (e.g., dynamically generated code).…”

Hardware-Assisted System for Program Execution Security of SOC

“…It's a software-based approach to detect attacks. Recently Schuster et al [2] came up with a new type of attack, called counterfeit object-oriented programming (COOP).…”