Defending Browsers against Drive-by Downloads: Mitigating Heap-Spraying Code Injection Attacks

Abstract

Abstract. Drive-by download attacks are among the most common methods for spreading malware today. These attacks typically exploit memory corruption vulnerabilities in web browsers and browser plug-ins to execute shellcode, and in consequence, gain control of a victim's computer. Compromised machines are then used to carry out various malicious activities, such as joining botnets, sending spam emails, or participating in distributed denial of service attacks. To counter drive-by downloads, we propose a technique that relies on x86 instruction emulation to identify JavaScript string buffers that contain shellcode. Our detection is integrated into the browser, and performed before control is transfered to the shellcode, thus, effectively thwarting the attack. The solution maintains fair performance by avoiding unnecessary invocations of the emulator, while ensuring that every buffer with potential shellcode is checked. We have implemented a prototype of our system, and evaluated it over thousands of malicious and legitimate web sites. Our results demonstrate that the system performs accurate detection with no false positives.

Detecting Malicious Javascript in PDF through Document Instrumentation

“…Polychronakis et al [23] proposed to execute shellcode in a CPU emulator and detect suspicious memory accesses using four heuristics. Egele et al [24] presented a similar method which identifies potential shellcode at runtime and tests it in libemu [25]. Compared with these methods, we use different and more robust runtime features, which characterize the essential operations required in the infection process.…”

JSGuard: Shellcode Detection in JavaScript

“…A representive work is [18] that uses libemu [28] to detect shellcode in JS strings. The state of the art of dynamic analysis is network-level emulation, which decodes input data into instruction sequences and then emulates their execution [28, [37][38][39].…”

“…1(a) can also be used to evade detection by current dynamic analysis based tools [18,28,[37][38][39]. Given an input stream containing the shellcode shown in Fig.…”

“…We also notice that some tools based on network-level emulation use heuristics based on the GetPC code [24,37] in shellcode detection, e.g., [18] uses libemu [28]. Besides the aforementioned evasion methods, attackers can also evade detection by writing shellcode without call group instruction or fstenv instruction opcodes, e.g., using purely alphanumeric shellcode [31].…”

Cross-Analysis of Botnet Victims: New Insights and Implications

“…In this case, since bots cannot find new victims automatically, malware writers should employ other techniques. They install a malicious binary into compromised web sites and trick people into downloading it (i.e., drive-by-download [12]) or they ask other malware owners, who have pre-installed malware, to distribute their malware (i.e., pay-perinstallation (PPI) [17] [28]). This approach seems to be relatively passive because the operation sequence of this approach may depend on human actions or other tools.…”