Fast and practical instruction-set randomization for commodity systems

Abstract

Instruction-set randomization (ISR) is a technique based on randomizing the "language" understood by a system to protect it from code-injection attacks. Such attacks were used by many computer worms in the past, but still pose a threat as it was confirmed by the recent Conficker worm outbreak, and the latest exploits targeting some of Adobe's most popular products. This paper presents a fast and practical implementation of ISR that can be applied on currently deployed software. Our solution builds on a binary instrumentation tool to provide an ISR-enabled execution environment entirely in software. Applications are randomized using a simple XOR function and a 16-bit key that is randomly generated every time an application is launched. Shared libraries can be also randomized using separate keys, and their randomized versions can be used by all applications running under ISR. Moreover, we introduce a key management system to keep track of the keys used in the system. To the best of our knowledge we are the first to apply ISR on truly shared libraries.Finally, we evaluate our implementation using real applications including the Apache web server, and the MySQL database server. For the first, we show that our implementation has negligible overhead (less than 1%) for static HTML loads, while the overhead when running MySQL can be as low as 75%. We see that our system can be used with little cost with I/O intensive network applications, while it can also be a good candidate for deployment with CPU intensive applications, in scenarios where security outweighs performance.

Eternal War in Software Security: A Survey of Control Flow Protection

“…Of course, changing the order of instruction storing must ensure that the topology order of execution is maintained or the results are unchanged. [30] presented the basic-block granularity randomization, [31] presented the basic-block's internal instruction granularity randomization.…”

Improving Resilience by Deploying Permuted Code onto Physically Unclonable Unique Processors

“…Portokalidis et al [15] use a similar approach to RISE, based on the Intel PIN dynamic binary rewriting tool. They use a database of keys, to randomize every loaded code image in a different way.…”

Towards a Mobile Malware Detection Framework with the Support of Machine Learning

“…However, lately systems' security have been highly enhanced by introducing different solutions [2,3] either at operating system or at application layer works, malware detection as a part of it is still an on-going and challenging research problem. Various research works [4,5] have shown that not only malicious software (malware) can get access to private information but also goodware might try to invade to users' digital space as it is considered the main asset for digital business in this new era, and consequently can threaten their private sphere.…”