Hiding in the Particles: When Return-Oriented Programming Meets Program Obfuscation

Borrello, Pietro; Coppa, Emilio; D’Elia, Daniele Cono

doi:10.1109/dsn48987.2021.00064

Cited by 5 publications

(4 citation statements)

References 58 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In more detail, we look up or introduce suitable gadgets in the target DLL for one instruction at a time, and wrap constructs like conditional transfers and API calls with templates. Promoting stack variables to global storage in the design sidesteps difficulties that would emerge here and that are known in the ROP practice, as in general translating stack manipulations may require non-trivial program analyses or the use of a parallel stack [4]. While implementing a fully automated translation goes beyond the scope of proving the effectiveness of Rope in avoiding detection, we believe it is a realistic goal also in light of the recent advances in ROP-based program obfuscation [4,32].…”

Section: Methodsmentioning

confidence: 99%

“…Hence, we make the Rope loader create another transacted file on a signed Microsoft DLL, add to it any required gadgets using code caves, and embed also the bootstrap component (as a ROP chain or even as a shellcode placed in RX caves) in it 4 . Then we create a section object and duplicate the handle to it.…”

Section: Methodsmentioning

confidence: 99%

“…Promoting stack variables to global storage in the design sidesteps difficulties that would emerge here and that are known in the ROP practice, as in general translating stack manipulations may require non-trivial program analyses or the use of a parallel stack [4]. While implementing a fully automated translation goes beyond the scope of proving the effectiveness of Rope in avoiding detection, we believe it is a realistic goal also in light of the recent advances in ROP-based program obfuscation [4,32]. Also, capable attackers have already written and released fully-ROP malware in the past [14,9].…”

Section: Methodsmentioning

confidence: 99%

“…For instance, a solution may look for repeated gadget sequences used to invoke API calls or for the arrangement of typical constants as API call arguments. On the other hand, attackers may experiment with gadgets more complex than the ones we use in Rope, for instance by playing with gadget diversification and dynamically dead code [4]. We observe that in this setting ROP-aware analyses may serve a more general purpose, as the recent availability of systems for encoding whole programs in ROP for obfuscation [4,32] may also encourage threat actors to experiment more with ROP in standalone malware too (e.g., for polymorphism [34]).…”

Section: Countermeasures and Wrap-upmentioning

confidence: 99%

See 3 more Smart Citations

Rope: Covert Multi-process Malware Execution with Return-Oriented Programming

D’Elia

Invidia

Querzoni

2021

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Distributed execution designs challenge behavioral analyses of anti-malware solutions by spreading seemingly benign chunks of a malicious payload to multiple processes. Researchers have explored methods to chop payloads, spread chunks to victim applications through process injection techniques, and orchestrate the execution. However, these methods can hardly be practical as they exhibit conspicuous features and make use of primitives that anti-malware solutions and operating system mitigations readily detect. In this paper we reason on fundamental requirements and properties for a stealth implementation of distributed malware. We propose a new covert design, Rope, that minimizes its footprint by making use of commodity techniques like transacted files and return-oriented programming for covert communication and payload distribution. We report on how synthetic Rope samples eluded a number of state-of-the-art anti-virus and endpoint security solutions, and bypassed the opt-in mitigations of Windows 10 for hardening applications. We then discuss directions and practical remediations to mitigate such threats.

show abstract

Section: Methodsmentioning

confidence: 99%

Section: Methodsmentioning

confidence: 99%