MoRE

Torrey, Jacob

doi:10.1145/2602087.2602105

Proceedings of the 9th Annual Cyber and Information Security Research Conference on - CISR '14 2014

DOI: 10.1145/2602087.2602105

|View full text |Cite

Jacob Torrey

Abstract: MoRE, or Measurement of Running Executables, was a DARPA Cyber Fast Track effort to study the feasibility of utilizing x86 translation look-aside buffer (TLB) splitting techniques for realizing periodic measurements of running and dynamically changing applications. Currently, there are certain applications that interleave code and data that cannot be meaningfully measured during execution due to their polymorphic/dynamically changing nature. This lack of meaningful measurement is a weakness in trusted computin… Show more

Help me understand this report

Search citation statements

Order By: Relevance

Paper Sections

Select...

Citation Types

Supporting

Mentioning

Contrasting

Year Published

2015

Publication Types

Select...

Other1

Relationship

Self Cite0

Independent1

Authors

Journals

Cited by 1 publication

References 1 publication

Supporting

Mentioning

Contrasting

Order By: Relevance

HideM

Gionta

Enck

Ning

2015

Proceedings of the 5th ACM Conference on Data and Application Security and Privacy

View full text Add to dashboard Cite

Memory disclosure vulnerabilities have become a common component for enabling reliable exploitation of systems by leaking the contents of executable data. Previous research towards protecting executable data from disclosure has failed to gain popularity due to large performance penalties and required architectural changes. Other research has focused on protecting application data but fails to consider a vulnerable application that leaks its own executable data.In this paper we present HideM, a practical system for protecting against memory disclosures in contemporary commodity systems. HideM addresses limitations in existing advanced security protections (e.g., fine-grained ASLR, CFI) wherein an adversary discloses executable data from memory, reasons about protection weaknesses, and builds corresponding exploits. HideM uses the split-TLB architecture, commonly found in CPUs, to enable fine-grained execute and read permission on memory. HideM enforces finegrained permission based on policy generated from binary structure thus enabling protection of Commercial-Off-TheShelf (COTS) binaries. In our evaluation of HideM, we find application overhead ranges from a 6.5% increase to a 2% reduction in runtime and observe runtime memory overhead ranging from 0.04% to 25%. HideM requires adversaries to guess ROP gadget locations making exploitation unreliable. We find adversaries have less than a 16% chance of correctly guessing a single gadget across all 28 evaluated applications. Thus, HideM is a practical system for protecting vulnerable applications which leak executable data.

show abstract

HideM

Gionta

Enck

Ning

2015

Proceedings of the 5th ACM Conference on Data and Application Security and Privacy

View full text Add to dashboard Cite

show abstract

scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.

Contact Info

hi@scite.ai

10624 S. Eastern Ave., Ste. A-614

Henderson, NV 89052, USA

Blog Terms and Conditions API Terms Privacy Policy Contact Cookie Preferences Do Not Sell or Share My Personal Information

Made with 💙 for researchers

Part of the Research Solutions Family.

MoRE

Cited by 1 publication

References 1 publication

HideM

HideM

Contact Info

Product

Resources

About