Out of Control: Overcoming Control-Flow Integrity

Abstract

Abstract-As existing defenses like ALSR, DEP, and stack cookies are not sufficient to stop determined attackers from exploiting our software, interest in Control Flow Integrity (CFI) is growing. In its ideal form, CFI prevents any flow of control that was not intended by the original program, effectively putting a stop to exploitation based on return oriented programming (and many other attacks besides). Two main problems have prevented CFI from being deployed in practice. First, many CFI implementations require source code or debug information that is typically not available for commercial software. Second, in its ideal form, the technique is very expensive. It is for this reason that current research efforts focus on making CFI fast and practical. Specifically, much of the work on practical CFI is applicable to binaries, and improves performance by enforcing a looser notion of control flow integrity. In this paper, we examine the security implications of such looser notions of CFI: are they still able to prevent code reuse attacks, and if not, how hard is it to bypass its protection? Specifically, we show that with two new types of gadgets, return oriented programming is still possible. We assess the availability of our gadget sets, and demonstrate the practicality of these results with a practical exploit against Internet Explorer that bypasses modern CFI implementations.

Missing the Point(er): On the Effectiveness of Code Pointer Integrity

“…(aslr entropy * page size)/libc size Here libc size, in our experiments, is approximately 2 21 . In other words, the estimated number of memory scans is: 2 28 * 2 12 /2 21 = 2 19 .…”

“…On the other hand, experience has shown that low overhead mechanisms that trade off security guarantees for performance (e.g., approximate [48] or partial [5] memory safety) eventually get bypassed [9,52,21,11,17].…”

“…We note that any security mechanism that trades security guarantees for performance may be vulnerable to future attacks. This short term optimization for the sake of practicality is one reason for the numerous attacks on security systems [9,52,21,11,17]. c) Timing Side Channel Defense: One way to defeat attacks that use side channels to disclose memory is to remove execution timing differences.…”

“…For example, control transfer checks are relaxed to allow transfers to any valid jump targets as opposed to the correct target. Unfortunately, these implementations have been shown to be ineffective because they allow enough valid transfers to enable an attacker to build a malicious payload [21].…”

Security Challenges of Small Cell as a Service in Virtualized Mobile Edge Computing Environments

“…For example, the increasing popularity of mobile crowdsourcing and mobile sensing projects [51] may enable an attacker to exploit various personal data such as the user location, mobility patterns or web browsing habits [52]. SDN controller hijacking: By exploiting the SDN controller implementation weaknesses, the adversary tries to divert the control ows to a controlled device [53]. Then the captured messages can be discarded preventing the data plane entities from proper operation.…”