Immunizing binary executables against return-oriented programming

Date
2010
Editor(s)
Advisor
Selçuk, Ali Aydın
Supervisor
Co-Advisor
Co-Supervisor
Instructor
Source Title
Print ISSN
Electronic ISSN
Publisher
Bilkent University
Volume
Issue
Pages
Language
English
Journal Title
Journal ISSN
Volume Title
Series
Abstract

Despite the numerous prevention and protection mechanisms that have been introduced into modern operating systems, the exploitation of memory corruption vulnerabilities still represents a serious threat to the security of software systems and networks. A recent exploitation technique, called Return-Oriented Programming (ROP), has lately attracted a considerable attention from academia. ROP attacks utilize short code sequences each ending with a free-branch instruction, i.e. an instruction that allows the attacker to control the execution flow. Identifying such sequences, or gadgets, available in binary executables and chaining them together, it is possible to perform arbitrary computations. Past research on the topic has mostly focused on refining the original attack technique, or on proposing partial solutions that target only particular variants of the attack. In this work, we present a compiler-based approach that represents the first practical solution against any possible form of ROP. Our solution is able to protect the aligned free-branch instructions to prevent them from being misused by an attacker, and to eliminate all unaligned free-branch instructions inside a binary executable. We developed a prototype based on our approach for the x86 architecture, and evaluated it by compiling GNU libc and a number of real-world applications. The results of the experiments demonstrate that our solution is able to prevent any form of returnoriented programming attack.

Course
Other identifiers
Book Title
Citation
Published Version (Please cite this version)