Browsing by Subject "Return-oriented programming"

Now showing 1 - 2 of 2

Open Access
G-free: Defeating return-oriented programming through gadget-less binaries
(ACM, 2010-12) Onarlıoğlu, Kaan; Bilge, L.; Lanzi, A.; Balzarotti, D.; Kirda, E.
Despite the numerous prevention and protection mechanisms that have been introduced into modern operating systems, the exploitation of memory corruption vulnerabilities still represents a serious threat to the security of software systems and networks. A recent exploitation technique, called Return-Oriented Programming (ROP), has lately attracted a considerable attention from academia. Past research on the topic has mostly focused on refining the original attack technique, or on proposing partial solutions that target only particular variants of the attack. In this paper, we present G-Free, a compiler-based approach that represents the first practical solution against any possible form of ROP. Our solution is able to eliminate all unaligned free-branch instructions inside a binary executable, and to protect the aligned free-branch instructions to prevent them from being misused by an attacker. We developed a prototype based on our approach, and evaluated it by compiling GNU libc and a number of real-world applications. The results of the experiments show that our solution is able to prevent any form of return-oriented programming. © 2010 ACM.
Open Access
Immunizing binary executables against return-oriented programming
(2010) Onarlıoğlu, Kaan
Despite the numerous prevention and protection mechanisms that have been introduced into modern operating systems, the exploitation of memory corruption vulnerabilities still represents a serious threat to the security of software systems and networks. A recent exploitation technique, called Return-Oriented Programming (ROP), has lately attracted a considerable attention from academia. ROP attacks utilize short code sequences each ending with a free-branch instruction, i.e. an instruction that allows the attacker to control the execution flow. Identifying such sequences, or gadgets, available in binary executables and chaining them together, it is possible to perform arbitrary computations. Past research on the topic has mostly focused on refining the original attack technique, or on proposing partial solutions that target only particular variants of the attack. In this work, we present a compiler-based approach that represents the first practical solution against any possible form of ROP. Our solution is able to protect the aligned free-branch instructions to prevent them from being misused by an attacker, and to eliminate all unaligned free-branch instructions inside a binary executable. We developed a prototype based on our approach for the x86 architecture, and evaluated it by compiling GNU libc and a number of real-world applications. The results of the experiments demonstrate that our solution is able to prevent any form of returnoriented programming attack.