Type of Publication: Research report

ROPdefender: A Detection Tool to Defend Against Return-Oriented Programming Attacks

Author(s):

Davi, Lucas; Sadeghi, Ahmad-Reza; Winandy, Marcel

Number of Report or Contribution:

HGI-TR-2010-001

Publication Date:

2010

Link to complete version:

http://www.trust.rub.de/media/trust/veroeffentlichungen/2010/12/14/HGI-TR-2010-001.pdf

Citation:

Download BibTeX

Abstract

Return-oriented programming (ROP) is a technique that enables an adversary to construct malicious programs with the desired behavior by combining short instruction sequences that already reside in the memory space of a program. ROP attacks have already been demonstrated on various processor architectures ranging from PCs to smartphones and special-purpose systems.

In this paper, we present our tool, ROPdefender, that dynamically detects conventional ROP attacks (that are based on return instructions) with a reasonable runtime overhead of 2x. In contrast to existing solutions, (i) ROPdefender does not rely on side information (e.g., source code or debugging information) and (ii) it instruments all return instructions issued during program execution including all returns from dynamic libraries, even if the adversary subverts the control flow by other means. Moreover, ROPdefender can handle Unix signals, non-local control transfers, C++ exceptions, lazy binding, and can be applied to multi-threaded applications such as Mozilla Firefox or Acrobat Reader. Finally our implementation supports mainstream operating systems (Windows and Linux) for the Intel x86 architecture. As proof of concept we show that ROPdefender successfully detects recent Acrobat Reader exploits on Windows.