Art der Publikation: Beitrag in Sammelwerk

Dynamic integrity measurement and attestation: Towards defense against return-oriented programming attacks

Autor(en):

Davi, Lucas; Sadeghi, Ahmad-Reza; Winandy, Marcel

Titel des Sammelbands:

Proc. of 4th ACM Workshop on Scalable Trusted Computing (STC)

Veröffentlichung:

2009

Digital Object Identifier (DOI):

doi:10.1145/1655108.1655117

Link zum Volltext:

https://dl.acm.org/authorize?N28544

Zitation:

Download BibTeX

Kurzfassung

Despite the many efforts made in recent years to mitigate runtime attacks such as stack and heap based buffer overflows, these attacks are still a common security concern in today's computing platforms. Attackers have even found new ways to enforce runtime attacks including use of a technique called return-oriented programming. Trusted Computing provides mechanisms to verify the integrity of all executable content in an operating system. But they only provide integrity at load-time and are not able to prevent or detect runtime attacks. To mitigate return-oriented programming attacks, we propose new runtime integrity monitoring techniques that use tracking instrumentation of program binaries based on taint analysis and dynamic tracing. We also describe how these techniques can be employed in a dynamic integrity measurement architecture (DynIMA). In this way we fill the gap between static load-time and dynamic runtime attestation and, in particular, extend trusted computing techniques to effectively defend against return-oriented programming attacks.