Art der Publikation: Forschungsbericht

ROPdefender: A Detection Tool to Defend Against Return-Oriented Programming Attacks

Autor(en):

Davi, Lucas; Sadeghi, Ahmad-Reza; Winandy, Marcel

Nummer des Berichts oder Beitrags:

HGI-TR-2010-001

Veröffentlichung:

2010

Link zum Volltext:

http://www.trust.rub.de/media/trust/veroeffentlichungen/2010/12/14/HGI-TR-2010-001.pdf

Zitation:

Download BibTeX

Kurzfassung

Return-oriented programming (ROP) is a technique that enables an adversary to construct malicious programs with the desired behavior by combining short instruction sequences that already reside in the memory space of a program. ROP attacks have already been demonstrated on various processor architectures ranging from PCs to smartphones and special-purpose systems.

In this paper, we present our tool, ROPdefender, that dynamically detects conventional ROP attacks (that are based on return instructions) with a reasonable runtime overhead of 2x. In contrast to existing solutions, (i) ROPdefender does not rely on side information (e.g., source code or debugging information) and (ii) it instruments all return instructions issued during program execution including all returns from dynamic libraries, even if the adversary subverts the control flow by other means. Moreover, ROPdefender can handle Unix signals, non-local control transfers, C++ exceptions, lazy binding, and can be applied to multi-threaded applications such as Mozilla Firefox or Acrobat Reader. Finally our implementation supports mainstream operating systems (Windows and Linux) for the Intel x86 architecture. As proof of concept we show that ROPdefender successfully detects recent Acrobat Reader exploits on Windows.