Countering code-injection attacks with instruction-set randomization

By Gaurav S. Kc, Angelos Dennis Keromytis, Vassilis Prevelakis. Conference on Computer and Communications Security, 2003

755 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/3d06bc310afc5ca8b04930a03514d1430a87ec37

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Signal Processing

Citations in the corpus

Argos: an emulator for fingerprinting zero-day attacks for advertised honeypots with automatic signature generation (2006, background): “tion and detection of attempts to perform syscalls from illegitimate addresses [16, 18, 24].”
SoK: Eternal War in Memory (2013, background): “But due to the support for page permissions, the much slower ISR has become less relevant and because of the limited space we will not cover it in more detail in this paper.”
Jump-oriented programming: a new class of code-reuse attack (2011, background): “Instruction-set randomization (ISR) [6, 27] instead randomizes the instruction set for each running process so that instructions in the injected attack code fail to execute correctly even though the attacks may have successfully hijacked the control .ow.”
ILR: Where'd My Gadgets Go? (2012, background): “Defensive techniques such as various forms of instruction-set randomization that target code injection attacks directly are completely circumvented by arc-injection attacks in general [28, 30, 31], of which ROP, return-to-libc [32, 33], and partial overwriting attacks of return addresses [10] are sp”
Preventing Memory Error Exploits with WIT (2008, methodology): “Other techniques do instruction set randomization [27] but have high overhead without hardware support.”
On the infeasibility of modeling polymorphic shellcode (2007, background): “Code injection attacks have traditionally received a great d l of attention from both security researchers and the blackhat c ommunity [1, 14], and researchers have proposed a variety of defe ns s, from artificial diversity of the address space [5] or instruc ion set [20, 4] to compiler-added integr”
SQLrand: Preventing SQL Injection Attacks (2004, methodology): “[22] introduced the concept of instruction-set randomization for safeguarding systems against any type of code-injection attack, by creating process-speciﬁc randomized instruction sets ( e.g., machine instructions) of the system executing potentially vulnerable software.”
SoK: Automated Software Diversity (2014, methodology): “This approach is known as Instruction Set Randomization [37], [5].”
N-Variant Systems: A Secretless Framework for Security through Diversity (2006, methodology): “Although it is likely that most sequences of malicious x86 instructions contain an invalid PowerPC instruction, it is certainly possible for attackers to design instruction sequences that are valid on both platforms (although we are not aware of any programs that do this for the x86 and PowerPC, Sjo”
Taint-Enhanced Policy Enforcement: A Practical Approach to Defeat a Wide Range of Attacks (2006, background): “Recently, more general techniques based on randomization have been developed, and they promise to defend against most memory error exploits [16, 2], However, due to the nature of the C language, these methods still cannot detect certain types of attacks, e.”
Just-In-Time Code Reuse: On the Effectiveness of Fine-Grained Address Space Layout Randomization (2013, background): “On the other hand, ISR has been shown to be vulnerable to key guessing attacks [57, 63]—that become more powerful in the face of memory disclosure attacks like ours,—suffers from high performance penalties [4], or requires hardware assistance that is not yet present in commodity systems [27].”
Toward Proactive, Adaptive Defense: A Survey on Moving Target Defense (2019, background): “Common MTD techniques include artificial diversity [20, 72, 76, 129, 152] or randomizations [3, 10, 79, 83, 86, 88, 97, 100, 135, 138, 143, 156], which rearrange or randomize the various system and network attributes where each work can belong to shuffling, diversity, and/or redundancy techniques.”
Efficient Techniques for Comprehensive Protection from Memory Error Exploits (2005, positive): “Recent works have applied it to randomization of address space [25, 4, 33], operating system functions [6], and instruction sets [20, 3].”
Binary stirring: self-randomizing instruction addresses of legacy x86 binary code (2012, methodology): “Instruction Set Randomization: ISR is an approach to prevent code injection attacks by randomizing the underlying system instructions [5, 34].”
Using parse tree validation to prevent SQL injection attacks (2005, methodology): “Boyd and Keremytis [1, 13] developed SQLRand, a technique that modifies the tokens of the SQL language: Each token type includes a prepended integer.”
Dynamic Taint Analysis for Automatic Detection, Analysis, and SignatureGeneration of Exploits on Commodity Software (2005, methodology): “In particular, we show how TaintCheck can be combined with honeypots, or with operating system randomization [11, 21, 8].”
Vigilante: end-to-end containment of internet worms (2005, background): “There is a large amount of work on host-based detection of vulnerabilities including [47, 10, 23, 21, 16, 2, 4].”