PointGuard™: Protecting Pointers from Buffer Overflow Vulnerabilities

By Crispin Cowan, Steve Beattie, John Einar Johansen, Perry Wagle. USENIX Security Symposium, 2003

503 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/4493c784abfc9f8728b63baf94edfb9b665e49d4

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Efficient Techniques for Comprehensive Protection from Memory Error Exploits (2005, unknown): “The PointGuard [9] approach randomizes (“encrypts”) stored pointer values.”
LIFT: A Low-Overhead Practical Information Flow Tracking System for Detecting Security Attacks (2006, methodology): “Some software-based dynamic methods detect certain types of exploits at runtime via program transformation [15, 16] or library changes [7].”
Address Obfuscation: An Efficient Approach to Combat a Broad Range of Memory Error Exploits (2003, unknown): “The PointGuard [13] approach complements ours in that it randomizes (“encrypts”) stored pointer values, as opposed to the locations where objects are stored.”
Dynamic Taint Analysis for Automatic Detection, Analysis, and SignatureGeneration of Exploits on Commodity Software (2005, methodology): “Most of these previous mechanisms require source code or special recompilation of the program, such as StackGuard [15], PointGuard [14], full-bounds check [20, 38], LibsafePlus [5], FormatGuard [13], and CCured [28].”
Practical Control Flow Integrity and Randomization for Binary Executables (2013, methodology): “PointGuard [26] use pointer encryption to protect function pointers from tampering.”
Non-Control-Data Attacks Are Realistic Threats (2005, background): “The possibility of these attacks has been suggested in previous work [9][42][48][52].”
Countering code-injection attacks with instruction-set randomization (2003, background): “PointGuard [22] encrypts all pointers while they reside in memory and decrypts them only before they are loaded to a CPU register.”
Code-pointer integrity (2014, methodology): “These approaches typically employ language modifications [Jim et al. 2002, Necula et al. 2005], compiler modifications [Cowan et al. 2003, Akritidis et al. 2008, Dhurjati et al. 2006, Nagarakatte et al. 2009, Serebryany et al. 2012], or rewrite machine code binaries [Niu and Tan 2013, Zhang and…”
ROPdefender: a detection tool to defend against return-oriented programming attacks (2011, methodology): “A more general approach, called PointGuard [15], encrypts all pointers and only decrypts them when they are loaded into CPU registers.”
Minos: Control Data Attack Prevention Orthogonal to Memory Model (2004, methodology): “PointGuard [12] attempts to protect the integrity of all pointers by encrypting them when a C program is compiled using type information.”
Argos: an emulator for fingerprinting zero-day attacks for advertised honeypots with automatic signature generation (2006, background): “Buffer overflow detection and protection methods exist in abundance [38, 10, 30, 36].”
Aegis: A Single-Chip Secure Processor (2007, background): “PointGuard [26] is a more recent proposal to protect all pointers by encrypting them in memory and decrypting them when the pointers are read into registers.”
Secure program execution via dynamic information flow tracking (2004, background): “PointGuard [4] is a more recent proposal to protect all pointers by encrypting them in memory and decrypting them when the pointers are read into registers.”
SQLrand: Preventing SQL Injection Attacks (2004, background): “PointGuard [ 11 ] encrypts all pointers while they reside in memory and decrypts them only before they are loaded to a CPU register.”
Preventing Memory Error Exploits with WIT (2008, background): “, [20, 19, 39]), or that exploit specific vulnerabilities, such as format string vulnerabilities (e.”