Practical Control Flow Integrity and Randomization for Binary Executables

By Chao Zhang, Tao Wei, Zhaofeng Chen, Lei Duan, László Szekeres, Stephen McCamant, Dawn Song, Wei Zou. IEEE Symposium on Security and Privacy, 2013

568 citations recorded by the source corpus.

Control Flow Integrity (CFI) provides a strong protection against modern control-flow hijacking attacks. However, performance and compatibility issues limit its adoption. We propose a new practical and realistic protection method called CCFIR (Compact Control Flow Integrity and Randomization), which addresses the main barriers to CFI adoption. CCFIR collects all legal targets of indirect control-transfer instructions, puts them into a dedicated "Springboard section" in a random order, and then limits indirect transfers to flow only to them. Using the Springboard section for targets, CCFIR can validate a target more simply and faster than traditional CFI, and provide support for on-site target-randomization as well as better compatibility. Based on these approaches, CCFIR can stop control-flow hijacking attacks including ROP and return-into-libc. Results show that ROP gadgets are all eliminated. We observe that with the wide deployment of ASLR, Windows/x86 PE executables contain enough information in relocation tables which CCFIR can use to find all legal instructions and jump targets reliably, without source code or symbol information. We evaluate our prototype implementation on common web browsers and the SPEC CPU2000 suite: CCFIR protects large applications such as GCC and Firefox completely automatically, and has low performance overhead of about 3.6%/8.6% (average/max) using SPECint2000. Experiments on real-world exploits also show that CCFIR-hardened versions of IE6, Firefox 3.6 and other applications are protected effectively.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/9a88b5a465ec08fc0269d1b86dda431d00ae64f3

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

ROP is Still Dangerous: Breaking Modern Defenses (2014, background): “Many ROP defenses [6] [23] [32] [34] apply the following policy: any time a ret instruction is executed, its target must be a call-preceded instruction.”
Out of Control: Overcoming Control-Flow Integrity (2014, methodology): “Specifically, recent work on practical CFI is applicable on binaries, but it enforces a looser notion of control flow integrity [17], [16].”
Code-pointer integrity (2014, methodology): “We also compare Levee to two related approaches, SoftBound [34] and control-flow integrity [1, 54, 53].”
Hypervision Across Worlds: Real-time Kernel Protection from the ARM TrustZone Secure World (2014, methodology): “Completely eliminating these attacks requires orthogonal techniques, such as [17,19,21,57].”
The Cybersecurity Landscape in Industrial Control Systems (2016, methodology): “To reduce this overhead, a number of proposals have been made: kBouncer [92], ROPecker [93], CFI for COTS binaries [94], ROPGuard [95], and CCFIR [96].”
This Paper Is Included in the Proceedings of the 12th Usenix Symposium on Operating Systems Design and Implementation (osdi '16). Ryoan: a Distributed Sandbox for Untrusted Computation on Secret Data Ryoan: a Distributed Sandbox for Untrusted Computation on Secret Data (unknown): “Orthogonal techniques [27, 31, 42, 61, 78] may be used to mitigate software bugs that unintentionally leak secret input data to a computation’s output.”
Neural Nets Can Learn Function Type Signatures From Binaries (2017, methodology): “Specifically, we investigate the problem of recovering function types / signatures from binary code — a problem with wide applications to control-flow hardening [54, 34, 53] and data-dependency analysis [31, 40] on binaries — using techniques from deep learning.”
Control Flow Integrity for COTS Binaries (2013, methodology): “CCFIR [48], like the work presented in this paper, targets binaries.”
ROPecker: A Generic and Practical Approach For Defending Against ROP Attacks (2014, background): “ROPecker: A Generic and Practical Approach for Defending Against ROP Attacks Yueqiang Cheng†, Zongwei Zhou§, Miao Yu§, Xuhua Ding†, Robert H. Deng† † School of Information Systems, Singapore Management University † {yqcheng.2008, xhding, robertdeng}@smu.edu.sg § ECE Department and CyLab, Carnegie Me”
Stitching the Gadgets: On the Ineffectiveness of Coarse-Grained Control-Flow Integrity Protection (2014, methodology): “To better tackle the performance trade-off between security and performance, several coarse-grained CFI solutions have been proposed to date [13, 20, 31, 45, 46].”
Enforcing Forward-Edge Control-Flow Integrity in GCC & LLVM (2014, background): “In particular, incremental compilation and dynamic libraries have remained primary challenges for CFI implementations, as has achieving low performance overheads; these challenges have only recently started to be addressed in experimental prototypes that enforce more coarse-grained CFI policies [28,”
Control-Flow Integrity (2017, methodology): “Borrowing a term from information-ﬂow control [Sabelfeld and Myers 2003], π CFI can, however, suffer from label creep by accumulating too many labels from the static CFG. CFI implementations introducing imprecision via labeling are: the original CFI paper [Abadi et al. 2005], control-ﬂow locking [Bl”
Counterfeit Object-oriented Programming: On the Difficulty of Preventing Code Reuse Attacks in C++ Applications (2015, methodology): “For example, the widely deployed address space layout randomization (ASLR) technique ensures that the stack, the heap, and executable modules of a program are mapped at secret, pseudo-randomly chosen memory locations.”