Code injection attacks on harvard-architecture devices

By Aurélien Francillon, Claude Castelluccia. Conference on Computer and Communications Security, 2008

317 citations recorded by the source corpus.

Harvard architecture CPU design is common in the embedded world. Examples of Harvard-based architecture devices are the Mica family of wireless sensors. Mica motes have limited memory and can process only very small packets. Stack-based buffer overflow techniques that inject code into the stack and then execute it are therefore not applicable. It has been a common belief that code injection is impossible on Harvard architectures. This paper presents a remote code injection attack for Mica sensors. We show how to exploit program vulnerabilities to permanently inject any piece of code into the program memory of an Atmel AVR-based sensor. To our knowledge, this is the first result that presents a code injection technique for such devices. Previous work only succeeded in injecting data or performing transient attacks. Injecting permanent code is more powerful since the attacker can gain full control of the target sensor. We also show that this attack can be used to inject a worm that can propagate through the wireless sensor network and possibly create a sensor botnet. Our attack combines different techniques such as return oriented programming and fake stack injection. We present implementation details and suggest some counter-measures.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/d823ee4fa7ca844624fc3eee68202f032270b9d2

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Just-In-Time Code Reuse: On the Effectiveness of Fine-Grained Address Space Layout Randomization (2013, methodology): “To date, return-oriented programming has been applied to a broad range of architectures (including Intel x86 [52], SPARC [10], Atmel AVR [20], ARM [25, 31], and PowerPC [35]).”
Return-oriented programming without returns (2010, methodology): “It was subsequently extended to the SPARC [3], Atmel AVR [15], PowerPC [26], Z80 [4], and ARM [23] processors.”
ROPdefender: a detection tool to defend against return-oriented programming attacks (2011, methodology): “In general, the ROP attacks presented so far are all based on this principle [53, 8, 24, 38, 41, 12, 32, 51].”
Cyber-physical systems security: Limitations, issues and future trends (2020, unknown): “According to current studies carried out by [160], [161], CPS is highly prone to malicious code injection attacks [162] and code-reuse attacks [163], along with fake data injection attacks [164], zero-control data attacks [165], and ﬁnally Control-Flow Attestation (C-FLAT) attacks [160].”
SMART: Secure and Minimal Architecture for (Establishing a Dynamic) Root of Trust (2012, methodology): “) This technique was used in several attacks on MCUs to recover keying material or store information across resets [20], [21].”
C-FLAT: Control-Flow Attestation for Embedded Systems Software (2016, background): “Keywords remote attestation; control-flow attacks; embedded system security”
SMART: Secure and Minimal Architecture for (Establishing Dynamic) Root of Trust (2012, methodology): “) This technique was used in several attacks on MCUs to recover keying material or store information across resets [20, 21].”
Jump-oriented programming: a new class of code-reuse attack (2011, background): “Copyright 2011ACM 978-1-4503-0564-8/11/03 ...$10.00. to redirect control .ow to the attacker-supplied code.”
Return-Oriented Programming: Systems, Languages, and Applications (2012, methodology): “Besides the x86 and SPARC architectures, return-oriented programming has been extended to the Atmel AVR [Francillon and Castelluccia 2008], PowerPC [Lidner 2009], Z80 [Checkoway et al.”