Out of Control: Overcoming Control-Flow Integrity

By Enes Göktas, Elias Athanasopoulos, Herbert Bos, Georgios Portokalidis. IEEE Symposium on Security and Privacy, 2014

443 citations recorded by the source corpus.

As existing defenses like ASLR, DEP, and stack cookies are not sufficient to stop determined attackers from exploiting our software, interest in Control Flow Integrity (CFI) is growing. In its ideal form, CFI prevents flows of control that were not intended by the original program, effectively putting a stop to exploitation based on return oriented programming (and many other attacks besides). Two main problems have prevented CFI from being deployed in practice. First, many CFI implementations require source code or debug information that is typically not available for commercial software. Second, in its ideal form, the technique is very expensive. It is for this reason that current research efforts focus on making CFI fast and practical. Specifically, much of the work on practical CFI is applicable to binaries, and improves performance by enforcing a looser notion of control flow integrity. In this paper, we examine the security implications of such looser notions of CFI: are they still able to prevent code reuse attacks, and if not, how hard is it to bypass its protection? Specifically, we show that with two new types of gadgets, return oriented programming is still possible. We assess the availability of our gadget sets, and demonstrate the practicality of these results with a practical exploit against Internet Explorer that bypasses modern CFI implementations.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/dbbdd8fbf65f87107690a160a0d297f04fcc440d

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Stitching the Gadgets: On the Ineffectiveness of Coarse-Grained Control-Flow Integrity Protection (2014, methodology): “For instance, the attacks shown in [11, 22, 34] are prevented by our combined CFI policy which monitors the sequence length at any time in program execution.”
ROP is Still Dangerous: Breaking Modern Defenses (2014, background): “Concurrent to this work, a detailed examination of attacks on many CFIbased schemes came to this same conclusion [14].”
VC3: Trustworthy Data Analytics in the Cloud Using SGX (2015, background): “Attacks on CFI [24] typically require an initial step to corrupt memory (e.”
Counterfeit Object-oriented Programming: On the Difficulty of Preventing Code Reuse Attacks in C++ Applications (2015, methodology): “Closely related to our work, several advanced ROP-based attacks were recently demonstrated [11], [16], [25], [26], [43] that bypassed certain coarse-grained CFI systems [3], [58], [59] or heuristics-based systems [14], [23], [40], [56].”
Control-Flow Bending: On the Effectiveness of Control-Flow Integrity (2015, background): “This notion of fully-precise static CFI allows us to transcend the recent arms race caused by defenders proposing forms of CFI [9,28] and then attackers defeating them [5, 14, 16].”
Hypervision Across Worlds: Real-time Kernel Protection from the ARM TrustZone Secure World (2014, background): “Recent research shows that these attacks are hard to prevent [26,54].”
The Cybersecurity Landscape in Industrial Control Systems (2016, background): “Detecting such attacks is challenging: modern programs link to a large number of libraries, and require dangerous API and system calls to operate correctly [97].”
Code-pointer integrity (2014, methodology): “CPI and CPS are effective: they prevent 100% of the attacks in the RIPE benchmark and the recent attacks [19, 15, 9] that bypass CFI, ASLR, DEP, and all other Microsoft Windows protections.”
Control-Flow Integrity (2017, background): “Second, even a large reduction of targets often leaves enough targets for an attacker to achieve the desired goals [8, 19, 26], making AIR unable to evaluate security of CFI mechanisms on an absolute scale.”