Address Obfuscation: An Efficient Approach to Combat a Broad Range of Memory Error Exploits

By Sandeep Bhatkar, Daniel C. DuVarney, R. Sekar. USENIX Security Symposium, 2003

665 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/e51bbd128bc5b3659b97084d8a1d20f3f13fc351

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

An efficient and backwards-compatible transformation to ensure memory safety of C programs (2004, background): “More recently, works have emerged that use randomization to achieve broad protection against attacks that exploit memory errors [5, 11].”
Taint-Enhanced Policy Enforcement: A Practical Approach to Defeat a Wide Range of Attacks (2006, background): “, [7, 9, 2, 22, 28, 5] handle buffer overflows, [6] handles format string attacks, and [24, 23] handle injection attacks involving strings.”
Shielding Applications from an Untrusted Cloud with Haven (2014, background): “Our loader does not yet implement address-space layout randomisation [7]; this is planned for future work.”
Address Space Layout Permutation (ASLP): Towards Fine-Grained Randomization of Commodity Software (2006, methodology): “User Level Randomization Address obfuscation [ 2 , 3] introduced a mechanism to not only randomly shift the placement of the three critical regions, but also randomly re-order objects in static code and data segments.”
Smashing the Gadgets: Hindering Return-Oriented Programming Using In-place Code Randomization (2012, background): “Another simpler and probably more effective approach is to rearrange existing blocks of code either at the function level [18], [19], [36], [37], or with finer granularity, at the basic block level [38], [39].”
SQLrand: Preventing SQL Injection Attacks (2004, background): “Another approach, address obfuscation [ 10 ], randomizes the absolute locations of all code and data, as well as the distances between different data items.”
DieHard: probabilistic memory safety for unsafe languages (2006, background): “Security vulnerabilities: Previous efforts to reduce vulnerability to heap-based security attacks randomize the base address of the heap, a technique known somewhat misleadingly as address space randomization [7, 29].”
N-Variant Systems: A Secretless Framework for Security through Diversity (2006, methodology): “Several techniques for automatically producing diversity have been developed including rearranging memory [8, 26, 25, 69] and randomizing the instruction set [6, 35].”
Hamsa: fast signature generation for zero-day polymorphic worms with provable attack resilience (2006, methodology): “COVERS [14], a system based on address-space randomization (ASR) [3] can detect and correlate the network input and generate signatures for server protection.”
Controlled-Channel Attacks: Deterministic Side Channels for Untrusted Operating Systems (2015, background): “However, this will not be the case if a shielding system implements Address Space Layout Randomization (ASLR) to randomize the bases of executables in memory.”
Jump-oriented programming: a new class of code-reuse attack (2011, background): “In particular, address-space layout randomization (ASLR) [2, 7, 8] randomizes the memory layout of a running program, making it difficult to determine the addresses in libc and other legitimate code on which return-into-libc or ROP/JOP-based attacks rely.”
Anomalous Payload-Based Worm Detection and Signature Generation (2005, background): “site invulnerable to the same exact attack exploit [1].”
Renovo: a hidden code extractor for packed executables (2007, methodology): “Such techniques include binary and source code obfuscation [13, 22], control-ﬂow obfuscation [20], instruction virtualization [10], and binary code packing [27].”
Misleading worm signature generators using deliberate noise injection (2006, background): “, [15, 10, 5, 1] are not considered because they are largely limited to application-based worms (e.”
Control Flow Integrity for COTS Binaries (2013, background): “Unlike address-space randomization [24, 5] and stack cookies [12, 17], CFI’s control-flow hijack defense is not vulnerable to the recent spate of information leakage and guessing attacks [40, 37, 16].”
Control-flow integrity principles, implementations, and applications (2009, methodology): “Several other techniques [Bhatkar et al. 2003; Cowan et al. 1998; PaX Project 2004; Tuck et al. 2004; Xu et al. 2003] also rely on secret values that in.uence the semantics of pointer addresses stored in memory.”
Hacking Blind (2014, background): “Unfortunately, canaries are not a perfect solution, as even with layout precautions, the structure of a buffer overflow can sometimes permit an attacker to bypass canary words and access critical state directly, as happened with unsafe pointer arithmetic in yaSSL [3].”