Overview of control-flow hijacking attack and defense techniques for process

Fengfeng WANG; Tao ZHANG; Weiguang XU; Meng SUN

doi:10.11959/j.issn.2096-109x.2019058

您当前的位置：

首页 >

文章列表页 >

Overview of control-flow hijacking attack and defense techniques for process

Comprehensive Review | 更新时间：2024-06-03

- Overview of control-flow hijacking attack and defense techniques for process
- Chinese Journal of Network and Information Security Vol. 5, Issue 6, Pages: 10-20(2019)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2019058
  CLC： TP309.2
- Online First：2019-12，
  
  Published：15 December 2019
- 稿件说明：
移动端阅览
Fengfeng WANG, Tao ZHANG, Weiguang XU, et al. Overview of control-flow hijacking attack and defense techniques for process[J]. Chinese Journal of Network and Information Security, 2019, 5(6): 10-20.
DOI：

Fengfeng WANG, Tao ZHANG, Weiguang XU, et al. Overview of control-flow hijacking attack and defense techniques for process[J]. Chinese Journal of Network and Information Security, 2019, 5(6): 10-20. DOI： 10.11959/j.issn.2096-109x.2019058.

摘要

控制流劫持攻击是一种常见的针对计算机软件的攻击，给计算机软件安全带来了巨大的危害，是信息安全领域的研究热点。首先，从攻击代码的来源角度出发，阐述了进程控制流劫持攻击的相关研究；其次，根据控制流劫持攻击技术的发展现状，基于不同防御思想介绍了近年来国内外的相关防御技术；最后对控制流劫持攻防技术发展趋势进行总结和展望。

Abstract

Control flow hijacking attack is a common attack against computer software

which brings great harm to computer software security and is a research hotspot in the field of information security.Firstly

from the perspective of the source of attack code

the related research was expounded on process’s control flow hijacking attack.Secondly

according to the newest development status of control flow hijacking attack technology

the related defense technologies at home and abroad were introduced based on different defense ideas.Finally

the development trend of control flow hijacking offensive and defensive technology were summarized.

关键词

Keywords

references

邵思豪 , 高庆 , 马森 , 等 . 缓冲区溢出漏洞分析技术研究进展 [J ] . 软件学报 , 2018 , 29 ( 5 ): 1179 - 1198 .

SHAO S H , GAO Q , MA S , et al . Progress in research on buffer overflow vulnerability analysis technologies [J ] . Journal of Software , 2018 , 29 ( 5 ): 1179 - 1198

张超 . 针对控制流劫持攻击的软件安全防护技术研究 [D ] . 北京:北京大学 , 2013 .

ZHANG C . Research on software security defense against control-flow hijacking attacks [D ] . Beijing:Beijing University , 2013 .

ROEMER R , BUCHANAN E , SHACHAM H , et al . Return-oriented programming:systems,languages,and applications [J ] . ACM Transactions on Information ＆ System Security , 2012 , 15 ( 1 ): 1 - 34 .

乔向东 , 郭戎潇 , 赵勇 . 代码复用对抗技术研究进展 [J ] . 网络与信息安全学报 , 2018 , 4 ( 3 ): 1 - 12 .

QIAO X D , GUO R X , ZHAO Y . Research progress in code reuse attacking and defending [J ] . Chinese Journal of Network and Information Security , 2018 , 4 ( 3 ): 1 - 12 .

DAVI L , SADEGHI A R , WINANDY M . ROPdefender:a detection tool to defend against return-oriented programming attacks [C ] // The 6th ACM Symposium on Information,Computer and Communications Security . 2011 : 40 - 51 .

BLETSCH T , JIANG X , FREEH V W , et al . Jump-oriented programming:a new class of code-reuse attack [C ] // The 6th ACM Symposium on Information,Computer and Communications Security . 2011 : 30 - 40 .

CHECKOWAY S , DAVI L , DMITRIENKO A , et al . Return-oriented programming without returns [C ] // ACM Conference on Computer ＆ Communications Security . 2010 : 559 - 572 .

钱逸 . 基于 ARM 架构的 ROP 攻击与防御技术研究 [D ] . 上海:上海交通大学 , 2012 .

QIAN Y . ROP attack and defense technology based on ARM [D ] . Shanghai:Shanghai Jiaotong University , 2012 .

BUCHANAN E , ROEMER R , SHACHAM H , et al . When good instructions go bad:Generalizing return-oriented programming to RISC [C ] // The 15th ACM Conference on Computer and Communications Security . 2008 : 27 - 38 .

DAVI L , DMITRIENKO A , SADEGHI A , et al . Return-oriented programming without returns on ARM [R ] . Ruhr-University Bochum , 2010 .

KORNAU T . Return oriented programming for the ARM architecture [D ] . Ruhr:Ruhr-Universität Bochum , 2010 .

DULLIEN T , PORST S . REIL:a platform-independent intermediate representation of disassembled code for static code analysis [J ] . Cansecwest , 2009 .

DULLIEN T , KORNAU T , WEINMANN R . A framework for automated architecture independent gadget search [C ] // Usenix Conference on Offensive Technologies . 2010 :1.

PaX team:PaX address space layout randomization (ASLR) [EB ] .

SNOW K Z , MONROSE F , DAVI L , et al . Just-in-time code reuse:on the effectiveness of fine-grained address space layout randomization [C ] // 2013 IEEE Symposium on Security and Privacy . 2013 : 574 - 588 .

BITTAU A , BELAY A , MASHTIZADEH A , et al . Hacking blind [C ] // 2014 IEEE Symposium on Security and Privacy . 2014 : 227 - 242 .

COWAN C , PU C , MAIER D , et al . StackGuard:automatic adaptive detection and prevention of buffer-overflow attacks [C ] // USENIX Security Symposium . 1998 : 98 63 - 78 .

TSAI T , SINGH N . Libsafe:transparent system-wide protection against buffer overflow attacks [C ] // International Conference on Dependable Systems and Networks . IEEE , 2002 :541.

COWAN C , BARRINGER M , BEATTIE S , et al . FormatGuard:automatic protection from printf format string vulnerabilities [C ] // USENIX Security Symposium . 2001 ,91.

MARTÍN A , BUDIU M , ERLINGSSON , ÚLFAR . Control-flow integrity [C ] // ACM Conference on Computer ＆ Communications Security . 2005 :340.

武成岗 , 李建军 . 控制流完整性的发展历程 [J ] . 中国教育网络 , 2016 ( 4 ): 52 - 55 .

WU C G , LI J J . The evolution of control flow integrity [J ] . China Education Network , 2016 ( 4 ): 52 - 55 .

MASHTIZADEH A J , BITTAU A , MAZIERES D , et al . Cryptographically enforced control flow integrity [J ] . arXiv preprint arXiv:1408.1451 , 2014 .

CRISWELL J , DAUTENHAHN N , ADVE V . KCoFI:complete control-flow integrity for commodity operating system kernels [C ] // 2014 IEEE Symposium on Security and Privacy . 2014 : 292 - 307 .

ZHANG C , WEI T , CHEN Z , et al . Practical control flow integrity and randomization for binary executables [J ] . IEEE Symposium on Security ＆ Privacy , 2013 : 559 - 573 .

ZHANG M , SEKAR R . Control Flow Integrity for {COTS} Binaries [C ] // Presented as part of the 22nd Security Symposium . 2013 : 337 - 352 .

GÖKTAS E , ATHANASOPOULOS E , BOS H , et al . Out of control:overcoming control-flow integrity [J ] . Security ＆ Privacy , 2014 : 575 - 589 .

CONTI M , CRANE S , DAVI L , et al . Losing control:on the effectiveness of control-flow integrity under stack attacks [C ] // The 22nd ACM SIGSAC Conference on Computer and Communications Security . 2015 : 952 - 963 .

CARLINI N , BARRESI N , MATHIAS P , et al . Control-flow bending:on the effectiveness of control-flow integrity [C ] // Usenix Conference on Security Symposium . 2015 : 161 - 176 .

OTGONBAATAR U . Evaluating modern defenses against control flow hijacking [D ] . Massachusetts:Massachusetts Institute of Technology , 2015 .

PAPPAS V , POLYCHRONAKIS M , KEROMYTIS A D . Transparent {ROP} exploit mitigation using indirect branch tracing [C ] // Presented as Part of the 22nd {USENIX} Security Symposium ({USENIX} Security 13) . 2013 : 447 - 462 .

QIU P , LYU Y , ZHANG J , et al . Control flow integrity based on lightweight encryption architecture [J ] . IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems , 2018 , 37 ( 7 ): 1358 - 1369 .

ZHANG J , QI B , QIN Z , et al . HCIC:Hardware-assisted control-flow integrity checking [J ] . IEEE Internet of Things Journal , 2018 , 6 ( 1 ): 458 - 471 .

蔡桂林 , 王宝生 , 王天佐 , 等 . 移动目标防御技术研究进展 [J ] . 计算机研究与发展 , 2016 , 53 ( 5 ): 968 - 987 .

CAI G L , WANG B S , WANG T Z , et al . Research and development of moving target defense technology [J ] . Journal of Computer Research and Development , 2016 , 53 ( 5 ): 968 - 987 .

FORREST S , SOMAYAJI A , ACKLEY D H . Building diverse computer systems [C ] // The Sixth Workshop on Hot Topics in Operating Systems (Cat.No.97TB100133) . 1997 : 67 - 72 .

SHACHAM H , PAGE M , PFAFF B , et al . On the effectiveness of address-space randomization [C ] // The 11th ACM Conference on Computer and Communications Security . 2004 : 298 - 307 .

KIL C , JUN J , BOOKHOLT C , et al . Address space layout permutation (ASLP):towards fine-grained randomization of commodity software [C ] // 2006 22nd Annual Computer Security Applications Conference (ACSAC'06) . 2006 : 339 - 348 .

HISER J , NGUYEN-TUONG A , et al . ILR:Where'd my gadgets go [C ] // 2012 IEEE Symposium on Security and Privacy . 2012 : 571 - 585 .

IYER V , KANITKAR A , DASGUPTA P , et al . Preventing overflow attacks by memory randomization [C ] // 2010 IEEE 21st International Symposium on Software Reliability Engineering . 2010 : 339 - 347 .

BHATKAR S , DUVARNEY D C , SEKAR R . Address obfuscation:an efficient approach to combat a broad range of memory error exploits [C ] // USENIX Security Symposium . 2003 12 ( 2 ): 291 - 301 .

BHATKAR S , DUVARNEY D C , SEKAR R . efficient techniques for comprehensive protection from memory error exploits [C ] // USENIX Security Symposium . 2005 :17.

BACKES M AND , NURNBERGER S , . Oxymoron:making fine-grained memory randomization practical by allowing code sharing [C ] // Usenix Conference on Security Symposium . 2014 : 433 - 447 .

GIUFFRIDA C , KUIJSTEN A , TANENBAUM A S . Enhanced operating system security through efficient and fine-grained address space randomization [C ] // Presented as Part of the 21st {USENIX}Security Symposium ({USENIX} Security 12) . 2012 : 475 - 490 .

CHEN X , XUE R , Wu C . Timely address space rerandomization for resisting code reuse attacks [J ] . Concurrency and Computation:Practice and Experience , 2017 , 29 ( 16 ):e3965.

侯宇 . 基于动态随机化和只可执行内存的JIT-ROP防御研究 [D ] . 南京:南京大学 , 2016 .

HOU Y . Defence against JIT-ROP based on dynamic randomization and executable only memory [D ] . Nanjing:Nanjing University , 2016

CHEN Y , WANG Z , WHALLEY D , et al . Remix:on-demand live randomization [C ] // The sixth ACM Conference on Data and Application Security and Privacy . 2016 : 50 - 61 .

HAWKINS W , NGUYEN-TUONG A , HISER J D , et al . Mixr:flexible runtime rerandomization for binaries [C ] // The 2017 Workshop on Moving Target Defense . 2017 : 27 - 37 .

BIGELOW D , HOBSON T , RUDD R , et al . Timely rerandomization for mitigating memory disclosures [C ] // ACM Sigsac Conference on Computer ＆ Communications Security , 2015 : 268 - 279 .

雷啸 . 内存信息泄露的运行中随机化防御方法的研究与改进 [D ] . 南京:南京大学 , 2017 .

LEI X . Research and improvement of runtime randomization defense method against memory information leakage [D ] . Nanjing:Nanjing University , 2017 .

MORTON M , KOO H , LI F , et al . Defeating zombie gadgets by re-randomizing code upon disclosure [C ] // International Symposium on Engineering Secure Software and Systems . 2017 : 143 - 160 .

LU K , NURNBERGER S , BACKES M , et al . How to make ASLR win the clone wars:runtime re-randomization [C ] // Network ＆ Distributed System Security Symposium . 2016 .

DAVI L , LIEBCHEN C , SADEGHI A R , et al . Isomeron:code randomization resilient to (just-in-time) return-oriented programming [C ] // Network ＆ Distributed System Security Symposium . 2015 .

WILLIAMS-KING D , GOBIESKI G , WILLIAMS-KING K . Shuffler:fast and deployable continuous code re-randomization [C ] // 12th {USENIX} Symposium on Operating Systems Design and Implementation ({OSDI} 16) . 2016 : 367 - 382 .

Views

1168

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Survey of software anomaly detection based on deception

Research progress in code reuse attacking and defending

Research on OLE object vulnerability analysis for RTF file

Related Author

Jianming FU

Chang LIU

Mengfei XIE

Chenke LUO

Xiangdong QIAO

Rongxiao GUO

Yong ZHAO

De-guang LE

Related Institution

Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education

School of Cyber Science and Engineering, Wuhan University

Information and Navigation College, Air Force Engineering University

Department of Computer Science and Technology,Peking University

Jiangnan Institute of Computing Technology

⁰