代码复用对抗技术研究进展

乔向东; 郭戎潇; 赵勇

doi:10.11959/j.issn.2096-109x.2018017

您当前的位置：

首页 >

文章列表页 >

代码复用对抗技术研究进展

综述 | 更新时间：2024-06-03

- 代码复用对抗技术研究进展
- Research progress in code reuse attacking and defending
- 网络与信息安全学报 2018年4卷第3期页码：1-12
- 作者机构：
  
  1. 空军工程大学信息与导航学院，陕西西安710077
  2. 清华大学计算机科学技术系，北京 100871
  3. 江南计算技术研究所，江苏无锡 214083
- 作者简介：
  
  [ "乔向东（1970-），男，陕西佳县人，博士，空军工程大学副教授，主要研究方向为网络空间安全、信息对抗及多传感器信息融合。" ]
  [ "郭戎潇（1982-），女，甘肃兰州人，博士，空军工程大学讲师，主要研究方向为网络空间安全。" ]
  [ "赵勇（1978-），男，黑龙江方正人，清华大学博士生，主要研究方向为网络信息安全。" ]
- 基金信息：
  
  国家自然科学基金资助项目;The National Natural Science Foundation of China(61672061)
- DOI：10.11959/j.issn.2096-109x.2018017
  中图分类号： TP309.2
- 网络首发：2018-03，
  
  纸质出版：2018-03-15
- 稿件说明：
移动端阅览
乔向东, 郭戎潇, 赵勇. 代码复用对抗技术研究进展[J]. 网络与信息安全学报, 2018,4(3):1-12.

Xiangdong QIAO, Rongxiao GUO, Yong ZHAO. Research progress in code reuse attacking and defending[J]. Chinese Journal of Network and Information Security, 2018, 4(3): 1-12.
乔向东, 郭戎潇, 赵勇. 代码复用对抗技术研究进展[J]. 网络与信息安全学报, 2018,4(3):1-12. DOI： 10.11959/j.issn.2096-109x.2018017.

Xiangdong QIAO, Rongxiao GUO, Yong ZHAO. Research progress in code reuse attacking and defending[J]. Chinese Journal of Network and Information Security, 2018, 4(3): 1-12. DOI： 10.11959/j.issn.2096-109x.2018017.

摘要

代码复用攻击利用被攻击目标的固有程序代码实施攻击，打破了恶意行为总是源自外部的传统假设，是先进内存攻击技术的典型代表，也是近期软件安全领域的研究热点。首先，阐述了该技术的产生背景和实现机理；其次，从改进与变体、不同架构平台下的实现方法、自动化以及包括盲代码复用攻击和基于代码复用的非控制数据攻击在内的代码复用攻击技术的重要拓展等方面系统阐述了近年来国内外相关研究进展；再次，对代码复用攻击的防御机制和对抗防御机制的方法进行了讨论；最后，对代码复用对抗技术的发展趋势和研究方向进行了展望。

Abstract

Code reuse attacks make use of binary code existed in the attacked target to perform attack action

such technique breaks out the traditional assumption that malicious behavior always be introduced from the outside，it is representative sample of the advanced memory corruption techniques and also the focus of attention in the software security research field.The generation background and implementation principle were described firstly

and then the recent progresses of the technique

including improvement and variants

implementation methods under the different architecture platforms

automatic construction and important extension including blind ROP and non-control data attacks based on code reuse attacks

were introduced respectively.Various defense mechanisms and possible counter-defense methods for code reuse attacks were also discussed.Finally a perspective of the future work in this research area was discussed.

关键词

Keywords

references

MICROSOFT . A detailed description of the data execution prevention (dep) feature in windows xp service pack 2 [EB/OL ] . http://Vsupportjnicrosoft.com/kb./875352 http://Vsupportjnicrosoft.com/kb./875352 .

THE PaX TEAM . PaX project [EB/OL ] . http://pax.grsean-ity.net docs/randexec.txt http://pax.grsean-ity.net docs/randexec.txt .

DESIGNER S . Bugtraq:getting around non-executable stack (and fix) [EB/OL ] . http://seclists.org/bugtraq/1997/Aug/63. http://seclists.org/bugtraq/1997/Aug/63. .

Bypassing non-executable-stack during exploitation using return-to-libc.c0ntex [EB/OL ] . http://www.infosecwriters.com/textreso urces/pdf/return-to-libc.pdf http://www.infosecwriters.com/textreso urces/pdf/return-to-libc.pdf .

MCDONALD J . Defeating solaris/sparc non-executable stack protection [EB/OL ] . https://www.thc.org/root/docs/exploit_writing/sol-ne-stack.html https://www.thc.org/root/docs/exploit_writing/sol-ne-stack.html .

TIM N . non-exec stack [J ] . Bugtraq , 2000 .

KRAHMER S . x86-64 buffer overflow exploits and the borrowed code chunks exploitation techniques [EB/OL ] . http://www.suse.de/krahmer/ no-nx.pdf http://www.suse.de/krahmer/ no-nx.pdf .

SHACHAM H , . The geometry of innocent flesh on the bone:retum-into-libc without function calls (on the x86) [C ] // ACM conference on Computer and communications security . 2007 : 552 - 561 .

ROEMER R , BUCHANAN E , SHACHAM H , et al . Return- oriented programming:Systems,languages,and applications [EB/OL ] . http://cseweb.ucsd.edu/liovav/papers/rbss11.html http://cseweb.ucsd.edu/liovav/papers/rbss11.html .

CHECKOWAY S , DAVI L , DMITRIENKO A . Return-oritend programming without returns [C ] // ACM Conference on Computer and Communications Security . 2010 : 559 - 572 .

CHECKOWAY S , SHACHAM H . Escape from return-oriented programming:return-oriented programming without returns (on the x86) [R ] . CS2010-0954 , 2010 .

PaX TEAM . What the future holds for pax [EB/OL ] . http://pax.grsecurity.net/docs/pax-future.txt http://pax.grsecurity.net/docs/pax-future.txt .

BLETSCH T , JIANG X , FREEH V , et al . Jump-oriented programming:a new class of code reuse attack [EB/OL ] . ftp://ftp.ncsu.edu/pub/tech/2010/TR-2010-8.pdf ftp://ftp.ncsu.edu/pub/tech/2010/TR-2010-8.pdf .

陈平 . 代码复用攻击与防御技术研究 [D ] . 南京:南京大学 , 2012 .

CHEN P . Research on the attack and defense techniques of code reuse [D ] . Nanjing:Nanjing University , 2012 .

邢晓 . 自动化构造Jump-Oriented Programming [D ] . 南京:南京大学 , 2012

XIAO X . Automatic construction of jump-oriented programming attack [D ] . Nanjing:Nanjing University , 2012 .

邢晓 , 陈平 , 丁文彪 , 茅兵 , 谢立 , . BIOP:自动构造增强型ROP攻击 [J ] . 计算机学报 , 2014 , 37 ( 5 ): 1111 - 1123 .

XIAO X , CHEN P , DING W B,et.al . BIOP:automatic construction of enhanced ROP attack [J ] . Chinese Journal of Computers , 2014 , 37 ( 5 ): 1111 - 1123 .

袁平海 , 曾庆凯 , . ROP图灵完备的普遍可实现性 [J ] . 软件学报 , 2017 , 28 ( 10 ): 2583 - 2598 .

YUAN P H , ZENG Q K . Universal availability of ROP-based turing-complete computation [J ] . Chinese Journal of Software , 2017 , 28 ( 10 ): 2583 - 2598 .

KORMAU T . Return oriented programming for the ARM architecture [D ] . Bochum:Ruhr University , 2010 .

DAVI L . Return-oriented programming without returns on ARM [R ] . Technical Report HGI-TR-2010-002 , 2010 .

钱逸 , 王轶骏 , 薛质 . 基于 ARM 平台的 ROP 攻击及防御技术 [J ] . 信息安全与保密 , 2012 , 10 : 75 - 77 .

QIAN Y , WANG Y J , XUE Z . ROP attack and defense technology based on ARM [J ] . Chinese Information Security and Communication Privacy , 2012 , 10 : 75 - 77 .

钱逸 . 基于 ARM 架构的 ROP 攻击与防御技术研究 [D ] . 上海:上海交通大学 , 2012 .

QIAN Y . ROP attack and defense technology based on ARM [D ] . Shanghai:Shanghai JiaoTong University , 2012 .

FRANCILLON C , CASTELLUCCIA . Code injection attacks on harvard-architecture devices [C ] // ACM Conference on Computer and Communications Security . 2008 : 15 - 26 .

CHECKOWAY S , FELDMAN A J , KANTOR B , et al . Can DREs provide long-lasting security? The case of return-oriented programming and the AVC Advantage [C ] // EVT/WOTE 2009.USENIX/ACCURATE/IAVoSS . 2009 .

BUCHANAN E , ROEMER R , SHACHAM H , et al . When good instructions go bad:generalizing return-oriented programming to RISC [C ] // ACM Conference on Computer and Communications Security . 2008 : 27 - 38 .

LIDNER F.Developments in Cisco IOS forensics Confidence 2 . 0 [EB/OL ] . http://www.recurity-labs.com/content/pub/FX_Router_Exploitation.pdf http://www.recurity-labs.com/content/pub/FX_Router_Exploitation.pdf .

彭国军 , 梁玉 , 张焕国 , 等 . 软件二进制代重用技术综述 [J ] . 软件学报 , 2017 , 28 ( 8 ): 2026 - 2045 .

PENG G J , LIANG Y , ZHANG H G , et al . Survey on software binary code reuse technologies [J ] . Chinese Journal of Software , 2017 , 28 ( 8 ): 2026 - 2045 .

HUND R , HOLZ T , FREILING F C . Return oriented rootkits:bypassing kernel code integrity protection mechanisms [C ] // Usenix Security Symposium . 2009 : 383 - 398 .

LEZ R , . ARM exploitation ROPMap [C ] // BlackHat , 2011 .

杨超 . 基于长指令序列的 ROP 攻击的自动化工具的研究与实现 [D ] . 南京:南京大学, , 2015

YANG C . Research and implement on an automatic ROP exploit based on long instruction sequence [D ] . Naijing:Nanjing University , 2015 .

LONG L D , NGUYEN T . Payload already inside:data re-use for rop exploits [C ] // Black Hack in the Box . 2010 .

PAYER M , . String oriented programming circumventing aslr,dep,and other guard [C ] // Chaos Communication Congress . 2011 : 1 - 5 .

BITTAU A , BELAY A . MASHTIZADEH and et al.Hacking blind [C ] // IEEE Symposium on Security and Privacy . 2014 : 227 - 242 .

HU H , SHINDE S , ADRIAN S , et al . Data-oriented programming:on the expressiveness of non-control data attacks [C ] // The 37th IEEE Symposium Security and Privacy . 2016 : 969 - 986 .

LI J K , WANG Z , JIANG X X , et al . Defeating return-oriented rootkits with return-less kernels [C ] // European conference on Computer systems . 2010 : 195 - 208 .

ONARLIOGLU K , BILGE L , LANZI A . et al . G-free:defeating return-oriented programming through gadget-less binaries [C ] // Computer Security Applications Conference . 2010 : 49 - 58 .

GOKTAS E , ATHANASOPOULOS E , BOS H , et al . Out of control:overcoming control-flow integrity [C ] // IEEE Symposium on Security and Privacy . 2014 : 575 - 589 .

CARLINI N , WAGNER D . ROP is still dangerous:breaking modern defenses [C ] // Usenix Security Symposium , 2014 : 385 - 399 .

OTGONBAATAR U . Evaluating modern defenses against control flow hijacking [D ] . Massachusetts Institute of Technology , 2015 .

王明华 , 尹恒 BHASKAR AV , 等 . 代码块:面向二进制程序的细粒度控制流完整性校验方法 [J ] . 信息安全学报 , 2016 , 1 ( 2 ): 61 - 72 .

WANG M H , YIN H , BHASKAR A V , et al . Binary code continent:finer-grained control flow integrity for stripped Binaries [J ] . Chinese Journal of Cyber Security , 2016 , 1 ( 2 ): 61 - 72 .

陈志锋 , 李清宝 , 张平 , 等 . 面向 Linux 的内核级代码复用攻击检测技术 [J ] . 软件学报 , 2017 , 28 ( 7 ): 1732 - 1745 .

CHEN Z F , LI Q B , ZHANG P , et al . Kernel code reuse attack detection technique for Linux [J ] . Chinese Journal of Software , 2017 , 28 ( 7 ): 1732 - 1745 .

CHENG Y Q , ZHOU Z W , YU M , et al . ROPecker:a generic and practical approach for defending against rop attacks [C ] // ISOC Network and Distributed System Security Symposium . 2014 : 1 - 14 .

PAPPAS V , POLYCHRONAKIS M , KEROMUTIS A D . Transparent ROP exploit mitigation using indirect branch tracing [C ] // USENIX Conference on Security . 2013 : 447 - 462 .

DAVI L , SADEGHI A , WINANDY M . ROPdefender:a detection tool to defend against return-oriented programming attacks [C ] // ACM Symposium on Information,Computer and Communications Security . 2011 : 40 - 51 .

HISER J, A , NGUYEN-TUNONG A , CO M , et al . ILR:where’d my gadgets go? [C ] // The 2012 IEEE Symp.On Security and Privacy (SP) . 2012 : 571 - 85 .

WARTELL R , MOHAN V , HAMLEN K W , et al . Binary stirring:self-randomizing instruction addresses of legacy x86 binary code [C ] // The 2012 ACM Conf.on Computer and Communications Security (CCS 2012) . 2012 . 157 - 168 .

PAPPAS V , POLYCHRONAKIS M , KEROMYTIS A D . Smashing the gadgets:Hindering return-oriented programming using in-place code randomization [C ] // The 2012 IEEE Symp.on Security and Privacy (SP) . 2012 . 601 - 615 .

浏览量

2999

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

进程控制流劫持攻击与防御技术综述

面向RTF的OLE对象漏洞分析研究