...
  • 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>Journal of computer security >Address-space layout randomization using code islands
【24h】

Address-space layout randomization using code islands

机译：使用代码岛的地址空间布局随机化

获取原文
获取原文并翻译 | 示例
           
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Address-Space Layout Randomization (ASLR) techniques prevent intruders from locating target functions by randomizing the process layout. Prior ASLR techniques defended against single-target brute force attacks, which work by locating a single, omnipotent system library function such as execve (). These techniques are not sufficient to defend against chained return-into-lib(c) attacks that call a sequence of system library functions.rnIn this paper, we describe the Island Code Transformation (ICT) that addresses chained retum-into-lib(c) attacks. A code island is a block of code that is isolated in the address space from other code blocks. Island code not only randomizes the base pointers used in memory mapping, but also maximizes the entropy in function layout (that is, knowing the location and extent of one function gains the attacker little knowledge as to the memory location of other functions).rnWe also provide an efficacy analysis of randomization schemes based on combinations of available ASLR techniques. Our analysis shows that ICT is exponentially more effective than any prior ASLR technique in defending against brute-force searches for addresses of multiple target functions - a key component of chained return-into-lib(c) attacks. ICT uses a predefined rerandomization threshold, that determines how frequently (in terms of failed attacks) the process layout is re-randomized to balance security and availability.rnOur overhead measurement on some well-known GNU applications shows that it takes less than 0.05 second to load/rerandomize a process with the necessary C system library functions in code islands, and our technique introduces a 3-10% run-time overhead caused by inter-island control transfers. We, therefore, conclude that ICT is well-suited for dedicated servers.
机译：地址空间布局随机化（ASLR）技术通过随机化进程布局来防止入侵者定位目标功能。先前的ASLR技术可以抵御单一目标的暴力攻击，这种攻击通过定位单个无所不能的系统库函数（例如execve（））来起作用。这些技术不足以抵御调用系统库函数序列的链接返回lib（c）攻击。在本文中，我们描述了解决链接到lib（c）链接的孤岛代码转换（ICT）。 ）攻击。代码岛是在地址空间中与其他代码块隔离的代码块。孤岛代码不仅随机化了内存映射中使用的基本指针，而且还最大化了函数布局中的熵（也就是说，知道一个函数的位置和程度会使攻击者对其他函数的内存位置知之甚少）。提供基于可用ASLR技术组合的随机化方案的功效分析。我们的分析表明，在防御针对多个目标函数的地址的强行搜索（链式返回lib（c）攻击的关键组成部分）的暴力搜索中，ICT比任何以前的ASLR技术都更有效。 ICT使用预定义的重新随机化阈值，该阈值确定对流程布局进行重新随机化的频率（就失败的攻击而言），以平衡安全性和可用性。rn我们对某些知名GNU应用程序的开销测量表明，该过程花费的时间不到0.05秒。使用代码岛中的必要C系统库功能加载/重新随机化进程，而我们的技术引入了3-10％的运行时开销，这些开销是由岛间控制转移引起的。因此，我们得出结论，ICT非常适合专用服务器。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号