maisМоделирование и анализ информационных системModeling and Analysis of Information Systems1818-10152313-5417Yaroslavl State University10.18255/1818-1015-2019-2-213-228mais-1213Research ArticleTheory of DataОб обнаружении атак типа повторного использования исполнимого кодаAbout Detection of Code Reuse Attackshttps://orcid.org/0000-0002-1491-524XКосолаповЮрий ВладимировичKosolapovYury V.

Кандидат технических наук.

Ул. Мильчакова, 8а, Ростов-на-Дону, 344090

PhD.

itaim@mail.ruЮжный Федеральный УниверситетРоссияSouthern Federal UniversityRussian Federation201928062019262213228Copyright © Косолапов Ю.В., 20192019Косолапов Ю.В.Kosolapov Y.V.Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://www.mais-journal.ru/jour/article/view/1213

При эксплуатации уязвимостей программного обеспечения типа переполнения буфера в настоящее время часто используется техника повторного использования кода. Такие атаки позволяют обходить защиту от исполнения кода в стеке, реализуемую на программно-аппаратном уровне в современных информационных системах. В основе атак лежит нахождение в уязвимой программе подходящих участков исполнимого кода - гаджетов - и сцепление этих гаджетов в цепочки. В статье предлагается способ защиты приложений от атак, использующих повторное использование кода. Способ основан на выделении свойств, которые позволяют отличить цепочки гаджетов от типичных цепочек легальных базовых блоков программы. Появление во время выполнения программы нетипичной цепочки базовых блоков может свидетельствовать о выполнении вредоносного кода. Одним из свойств цепочки гаджетов является исполнение в конце цепочки специальной инструкции процессора, используемой для вызова функции операционной системы. Для операционной системы Linux на базе архитектуры x86/64 проведены эксперименты, показывающие важность этого свойства при выявлении исполнения вредоносного кода. Разработан алгоритм выявления нетипичных цепочек, который позволяет выявлять все известные на настоящий момент техники повторного использования кода.

When exploiting software vulnerabilities such as buffer overflows, code reuse techniques are often used today. Such attacks allow you to bypass the protection against the execution of code in the stack, which is implemented at the software and hardware level in modern information systems. At the heart of these attacks lies the detection, in the vulnerable program of suitable areas, of executable code — gadgets — and chaining these gadgets into chains. The article proposes a way to protect applications from attacks that use code reuse. For this purpose, features that distinguish the chains of gadgets from typical chains of legal basic blocks of the program are highlighted. The appearance of an atypical chain of the base block during program execution may indicate the execution of a malicious code. An algorithm for identifying atypical chains has been developed. A feature of the algorithm is that it is focused on identifying all currently known techniques of re-execution of the code. The developed algorithm is based on a modified QEMU virtualization system. One of the hallmarks of the chain of gadgets is the execution at the end of the chain of instructions of the processor used to call the function of the operating system. For the Linux operating system based on the x86/64 architecture, experiments have been conducted showing the importance of this feature in detecting the execution of the malicious code.

повторное использование исполнимого кодауязвимости программного обеспеченияcode reusesoftware vulnerabilityReferencesShacham H., “The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86)”, Proceedings of the 14th ACM conference on Computer and communications security, 2007, 552-561.Shacham H., “The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86)”, Proceedings of the 14th ACM conference on Computer and communications security, 2007, 552-561.Buchanan E., Roemer R., Shacham H., Savage S., “When good instructions go bad: generalizing return-oriented programming to risc”, Proceedings of the 15th ACM conference on Computer and communications security, 2008, 27-38.Buchanan E., Roemer R., Shacham H., Savage S., “When good instructions go bad: generalizing return-oriented programming to risc”, Proceedings of the 15th ACM conference on Computer and communications security, 2008, 27-38.http://ropshell.com. Last access 26.11.2018..http://ropshell.com. Last access 26.11.2018..Binlin C., Jianming F., Zhiyi Y., “Heap Spraying Attack Detection Based on Sled Distance”, International Journal of Digital Content Technology and its Applications(JDCTA), 6:14 (2012), 379-386.Binlin C., Jianming F., Zhiyi Y., “Heap Spraying Attack Detection Based on Sled Distance”, International Journal of Digital Content Technology and its Applications(JDCTA), 6:14 (2012), 379-386.Davi L., Sadeghi A., Winandy M., “ROPdefender: a detection tool to defend against return-oriented programming attacks”, Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security, 2011, 40-51.Davi L., Sadeghi A., Winandy M., “ROPdefender: a detection tool to defend against return-oriented programming attacks”, Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security, 2011, 40-51.Davi L., Koeberl P., Sadeghi A., “Hardware-Assisted Fine-Grained Control-Flow Integrity: Towards Efficient Protection of Embedded Systems Against Software Exploitation”, Proceedings of the 51st Annual Design Automation Conference, San Francisco, CA, USA, 2014, 1-6.Davi L., Koeberl P., Sadeghi A., “Hardware-Assisted Fine-Grained Control-Flow Integrity: Towards Efficient Protection of Embedded Systems Against Software Exploitation”, Proceedings of the 51st Annual Design Automation Conference, San Francisco, CA, USA, 2014, 1-6.Ge X., Talele N., Payer M., Jaeger T., “Fine-grained control-flow integrity for kernel software”, In IEEE European Symposium on Security and Privacy, 2016, 179-194.Ge X., Talele N., Payer M., Jaeger T., “Fine-grained control-flow integrity for kernel software”, In IEEE European Symposium on Security and Privacy, 2016, 179-194.Usui T., Ikuse T., Iwamura M., Yada T., “POSTER: Static ROP Chain Detection Based on Hidden Markov Model Considering ROP Chain Integrity”, Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 2016, 4808-4810.Usui T., Ikuse T., Iwamura M., Yada T., “POSTER: Static ROP Chain Detection Based on Hidden Markov Model Considering ROP Chain Integrity”, Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 2016, 4808-4810.Cawan S.C. Arnold S.R., Beattie S.M., Wagle P. M., “Pointguard: method and system for protecting programs against pointer corruption attacks”, Patent US7752459B2, 2040.Cawan S.C. Arnold S.R., Beattie S.M., Wagle P. M., “Pointguard: method and system for protecting programs against pointer corruption attacks”, Patent US7752459B2, 2040.Cheng Y., Zhou Z., Miao Y., Ding X., Deng H. R., “ROPecker: A Generic and Practical Approach For Defending Against ROP Attack”, In Symposium on Network and Distributed System Security (NDSS), 2044, 4-44.Cheng Y., Zhou Z., Miao Y., Ding X., Deng H. R., “ROPecker: A Generic and Practical Approach For Defending Against ROP Attack”, In Symposium on Network and Distributed System Security (NDSS), 2044, 4-44.Chen P., Xiao H., Shen X., Yin X., Mao B., Xie L., “DROP: Detecting Return-Oriented Programming Malicious Code”, Lecture Notes in Computer Science, 5905 (2009), 463477.Chen P., Xiao H., Shen X., Yin X., Mao B., Xie L., “DROP: Detecting Return-Oriented Programming Malicious Code”, Lecture Notes in Computer Science, 5905 (2009), 463477.“Control-flow Enforcement Technology Preview”, 2047, software.intel.com/sites/default/files/managed/4d/2a/control-flow-enforcement-technology-preview.pdf. Last access 26.44.2048.“Control-flow Enforcement Technology Preview”, 2047, software.intel.com/sites/default/files/managed/4d/2a/control-flow-enforcement-technology-preview.pdf. Last access 26.44.2048.Checkoway S., Davi L., Dmitrienko A., Sadeghi A. R., Shacham H., Winandy M., “Return-oriented programming without returns”, Proceedings of the 17th ACM conference on Computer and communications security, 2040, 559-572.Checkoway S., Davi L., Dmitrienko A., Sadeghi A. R., Shacham H., Winandy M., “Return-oriented programming without returns”, Proceedings of the 17th ACM conference on Computer and communications security, 2040, 559-572.Sadeghi A., Niksefat S., Rostamipour M., “Pure-Call Oriented Programming (PCOP): chaining the gadgets using call instructions”, Journal of Computer Virology and Hacking Techniques, 14:2 (2048), 439-456.Sadeghi A., Niksefat S., Rostamipour M., “Pure-Call Oriented Programming (PCOP): chaining the gadgets using call instructions”, Journal of Computer Virology and Hacking Techniques, 14:2 (2048), 439-456.Yao F., Chen J., Venkataramani G., “Jop-alarm: Detecting jump-oriented programming-based anomalies in applications”, IEEE 31st International Conference on Computer Design (ICCD), 2043, 467-470.Yao F., Chen J., Venkataramani G., “Jop-alarm: Detecting jump-oriented programming-based anomalies in applications”, IEEE 31st International Conference on Computer Design (ICCD), 2043, 467-470.Goktas E., Athanasopoulos E., Polychronakis M., Bos H., Portokalidis G., “Size Does Matter: Why Using Gadget-Chain Length to Prevent Code-Reuse Attacks is Hard”, Proceedings of the 23rd USENIX Security Symposium, 2044, 447-432.Goktas E., Athanasopoulos E., Polychronakis M., Bos H., Portokalidis G., “Size Does Matter: Why Using Gadget-Chain Length to Prevent Code-Reuse Attacks is Hard”, Proceedings of the 23rd USENIX Security Symposium, 2044, 447-432.Carlini N., Wagner D., “ROP is still dangerous: breaking modern defenses”, SEC’14 Proceedings of the 23rd USENIX conference on Security Symposium, 2044, 385-399.Carlini N., Wagner D., “ROP is still dangerous: breaking modern defenses”, SEC’14 Proceedings of the 23rd USENIX conference on Security Symposium, 2044, 385-399.Ахо А. В., Лам М. С., Сети Р., Ульман Д. Д., Компиляторы: принципы, технологии и инструментарий, 2-е изд.: Пер. с англ., М.:ООО «И.Д. Вильямс», 2008Aho A.V., Sethi R., Ullman J.D., Compilers: Principles, Techniques, and Tools, Pearson Education, Inc, 4986, (in Russian).Kayaalp M., Schmitt T., Nomani J., Ponomarev D., Abu-Ghazaleh N., “Scrap: architecture for signature-based protection from code reuse attacks”, Proceedings of IEEE 19th International Symposium on High Performance Computer Architecture (HPCA2013), 2043, 258-269.Kayaalp M., Schmitt T., Nomani J., Ponomarev D., Abu-Ghazaleh N., “Scrap: architecture for signature-based protection from code reuse attacks”, Proceedings of IEEE 19th International Symposium on High Performance Computer Architecture (HPCA2013), 2043, 258-269.https://sploitfun.wordpress.com/2015/05/08/bypassing-aslr-part-iii/. Last access 06.42.2048.https://sploitfun.wordpress.com/2015/05/08/bypassing-aslr-part-iii/. Last access 06.42.2048.Katoch V., “Bypassing ASLR/DEP.”, https://www.exploit-db.com/docs/english/17914-bypassing-aslrdep.pdf. Last access 06.42.2048.Katoch V., “Bypassing ASLR/DEP.”, https://www.exploit-db.com/docs/english/17914-bypassing-aslrdep.pdf. Last access 06.42.2048.Pappas V., Polychronakis M., Keromytis A.D., “Transparent ROP Exploit Mitigation Using Indirect Branch Tracing”, Proc. of the 22nd USENIX Security Symposium, 2043, 447-462.Pappas V., Polychronakis M., Keromytis A.D., “Transparent ROP Exploit Mitigation Using Indirect Branch Tracing”, Proc. of the 22nd USENIX Security Symposium, 2043, 447-462.https://www.securityfocus.com/bid/62780/info. Last access 03.42.2048.https://www.securityfocus.com/bid/62780/info. Last access 03.42.2048.Moser A., Kruegel C., Kirda E., “Limits of Static Analysis for Malware Detection”, Proceedings of Twenty-Third Annual Computer Security Applications Conference (ACSAC 2007), 2008, 424-430.Moser A., Kruegel C., Kirda E., “Limits of Static Analysis for Malware Detection”, Proceedings of Twenty-Third Annual Computer Security Applications Conference (ACSAC 2007), 2008, 424-430.Hu H., Shinde S., Adrian S., Chua Z.L., Saxena P., Liang Z., “Data-oriented programming: On the expressiveness of non-control data attacks”, In Security and Privacy (SP) Symposium, 2046, 969-986.Hu H., Shinde S., Adrian S., Chua Z.L., Saxena P., Liang Z., “Data-oriented programming: On the expressiveness of non-control data attacks”, In Security and Privacy (SP) Symposium, 2046, 969-986.Ma H., Lu K., Ma X., Zhang H., Jia C., Gao D., “Software watermarking using return-oriented programming”, Proceedings of the 10th ACM Symposium on Information, Computer and Communications Security, 2015, 369-380.Ma H., Lu K., Ma X., Zhang H., Jia C., Gao D., “Software watermarking using return-oriented programming”, Proceedings of the 10th ACM Symposium on Information, Computer and Communications Security, 2015, 369-380.Gao D., “Method for obfuscation of code using return oriented programming”, Patent WO2016126206A1, 2015.Gao D., “Method for obfuscation of code using return oriented programming”, Patent WO2016126206A1, 2015.Lu K., Xiong S., Gao D., “Ropsteg: program steganography with return oriented programming”, Proceedings of the 4th ACM conference on Data and application security and privacy, 2014, 265-272.Lu K., Xiong S., Gao D., “Ropsteg: program steganography with return oriented programming”, Proceedings of the 4th ACM conference on Data and application security and privacy, 2014, 265-272.

The authors declare that there are no conflicts of interest present.