论文标题
破坏和修复破坏性代码读取防御
Breaking and Fixing Destructive Code Read Defenses
论文作者
论文摘要
即时以返回为导向的编程（JIT-ROP）是一种强大的内存损坏攻击，绕过各种形式的代码随机化。仅执行的内存（XOM）可能会防止这些攻击，但需要源代码。相比之下，破坏性代码读取（DCR）提供了安全性和遗产兼容性之间的权衡。普遍的信念是，如果将DCR与高渗透代码随机化相结合，则提供了强有力的保护。 本文的贡献是双重的：首先，我们证明DCR可以被绕过，而与基础代码随机方案无关。为此，我们展示了小说的通用攻击，这些攻击推断了高度随机的程序代码的代码布局。其次，我们介绍了BGDX（字节粒DCR和XOM）的设计和实现，这是一种新型缓解技术，可保护遗产二进制文件免受代码推理攻击的影响。 BGDX在字节粒度上实现了内存权限，从而使我们可以将DCR和XOM结合起来，以获取遗产，现成的二进制文件。我们的评估表明，BGDX不仅有效，而且高效，仅在规格上施加了3.95％的几何平均性能开销。
Just-in-time return-oriented programming (JIT-ROP) is a powerful memory corruption attack that bypasses various forms of code randomization. Execute-only memory (XOM) can potentially prevent these attacks, but requires source code. In contrast, destructive code reads (DCR) provide a trade-off between security and legacy compatibility. The common belief is that DCR provides strong protection if combined with a high-entropy code randomization. The contribution of this paper is twofold: first, we demonstrate that DCR can be bypassed regardless of the underlying code randomization scheme. To this end, we show novel, generic attacks that infer the code layout for highly randomized program code. Second, we present the design and implementation of BGDX (Byte-Granular DCR and XOM), a novel mitigation technique that protects legacy binaries against code inference attacks. BGDX enforces memory permissions on a byte-granular level allowing us to combine DCR and XOM for legacy, off-the-shelf binaries. Our evaluation shows that BGDX is not only effective, but highly efficient, imposing only a geometric mean performance overhead of 3.95% on SPEC.
