Analyzing and compiling code Linking objects into executable Loading executable into memory Running executable Preventing Buffer Overflows Splint - Check array bounds and pointers Non-executable stack Stackguard put canary before RA Libsafe replace vulnerable library functions RAD check RA against copy
Analyze call trace for abnormality PointGuard encrypt pointers Binary diversity change code to slow worm propagation PAX binary layout randomization by kernel Randomize system call numbers Preventing Buffer Overflows Randomize code Barrantes, Ackley, Forrest, Palmer, Stefanovic, Zovi, Randomized Instruction Set Emulation to Disrupt Binary Code Injection Attacks, ACM CCS 2003. Randomize location of code/data
Bhatkar, DuVarney, Sekar, Address Obfuscation: an Efficient Approach to Combat a Broad Range of Memory Error Exploits, USENIX Security 2003. Randomized Instruction Sets Threat: binary code injection from network Goal: de-standardize each system in an externally unobservable way Solution:
Each program has a different and secret instruction set Use translator to randomize instructions at loadtime Limits: no defense against data-only modifications RISE: loading binary Valgrind / RISE Key Memory Scrambled Code ELF binary file Code Data + Data
Injected from network + Code Data Code Hardware L L I SIG Scrambled Code Complications Shared libraries
Protecting plaintext Usually code from libraries is shared among multiple processes RISE scrambles shared code, at increased memory expense Descrambled code blocks stored in trace cache Make cache read-only except when updating Entanglement
Should not use same libraries as process emulated Some libraries use dispatch tables stored in code Performance 9 out of 14 attacks failed due to Valgrind itself Others were stopped by RISE RISE costs ~5% more than Valgrind (which is 4-50x slower than native) Keeping key and shared libs triples memory x86 opcode space is dense, so random instruction might not be illegal Percentage of runs
RISE: locations of crash 25% 6% Offset from start address to failure location Address Randomization Threat: memory error exploits Goal: remove predictability from memory access Solution:
Relocate memory regions Permute order of variables and code Introduce random gaps between objects Limits: not all are easy to implement with common ABIs at load-time Randomizing Obfuscations kernel space Randomize base addresses of memory regions
Stack: subtract large value Heap: allocate large block DLLs: link with dummy lib Code/static data: convert to shared lib, or re-link at different address Makes absolute addressdependent attacks harder stack shared library heap bss static data code Randomizing Obfuscations
Permute the order of variables / routines Local variables in stack frame Order of static variables Order of routines in DLLs or executable Makes relative-address dependent attacks harder Not implemented by authors Randomizing Obfuscations Introduce random gaps between objects
Randomly pad stack frames Between frame pointer and local variables Randomly pad successive malloc() calls Randomly pad between static variables Add gaps inside routines and jumps to skip them Helps randomize objects which must maintain relative order First two are implemented by authors
Performance A probabilistic approach, increasing attackers expected work Each failed attempt results in crash; at restart, randomization is different ~3000 attempts for P(success) = 0.5 0-21% overhead on execution time Limited protection for: Modifications within heap-allocated blocks Overflows of adjacent data within stack frame or static
variables Comparison RISE x x x Conclusion Common weaknesses: Overflows onto adjacent data
Read/write attacks Double-pointer attacks Lack of information at runtime Distinguishing pointers from non-pointers Determining sizes of data objects Distinguishing code from data Static analysis + Link & Load-time randomization can be very effective (for now) References
Barrantes, Ackley, Forrest, Palmer, Stefanovic, Zovi, Randomized Instruction Set Emulation to Disrupt Binary Code Injection Attacks, ACM CCS 2003. Bhatkar, DuVarney, Sekar, Address Obfuscation: an Efficient Approach to Combat a Broad Range of Memory Error Exploits, USENIX Security 2003. Cowan, Beattie, Johansen, Wagle, PointGuard: Protecting Pointers From Buffer Overflow Vulnerabilities, USENIX Security 2003. Wilander, Kamkar, A Comparison of Publicly Available Tools for Dynamic Buffer Overflow Prevention, NDSS 2003.
Work DOL 6 th Grade TEK 7.7(A) contrast situations where work is done with different amounts of force to situations where no work is done such as moving a box with a ramp and without a ramp, or standing still;
Single Sign-On Vijay Kumar, CISSP Agenda What is Single Sign-On (SSO) Advantages of SSO Types of SSO Examples Case Study Summary What is SSO Single sign-on is a user/session authentication process that permits a user to enter one name and...
Physics coursework Title2017. Using conductors made of children's play (modelling) dough, investigate quantitatively the effect on . resistance, calculated from measurements of voltage across and current through the conductors, of . changing the conductor length and obtain data to establish...
QHP, WAH, Individual, mixed, SHOP, enrolled, eligible but not enrolled. Characteristics - insurance status, access to care, need for care. Conduct survey in August and receive results in September. Health Literacy Project Update Pam Cowley, Outreach Manager.
Identify your competitors and present a matrix including the competitors and your venture comparing on key attributes including functionality, price, quality, etc. Value proposition to Customer Segments (Product-Market Fit)