Tuesday, April 7, 2009
Wei Hu
Chair: John Knight
Advisor: Jack Davidson; David Evans; Westley Weimer; Ronald Williams; Benjamin Zorn
OLSSON 228E, 15:30:00
A Ph.D. Proposal
Automatic and Efficient Protection against Non-Control-Data Attacks
ABSTRACT
Memory overwriting vulnerabilities is a common cause of security problems. Exploits usually modify some control data, e.g., return addresses and function pointers, so that the code arranged by the attackers is executed. Due to the popularity of this type of attacks, many defenses have been designed. However, memory overwriting vulnerabilities can also be exploited to modify non-control data, and cause the same level of security compromises. Non-control-data attacks are generally ignored by existing defenses. Therefore, it is foreseeable that as control-flow data protection techniques become widely deployed, attackers will seek to use non-control-data attacks.
The thesis of the proposal is that automated program analysis and transformation can be used to efficiently thwart memory corruption attacks that overwrite non-control data to compromise an application. The key insight into non-control-data attacks is that they must overwrite some security-critical data in order to benefit from the vulnerabilities. If all the potential targets of a non-control-data attack are identified, defenses can be designed to protect them.
This work will define a formal security model that specifies security-critical functions. Using this model, this work will design automated source-code analysis approaches that identify security-critical variables in a program, and develop practical software solutions for protecting identified data items without relying on uncommon hardware features such as word-level memory protection. This research will be validated by implementing the framework and evaluating how its security, scalability and performance overhead are affected by different design choices.