微软于2006年末推出的桌面操作系统Windows Vista是Windows XP的升级换代,该系统的界面外观、技术应用、安全保障、多媒体等多方面显示出与众不同的特点和实用性,具有强大的文件管理组织和搜索能力,包括IE7浏览器、Windows Media Player...微软于2006年末推出的桌面操作系统Windows Vista是Windows XP的升级换代,该系统的界面外观、技术应用、安全保障、多媒体等多方面显示出与众不同的特点和实用性,具有强大的文件管理组织和搜索能力,包括IE7浏览器、Windows Media Player 11播放器。展开更多
随着地址空间布局随机化被广泛部署于操作系统上,传统的代码复用攻击受到了较好的抑制.但新型的代码复用攻击能通过信息泄露分析程序的内存布局而绕过地址空间布局随机化(address space layout randomization,ASLR),对程序安全造成了严...随着地址空间布局随机化被广泛部署于操作系统上,传统的代码复用攻击受到了较好的抑制.但新型的代码复用攻击能通过信息泄露分析程序的内存布局而绕过地址空间布局随机化(address space layout randomization,ASLR),对程序安全造成了严重威胁.通过分析传统代码复用攻击和新型代码复用攻击的攻击本质,提出一种基于代码防泄漏的代码复用攻击防御方法 VXnR,并在Bitvisor虚拟化平台上实现了VXnR,该方法通过将目标进程的代码页设置可执行不可读(Execute-no-Read,XnR),使代码可以被处理器正常执行,但在读操作时根据被读物理页面的存储内容对读操作进行访问控制,从而阻止攻击者利用信息泄露漏洞恶意读进程代码页的方法搜索gadgets,实验结果表明:该方法既能防御传统的代码复用攻击,还能够防御新型的代码复用攻击,且性能开销在52.1%以内.展开更多
Code reuse attacks pose a severe threat to modern applications. These attacks reuse existing code segments of vulnerable applications as attack payloads and hijack the control flow of a victim application. With high c...Code reuse attacks pose a severe threat to modern applications. These attacks reuse existing code segments of vulnerable applications as attack payloads and hijack the control flow of a victim application. With high code entropy and a relatively low performance overhead, Address Space Layout Randomization(ASLR) has become the most widely explored defense against code reuse attacks. However, a single memory disclosure vulnerability is able to compromise this defense. In this paper, we present Memory Protection Extensions(MPX)-assisted Address Space Layout Randomization(M-ASLR), a novel code-space randomization scheme. M-ASLR uses several characteristics of Intel MPX to restrict code pointers in memory. We have developed a fully functioning prototype of M-ALSR, and our evaluation results show that M-ASLR:(1) offers no interference with normal operation;(2) protects against buffer overflow attacks, code reuse attacks, and other sophisticated modern attacks;and(3) adds a very low performance overhead(3.3%) to C/C++ applications.展开更多
文摘随着地址空间布局随机化被广泛部署于操作系统上,传统的代码复用攻击受到了较好的抑制.但新型的代码复用攻击能通过信息泄露分析程序的内存布局而绕过地址空间布局随机化(address space layout randomization,ASLR),对程序安全造成了严重威胁.通过分析传统代码复用攻击和新型代码复用攻击的攻击本质,提出一种基于代码防泄漏的代码复用攻击防御方法 VXnR,并在Bitvisor虚拟化平台上实现了VXnR,该方法通过将目标进程的代码页设置可执行不可读(Execute-no-Read,XnR),使代码可以被处理器正常执行,但在读操作时根据被读物理页面的存储内容对读操作进行访问控制,从而阻止攻击者利用信息泄露漏洞恶意读进程代码页的方法搜索gadgets,实验结果表明:该方法既能防御传统的代码复用攻击,还能够防御新型的代码复用攻击,且性能开销在52.1%以内.
基金supported in part by the National Natural Science Foundation of China(No.61272452)the National Key Basic Research and Development(973)Program of China(No.2014CB340601)the Natural Science Foundation of Hubei Province(No.2017CFB663)
文摘Code reuse attacks pose a severe threat to modern applications. These attacks reuse existing code segments of vulnerable applications as attack payloads and hijack the control flow of a victim application. With high code entropy and a relatively low performance overhead, Address Space Layout Randomization(ASLR) has become the most widely explored defense against code reuse attacks. However, a single memory disclosure vulnerability is able to compromise this defense. In this paper, we present Memory Protection Extensions(MPX)-assisted Address Space Layout Randomization(M-ASLR), a novel code-space randomization scheme. M-ASLR uses several characteristics of Intel MPX to restrict code pointers in memory. We have developed a fully functioning prototype of M-ALSR, and our evaluation results show that M-ASLR:(1) offers no interference with normal operation;(2) protects against buffer overflow attacks, code reuse attacks, and other sophisticated modern attacks;and(3) adds a very low performance overhead(3.3%) to C/C++ applications.
