Neutralizing Manipulation of Critical Data by Enforcing Data-Instruction Dependency
pdf
| In this paper, we propose a new approach to neutralize attacks that tamper with critical program data. Our technique uses a sequence of instructions as a trap against the illicit modification of the critical data. In a nutshell, we set up a dependency such that the contin-ued execution of the program is contingent upon the successful execution of the instruction sequence and the successful execution of the instruction sequence is contingent upon the integrity of the critical data. In particular, we discuss a specific implementation of our technique focusing on a critical data that is often subject to malicious manipulation: the return address of a function. We show that our technique can be an effective countermeasure to defend against attacks that overwrite the return address to divert control to a malicious code. We further show that our technique offers significant protection without resorting to complementary defenses such as ASLR, DEP or StackGuard. |
Chandra Sharma got his BS degree in Computer Engineering from Kathmandu Engineering College in 2015. As a graduate student at Kansas State University since 2017, his research is mostly focused on software security and information security. One of his active research is on finding the optimal trade-off between privacy and utility of the information shared by users on the internet. His another research work is focused on developing novel techniques to protect against code-injection and code-reuse attacks. Some of his other research interests includes vehicular security and application of game theory to information security.
Tags:
License: CC-2.5
Submitted by Anonymous
on