Dynamic Taint Analysis to Handle Them

VU Research Portal Using information flow tracking to protect legacy binaries Slowinska, J.M. 2012 document version Publisher's PDF, also known as Version of record Link to publication in VU Research Portal citation for published version (APA) Slowinska, J. M. (2012). Using information flow tracking to protect legacy binaries. General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal ? Take down policy If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim. E-mail address: [email protected] Download date: 24. Sep. 2021 Chapter 1 Chapter 1 Introduction Even though memory corruption vulnerabilities are inherent to C, this language is not likely to be replaced by strongly typed languages with memory safety guaran- tees [76; 200; 30]. Programmers are not willing to relinquish high performance, reuse of code they wrote earlier, and backward compatibility offered by C. However, the lack of safety causes serious security problems. Memory corruption vulnerabilities are reported daily [180; 150; 137], and we regularly witness attacks compromis- ing popular software or critical networks [123; 198]. The research community has long recognised the problem, and has proposed multiple solutions. However, the existing proposals that are practical for production use prove inefficient, while the more comprehensive ones are either inapplicable to legacy software, or incur a high performance overhead. In this thesis, we address the problem of protecting legacy C binaries against memory corruption attacks. We focus on techniques employing data flow tracking, since they are applicable to existing software, and at the same time offer a mechanism to monitor and accurately reason about a program execution. Because such monitoring is often prohibitively expensive, current systems employing data flow tracking are mainly limited to non production machines, such as malware analysis engines or honeypots. In our work, we seek solutions that would let us benefit from the wealth of information available during a run of the program, but at the same time be efficient and applicable in a timely fashion. We divide memory corruption attacks into two classes: (1) control-diverting, that divert the flow of execution of a program to code injected or chosen by an attacker, and (2) non-control-diverting, that do not directly divert a program’s control flow, but might modify a value in memory that represents e.g., a user’s privilege level, or a server configuration string. The research community has widely applied information flow tracking to protect against both types of memory corruptions. A popular branch of the technique, known as Dynamic Taint Analysis [62; 149], has been successfully employed to detect control-diverting attacks. In this dissertation, we further extend this mechanism 1 2 CHAPTER 1. INTRODUCTION to perform attack analysis. We develop Prospector, an emulator capable of tracking which bytes contributed to a buffer overflow attack on the heap or stack. We use this information to generate signatures, which effectively stop polymorphic attacks, and also allow for efficient filtering. Further, we propose Hassle, a honeypot that is capable of generating signatures for attacks over both encrypted and non-encrypted channels. As far as non-control-diverting attacks are concerned, several projects have at- tempted to employ an extended version of dynamic taint analysis to handle them. We analyse and evaluate this technique. Since the mechanism appears to have serious problems that limit its applicability, we introduce BodyArmour, a completely new method of protecting legacy binaries against buffer overflow attacks, also the non-control-diverting ones. BodyArmour tracks how pointers are used at runtime, to see when they access memory beyond buffer’s boundaries. As BodyArmour requires knowledge about memory objects used by the binary, we present Howard, a dynamic approach to unearth the necessary information. 1.1 The Problem It has been already forty years since Anderson identified memory corruptions [10], and fifteen years since Aleph One provided a detailed introduction to stack smashing attacks [84]. The security community has recognised the problem, and has implemented various solutions in real-world systems. Static analysis has improved code quality by identifying many errors during development, but it is imprecise, and might incur both false positives and false negatives [224]. Furthermore, address space lay- out randomisation (ASLR) [27], data execution prevention (PaX/DEP) [154], and canaries [63] can thwart some of the attacks. Despite all these solutions, buffer overflows alone rank third in the CWE SANS top 25 most dangerous software errors [70]. The security implications are evident— Table 1.1 lists some major buffer overflow attack outbreaks we have witnessed in recent years. The problems persist in the real world because the adopted solutions prove insuf- ficient, whereas more powerful protection mechanisms are either too slow for practical usage, they break backward compatibility, or require source code and recompilation. While an extensive overview of major defence mechanisms is presented in Chapter 2, we focus now on the few solutions which are the most relevant to this thesis. Anti-virus software and network intrusion detection systems (NIDS) monitor ex- ecutable files or the network traffic, and frequently search for signatures, i.e., patterns distinguishing malicious attacks from benign data. However, polymorphic attacks, zero-day attacks, and data encryption, all render signature-based solutions limited. 1.1. THE PROBLEM 3 Name Year Information Morris 1988 The Morris worm [83] was the earliest documented hostile exploitation of a buffer overflow. It became also the first worm to spread extensively "in Chapter 1 the wild". It infected about 6,000 UNIX machines. Code Red 2001 The Code Red worm [225] exploited a buffer overflow in MS Internet Information Services (IIS). It spread by probing random IP addresses and infecting all hosts vulnerable to the IIS exploit. Over 359.000 unique hosts got infected in a 24-hours period on July 19th. Slammer 2003 The SQL Slammer worm [138] exploited a buffer overflow in MS SQL Server and Desktop Engine database products. It spread rapidly, infecting most of its 75,000 victims within ten minutes. Blaster 2003 The Blaster worm [42] spread on computers running MS Windows XP and Windows 2000 in August 2003. It spread by exploiting a buffer overflow in the DCOM RPC service. Zotob 2005 The Zotob worm [202; 54] exploited a stack-based buffer overflow in the Plug and Play service for MS Windows 2000 and Windows XP SP1. Its outbreak was covered "live" on CNN television, as the network’s own computers got infected. Conficker 2008 The Conficker worm [134; 136] spread itself primarily through a buffer overflow vulnerability in the MS Server Service. It compromised many critical networks [123; 14], and security experts estimate that it has passed a milestone of having infected more than 7 million computers [58]. Stuxnet 2010 The Stuxnet worm targeted Siemens industrial software and equipment running MS Windows. It used four zero-day attacks, including a bound- ary condition error [198]. Different variants of Stuxnet targeted Iranian nuclear facilities with the probable target widely suspected to be uranium enrichment infrastructure in Iran [90; 91]. Table 1.1: Major buffer overflow attack outbreaks. Runtime host solutions take advantage of the wealth of information present when a vulnerable application is running to protect against attacks. Dynamic Taint Anal- ysis (DTA), proposed by Denning et al. [77] and later implemented in TaintCheck [149], is one of the few techniques that protect legacy binaries against memory corruption attacks on control data. Because of its accuracy, the technique is very popular in the systems and security community. However, it can slow down the protected application by an order of magnitude, and in practice, it is limited to non-production machines like honeypots or malware analysis engines. Furthermore, DTA can usu- ally detect only control-flow diverting attacks, so it does not defend against the non- control-diverting ones. Another powerful protection mechanism comes in a form of compiler extensions. WIT [6] is an attractive framework that marries immediate detection of memory corruption to excellent performance. To harden an application, WIT requires recompilation. Unfortunately, access to source code or recompilation is often not possible in 4 CHAPTER 1. INTRODUCTION practice. Most vendors do not share the source, or even the symbol tables, with their customers. In all probability, many programs in use today will never be recompiled at all. To protect such software, we need a solution that works for binaries. In this thesis, we do not consider detection mechanisms such as anomaly detection or behaviour based approaches. Although they are related in the sense that they detect attacks also, they differ greatly in approach and issues (for instance, reducing the number of false positives is the core problem for these systems). 1.2 Goals The goal of this work is to investigate solutions to protect legacy binaries against memory corruption attacks in a timely fashion. Furthermore, we do not limit our- selves to control-diverting attacks, but we also address the non-control-diverting ones. Throughout the thesis, we explore different paths to binary protection, from vulnerability signatures, to host level solutions.

Load more