计算机科学 ›› 2018, Vol. 45 ›› Issue (1): 240-244.doi: 10.11896/j.issn.1002-137X.2018.01.042
彭建山,周传涛,王清贤,丁大钊
PENG Jian-shan, ZHOU Chuan-tao, WANG Qing-xian and DING Da-zhao
摘要： ROP是一种流行的软件漏洞利用技术,它与ROP检测技术的对抗正在不断升级。主流的ROP检测工具kBouncer和ROPecker通过LBR寄存器追踪间接跳转指令的执行过程,结合ROP特征检测,对传统的ROP以及改进的JOP等攻击行为都有很好的检测效果。Nicholas提出了绕防方法,但它存在可用gadget数量少、实现难度大等问题。提出了一种基于多路径分发的ROP框架构造方法,基于3种类型的gadget模块构造了一个gadget循环执行的框架,在该框架内可以使用丰富的常规gadget,从而形成一条完整、高效的ROP攻击链。实验表明该方法的实现难度低,不仅能够完成复杂的ROP功能,而且特征足够小,能够绕过主流ROP检测工具的检测。
| [1] SHACMAM H.The geometry of innocent flesh on the bone:return-into-libc without function calls (on the x86) [C]∥ACM Conference on Computer and Communications Security(CCS).New York,USA,2007:552-561. [2] ABADI M,BUDIU M,ERLINGSSON U,et al.Control-flow integrity[C]∥ACM Conference on Computer and Communications Security(CCS).2005:340-353. [3] CHEN P,XIAO H,SHEN X,et al.DROP:Detecting Return-Oriented Programming Malicious Code[C]∥Information Systems Security,International Conference(ICISS 2009).Kolkata,India,2009:163-177. [4] DAVI L,SADEGHI A R,WINANDY M.ROPdefender:a detection tool to defend against return-oriented programming attacks[C]∥ACM Symposium on Information Computer & Communication Security Cited on.2011:40-51. [5] ONARLIOGLU K,BILGE L,LANZI A,et al.G-Free:defeating return-oriented programming through gadget-less binaries[C]∥Twenty-Sixth Computer Security Applications Conference(ACSAC 2010).Austin,Texas,USA,2010:49-58. [6] PAPPAS V,POLYCHRONAKIS M,KEROMYTIS A D.Trans-parent ROP exploit mitigation using indirect branch tracing[C]∥Usenix Conference on Security.2013:447-462. [7] CHENG Y,ZHOU Z,YU M,et al.ROPecker:A Generic andPractical Approach For Defending Against ROP Attacks[C]∥Network and Distributed System Security Symposium(NDSS14).2014. [8] CHECKOWAY S,DAVI L,DMITRIENKO A,et al.Return-oriented programming without returns[C]∥ACM Conference on Computer and Communications Security(CCS 2010).Chicago,Illinois,USA,2010:559-572. [9] BLETSCH T,JIANG X,FREEH V W,et al.Jump-orientedprogramming:a new class of code-reuse attack[C]∥ACM Symposium on Information,Computer and Communications Security(ASIACCS 2011).Hong Kong,China,2011:303-307. [10] CARLINI N,WAGNER D.ROP is still dangerous:breakingmodern defenses[C]∥USENIX Conference on Security Symposium.USENIX Association,2014:385-399. [11] Windows ISV Software Security Defenses[EB/OL].(2010-12-01) [2015-01-30].https://msdn.microsoft.com/en-us/library/bb430720.aspx. [12] SCHWARTZ E J,AVGERINOS T,BRUMLEY D.Q:exploit hardening made easy[C]∥Usenix Conference on Security.USENIX Association,2011:25-25. |
| No related articles found! |
|
||
首页