一種應用於Windows Vista之加強DLL Random Entropy的保護機制

A DLL Protection Mechanism with Larger Random Entropy for Windows Vista

周君樺(Chun-Hua Chou)

指導教授 ： 孫宏民

國立清華大學/電機資訊學院/資訊工程學系/碩士(2009年)

摘要

Recent year, we have seen increased attention being given to Address Space Layout Randomization, or ASLR, in diversity research. The continuing improvements in ASLR on Linux have led to decreasing the probability of attacking vulnerable machines. Windows system also adopts ASLR technique in the operating system on Windows Vista and Windows Server 2008. We investigate the behavior of the ASLR implementation on Windows Vista. Windows Vista randomizes the base addresses of executable and DLLs (Dynamic Link Libraries) from a range of 256 (8-bit) values once per reboot. This entropy is much less than the PaX ASLR. However, the possible of breaking ASLR on Linux has generated wide interest in our research that Windows Vista ASLR technique can be broken by brute-force attack. They broke the PaX ASLR by a novel return-into-libc attack on an Apache HTTP Server. This novel attack only guesses 16-bit offset instead of knowing the address of both the library segment and the stack. Therefore, the aim of this paper attempts to avoid attackers breaking the ASLR technique on Windows Vista by using a novel return-into-dlls attack similar to this novel return-into-libc attack. To that end, we present a comprehensive system that provides: (1) 13-bit randomness at preprocessing phase, and (2) an additional re-randomizing phase to relocate the entrance of each Win32 API after called. Experiments show that our system imposes no significant overhead on the whole program. Moreover, we explore how our system defeats the classes of attacks that previous ASLR approaches cannot defense. To conclude, our security mechanism increases the effectiveness of randomization.

關鍵字

隨機化 ； API 掛鉤

並列摘要

近年來，許多位址空間佈局隨機化的技術已受到廣泛的重視。位址空間佈局隨機化可以使得攻擊者不能藉由相同的攻擊程式達到像蠕蟲一樣廣泛攻擊的目的。現今，這項技術已經被廣泛的應用於Unix-like的系統上，Windows也將位址空間佈局隨機化的技術整合進新推出的作業系統Vista上。然而，Windows Vista上位址空間佈局隨機化的技術只提供8-bit的值，遠比PaX位址空間佈局隨機化(16-bit)的機制少很多。此外，Windows Vista只有在每次重新開機時，作業系統才會重新佈局DLL在記憶體中的位址空間。近年來已有研究利用return-into-libc attack破解PaX位址空間佈局隨機化的機制，我們也將利用相同的方式(return-into-dlls attack)來破解Windows Vista上位址空間佈局隨機化的機制。在本篇論文中，我們將設計一種應用於Windows Vista上之加強動態鏈結程式庫隨機化的機制並且能夠防止攻擊者透過retrun-into-dlls attack來達到攻擊的目的。我們不但提供了13-bit隨機化的值，而且在每次呼叫完Win32 API後，隨機改變Win32 API的入口位址，達到每次呼叫隨機化的目的。實驗結果顯示我們的系統可以抵擋傳統位址空間佈局隨機化的機制所不能抵擋的攻擊，例如：資訊揭露攻擊(information leakage attack)。此外，我們的系統對整體效能影響不大，平均只有增加大約8%的時間。

並列關鍵字

Randomization ； API hooking

參考文獻

[2] E. G. Barrantes, D. H. Ackley, S. Forrest, T. S. Palmer, D. Stefanovic, and D. D. Zovi. Randomized Instruction Set Emulation to Disrupt Binary Code

[5] CERT. Multiple Vulnerabilities in Oracle Servers.

[7] S. Forrest, A. Somayaji, and D. H. Ackley. Building Diverse Computer Systems. In Proceedings of the 6th Workshop on Hot Topics in Operating Systems, page 67-72, Washington, DC, USA, 1997. IEEE Computer Society.

[8] M. Howard. Address Space Layout Randomization in Windows

[10] X. Jiang, H. J. Wang, D. Xu, and Y.-M. Wang. RandSys: Thwarting Code Injection Attacks with System Service Interface Randomization. In Proceedings of the 26th IEEE International Symposium on Reliable Distributed Systems, pages 209-218, Washington, DC, USA, 2007. IEEE Computer Society.