一種基於編譯器的保護返回位址的方法

Compiler-based approach to protect return address

李宏哲(Hong-Jhe Li)

指導教授 ： 楊吳泉

義守大學/電機資訊學院/資訊工程學系/碩士(2017年)

摘要

堆疊緩衝區溢位攻擊(Stack-based Buffer overflow attack) 一直都是軟體安全頭痛的問題之一，到目前為止還是沒有有效的抑制方法，只能透過編譯器及作業系統的支援促使程式運行狀態宛若處在黑箱之中，藉此使攻擊者無法得到必要的資訊而進一步的利用弱點達到攻擊的效果。
本論文針對返回位址 (return address) 的保護為重點，核心思想為阻止返回位址被惡意的資料所覆蓋，從而避免攻擊者控制指令指標(Instruction Pointer, IP) 來達到更動程式流程的目的。
實驗結果顯示，本論文提出來的保護方法可以確切的保護堆疊中的返回位址不被惡意資料覆蓋，因此也提升了程式本身的安全性。

關鍵字

堆疊緩衝區溢位 ； 返回位址保護

並列摘要

Stack-based buffer overflow attack has been one of the most tough problem of security vulnerability. There is no effectively solution to eliminated for now. Can only make your program runtime like a black box to avoid attacker exploit vulnerability by gathering necessary information of your program.
In this paper we provide a compiler-based solution to prevent Stack-based Buffer overflow attack on the function return address. To prevent override of return address means no control flow hijacked, and the integrity of the program.
Experiment shows that the approach we proposed could protect the return address in the stack buffer effectively therefore more secure software.

並列關鍵字

stack-based buffer overflow ； return address protection ； compiler-based

參考文獻

[1] C. Cowan, P. Wagle, C. Pu, S. Beatte, J. Walpole., “Buffer overflows: Attacks and Defenses for the Vulnerability of the Decade., available via https://css.csail.mit.edu/6.858/2012/readings/buffer-overflows.pdf, DARPA Information Survivability Conference and Exposition, 2000, view in 2017.

[3] PaX-Team, “PaX ASLR(Address Space Layout Randomization)” available via https://pax.grsecurity.net/docs/aslr.txt, 2003, view in 2017.

[2] Haroon Meer, “Memory Corruption Attacks The (almost) Complete History” available via , https://media.blackhat.com/bh-us-10/whitepapers/Meer/BlackHat-USA-2010-Meer-History-of-Memory-Corruption-Attacks-wp.pdf, Black Hat 2010 USA., view in 2017.

[4] Perry Wagle, Crispin Cowan “StackGuard: Simple Stack Smash Protection for GCC” available via, https://ece.uwaterloo.ca/~vganesh/TEACHING/S2014/ECE458/Stackguard.pdf, Immunix Inc., 2003, view in 2017.

[5] PaX-Team, “PaX non-executable pages” available via https://pax.grsecurity.net/docs/noexec.txt, view in 2017.