CERIAS Weekly Security Seminar – Purdue University
Mathias Payer, WarGames in Memory: Fighting Powerful Attackers
Memory corruption (e.g., buffer overflows, random writes, memoryallocation bugs, or uncontrolled format strings) is one of the oldestand most exploited problems in computer science. These problems arehere to stay as low-level languages like C or C++ continue to tradesafety for potential performance. A small set of all proposedsolutions (e.g., Address Space Layout Randomization, Data ExecutionPrevention, and stack canaries) is applied in practice but realexploits show that all currently deployed protections can be defeated.The problems of current protection mechanisms call for novelapproaches towards software protection that fulfill the followingproperties: low overhead for high security guarantees, no changes tothe original source code, and compatibility to existing libraries andbinaries (including a partial migration strategy).We present a security policy that deterministically protects softwareagainst control-flow hijack attacks. Our mechanism uses both auser-space virtualization system (building on binary translation) tosupport legacy code and a compiler-based framework to enforce theintegrity of all code pointers at runtime. Such a system controls theexecution of all code in user-space, extracts information from allloaded components, and enforces a strong security policy for theexecuted software with low overhead. We show possible pitfalls andlimitations and discuss future extensions and optimizations. About the speaker: Mathias Payer is a security researcher and an assistant professor incomputer science at Purdue university. His interests are related tosystem security, binary exploitation, user-space software-based faultisolation, binary translation/recompilation, and (application)virtualization.Before joining Purdue in 2014 he spent two years as PostDoc in DawnSong's BitBlaze group at UC Berkeley. He graduated from ETH with a Dr.sc. ETH in 2012. The topic of his thesis is related to low-levelbinary translation and security. After developing a fast binarytranslation system (fastBT) he started to analyze different exploittechniques and wondered how binary translation could be used to raisethe guard of current systems (with TRuE and libdetox as a prototypeimplementation of the security framework).
Senaste avsnitt
En liten tjänst av I'm With Friends. Finns även på engelska.