Detecting Code Reuse Attacks with a Model of Conformant Program Execution Emily R. Jacobson, Andrew R. Bernat, William R. Williams, Barton P. Miller Computer Sciences Department University of Wisconsin ESSoS 2014 Munich, Germany February 27, 2014

Attack goal: effect some malicious intent by hijacking program control flow Historically, accomplished via code injection Threat Model Detecting Code Reuse Attacks with a Model of Conformant Program Execution heap entry point code process address space stack injected shellcode 2

W X prevents code injection So, code cannot be executed from the stack or heap Alternative: construct an exploit using code that already exists within the program’s address space Threat Model code reuse attacks Detecting Code Reuse Attacks with a Model of Conformant Program Execution heap entry point code process address space stack injected shellcode 3

7a 77 0e 20 e9 3d e0 09 e8 68 c0 45 be 79 5e c0 73 1c a d8 6a d0 56 4b fe af 40 0c b6 f f5 07 b c 85 a5 94 2b 20 fd 5b 95 e7 c a d9 83 a1 37 1b 2f b c 22 8e de a2 87 ad f d2 d2 02 b0 18 b5 f1 b1 fb bb 1f c d f0 2d 7a 77 0e 20 e9 3d e0 09 e8 68 c0 45 be 79 5e c0 73 1c a d8 6a d0 56 4b fe af 40 0c b6 f f5 07 b c 85 a5 94 2b 20 fd 5b 95 e7 c a d9 83 a1 37 1b 2f b c 22 8e de a2 87 ad f d2 d2 02 b0 18 b5 f1 b1 fb bb 1f c d f0 2d 7a 77 0e 20 e9 3d e0 09 e8 68 c0 45 be 79 5e c0 73 1c a d8 6a d0 56 4b fe af 40 0c b6 f f5 07 b c 85 a5 94 2b 20 fd 5b 95 7a 77 0e 20 e9 3d e0 09 e8 68 c0 45 be 79 5e c0 73 1c a d8 6a d0 56 4b fe af 40 0c b6 f f5 07 b c 85 a5 94 2b 20 fd 5b 95 e7 c a d9 83 a1 37 1b 2f b c 22 8e de a2 87 ad f d2 d2 02 b0 18 b5 f1 b1 fb bb 1f e 20 e9 3d e0 09 e8 68 c0 45 be 79 5e c0 73 1c a d8 6a d0 56 4b fe af 40 0c b6 f f5 07 b c 85 a5 94 2b 20 fd 5b 95 7a 77 0e 20 e9 3d e0 09 e8 68 c0 45 be 79 5e Anatomy of a Code Reuse Attack xchg %eax,%ecx fdiv %st(3),%st jmp *-0xf(%esi) xchg %eax,%ecx fdiv %st(3),%st jmp *-0xf(%esi) add %edi,%ebp jmp *-0x39(%ebp) add %edi,%ebp jmp *-0x39(%ebp) mov 0xc(%esi),%eax mov %eax,(%esp) call *0x4(%esi) mov 0xc(%esi),%eax mov %eax,(%esp) call *0x4(%esi) add %edi,%ebp jmp *-0x39(%ebp) add %edi,%ebp jmp *-0x39(%ebp) sysenter … pop %ebx sysenter … pop %ebx Select gadgets from within the address space of the process Chain gadgets together with indirect control flow Usually a short attack with the goal of escaping the confining W X environment exec(“/bin/sh”) code Detecting Code Reuse Attacks with a Model of Conformant Program Execution Example based on exploit presented in Bletsch et al indirect jump instructions  “jump-oriented programming” (JOP)

Anatomy of a Code Reuse Attack Select gadgets from within the address space of the process Chain gadgets together with indirect control flow Detecting Code Reuse Attacks with a Model of Conformant Program Execution 7a 77 0e 20 e9 3d e0 09 e8 68 c0 45 be 79 5e c0 73 1c a d8 6a d0 56 4b fe af 40 0c b6 f f5 07 b c 85 a5 94 2b 20 fd 5b 95 e7 c a d9 83 a1 37 1b 2f b c 22 8e de a2 87 ad f d2 d2 02 b0 18 b5 f1 b1 fb bb 1f c d f0 2d 7a 77 0e 20 e9 3d e0 09 e8 68 c0 45 be 79 5e c0 73 1c a d8 6a d0 56 4b fe af 40 0c b6 f f5 07 b c 85 a5 94 2b 20 fd 5b 95 e7 c a d9 83 a1 37 1b 2f b c 22 8e de a2 87 ad f d2 d2 02 b0 18 b5 f1 b1 fb bb 1f c d f0 2d 7a 77 0e 20 e9 3d e0 09 e8 68 c0 45 be 79 5e c0 73 1c a d8 6a d0 56 4b fe af 40 0c b6 f f5 07 b c 85 a5 94 2b 20 fd 5b 95 7a 77 0e 20 e9 3d e0 09 e8 68 c0 45 be 79 5e c0 73 1c a d8 6a d0 56 4b fe af 40 0c b6 f f5 07 b c 85 a5 94 2b 20 fd 5b 95 e7 c a d9 83 a1 37 1b 2f b c 22 8e de a2 87 ad f d2 d2 02 b0 18 b5 f1 b1 fb bb 1f e 20 e9 3d e0 09 e8 68 c0 45 be 79 5e c0 73 1c a d8 6a d0 56 4b fe af 40 0c b6 f f5 07 b c 85 a5 94 2b 20 fd 5b 95 7a 77 0e 20 e9 3d e0 09 e8 68 c0 45 be 79 5e xchg %eax,%ecx fdiv %st(3),%st jmp *-0xf(%esi) xchg %eax,%ecx fdiv %st(3),%st jmp *-0xf(%esi) add %edi,%ebp jmp *-0x39(%ebp) add %edi,%ebp jmp *-0x39(%ebp) mov 0xc(%esi),%eax mov %eax,(%esp) call *0x4(%esi) mov 0xc(%esi),%eax mov %eax,(%esp) call *0x4(%esi) add %edi,%ebp jmp *-0x39(%ebp) add %edi,%ebp jmp *-0x39(%ebp) sysenter … pop %ebx sysenter … pop %ebx Usually a short attack with the goal of escaping the confining W X environment exec(“/bin/sh”) Example based on exploit presented in Bletsch et al

Existing Defenses Against Code Reuse Attacks Detecting Code Reuse Attacks with a Model of Conformant Program Execution Select gadgets from within the address space of the process Chain gadgets together with indirect control flow Making gadget discovery difficult: ASLR software diversification removal of useful instruction sequences [Li et al. 2010] [Onarlioglu et al. 2010] [Hiser et al. 2012] [Pappas et al. 2012] [Wartell et al. 2012] [Davi et al. 2013] Make discovery difficult, not impossible Detecting control flow manipulations: shadow stack matched call/return pairs [Davi et al. 2009] [Francillon et al. 2009] [Chen et al. 2010] [Huang et al. 2012] [Kayaalp et al. 2012] [Davi et al. 2013] Defeated by JOP Enforcing control flow integrity: [Abadi et al. 2009] [Zhang et al. 2012] [Zhang et al. 2013] Require binary rewriting of all code 6

Our Approach Define security policy based on well-defined behaviors of the program binary Does not rely on behavior of known attacks Use static analysis of binary to extract the model Does not require learning phase or expert knowledge Enforce expected behavior Protects against new exploit variations Detecting Code Reuse Attacks with a Model of Conformant Program Execution 7

Our Approach Define conformant program execution (CPE) as a set of requirements on program states Valid program counter Valid callstack Enforce CPE by monitoring program at runtime Monitor is protected from being exploited because it’s in a separate process Detecting Code Reuse Attacks with a Model of Conformant Program Execution 8

Model Component #1 Valid program counter (PC): PC must point to a valid instruction in the original program Detecting Code Reuse Attacks with a Model of Conformant Program Execution b7fe3424: pop %ebp b7fe3425: pop %edx b7fe3426: pop %ecx b7fe3427: ret b7fe3424: pop %ebp b7fe3425: pop %edx b7fe3426: pop %ecx b7fe3427: ret 0xb7fe3424 PC CFG 9

Model Component #2 Detecting Code Reuse Attacks with a Model of Conformant Program Execution Valid callstack: For each frame: 1.frame must have valid stack frame height 2.(caller  current frame) must represent a valid control flow transfer in the program stack pointer callstack CFG expected stack frame push %ecx push %edx push %ebp mov %esp, %ebp sysenter … jmp b7fe3417 pop %ebp pop edx pop ecx ret push %ecx push %edx push %ebp mov %esp, %ebp sysenter … jmp b7fe3417 pop %ebp pop edx pop ecx ret pop %ebp pop %edx pop %ecx ret pop %ebp pop %edx pop %ecx ret invalid return address valid control flow transfer? 10

Program Validation Design decision: when do we validate? Option 1: At all instructions “Conformant program execution” Disadvantage: inefficient Option 2: At system calls “Observed conformant program execution”(OCPE) Effective because attacks must use the system call interface to modify overall machine state Disadvantage: relies on attack being observable at system calls Detecting Code Reuse Attacks with a Model of Conformant Program Execution 11

ROPStop Implementation Detecting Code Reuse Attacks with a Model of Conformant Program Execution Operating System running process (monitored application) running process (monitored application) system calls intercept via ptrace binary running process ROPStop 1.Attach to running process or launch new process from binary 2.Parse program binary 3.Register callbacks at system calls 4.Continue process At each system call: 1.Validate current program counter 2.Perform robust stackwalk and validate the current callstack or 12

Accuracy Evaluation Overhead False negatives? False positives? Detecting Code Reuse Attacks with a Model of Conformant Program Execution 13

Results: Real Code Reuse Attacks 100% accuracy using real ROP and JOP exploits Detecting Code Reuse Attacks with a Model of Conformant Program Execution 14

Results: Real Code Reuse Attacks Detecting Code Reuse Attacks with a Model of Conformant Program Execution CFG push %ecx push %edx push %ebp mov %esp, %ebp sysenter … jmp b7fe3417 pop %ebp pop edx pop ecx ret push %ecx push %edx push %ebp mov %esp, %ebp sysenter … jmp b7fe3417 pop %ebp pop edx pop ecx ret pop %ebp pop %edx pop %ecx ret pop %ebp pop %edx pop %ecx ret stack pointer callstack expected stack frame invalid return address 15

Results: SPEC CPU % accuracy (0 false positives), 5.3% overhead (geometric mean) Detecting Code Reuse Attacks with a Model of Conformant Program Execution 16

Results: SPEC CPU2006 Where does the overhead come from? PC validity Callstack validity Monitor context switching (~frequency of system calls) Detecting Code Reuse Attacks with a Model of Conformant Program Execution system calls/ second 2.0 system calls/ second 17

Results: Apache HTTP Server 100% accuracy (0 false positives), 6.3% overhead (geometric mean) Detecting Code Reuse Attacks with a Model of Conformant Program Execution 18

Open Questions Data-driven attacks (orthogonal type of attack) [Chen et al. 2005] [Demay et al. 2011] Exploits that modify program data (e.g., system call arguments) to effect an attack May not have visible effects on the program states we monitor Mimicry/evasion attacks (do not exist as code reuse attacks) [Giffin et al. 2006] [Wagner and Soto 2002] Exploits that evade system call monitoring by ensuring program state is restored before system call check takes place Are designed to have no visible effects on the program states we monitor Detecting Code Reuse Attacks with a Model of Conformant Program Execution 19

Conclusion Approach for detecting code reuse attacks We defined conformant program execution and an efficient and adoptable approximation, observed conformant program execution We built a tool to enforce OCPE, ROPStop Detecting Code Reuse Attacks with a Model of Conformant Program Execution 20

Questions? Detecting Code Reuse Attacks with a Model of Conformant Program Execution 21

Overhead breakdown Benchmark System call rate (calls/second)% Overhead Imposed% Instruction Validity% Callstack Validity% Context Switching perlbench bzip bwaves gamess mcf milc zeusmp gromacs cactusADM leslie3d namd gobmk soplex povray hmmer sjeng GemsFDTD libquantum h264ref tonto lbm omnetpp astar wrf sphinx