Nozzle: A Defense Against Heap Spraying Attacks Ben Livshits, Paruj Ratanaworabhan, and Ben Zorn Microsoft Research Redmond, WA

A Brief History of Memory Exploits Stack overflow Heap exploit Heap spraying Frequency Vista heap, layout randomization Nozzle StackGuard Year 2000 2002 2004 2006 2008 2010

Stack Overflow Exploit return address 2 jump NOP sled shellcode <IFRAME SRC=file://BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB … NAME="CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC … ഍഍"></IFRAME> 1 exploit

Heap Corruption Exploit 2 jump vtable pointer NOP sled shellcode <IFRAME SRC=file://BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB … NAME="CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC … ഍഍"></IFRAME> 1 exploit

Heap Spraying Exploit in a Browser sled shellcode sled shellcode <SCRIPT language="text/javascript"> shellcode = unescape("%u4343%u4343%...''); oneblock = unescape("%u0C0C%u0C0C"); var fullblock = oneblock; while (fullblock.length<0x40000) { fullblock += fullblock; } sprayContainer = new Array(); for (i=0; i<1000; i++) { sprayContainer[i] = fullblock + shellcode; </SCRIPT> sled shellcode sled shellcode sled shellcode <IFRAME SRC=file://BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB … NAME="CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC … ഍഍"></IFRAME> sled shellcode sled shellcode vtable pointer sled shellcode sled shellcode sled shellcode sled shellcode 1 spray 2 exploit 3 jump

Kittens of Doom. Is no Data Sacred? Spraying: general attack Embed malicious code in images, documents, DLLs… Image example: Comments, transformed data Documented at BlackHat’08 cmd.exe opened

Visiting a Site Can Compromise Your Whole Machine

Nozzle Overview Heap Spraying Nozzle Relies on pre-existing exploit (in C/C++) Spraying in type-safe language JavaScript, C#, Java JIT-ed languages: good targets Randomization doesn’t help Browsers are popular target Detect / mitigate heap spray attack Monitors heap for suspicious activity Compare to HW “no-execute” page protection More compatible Doesn’t just crash Focus on browser, but applicable to all applications

Nozzle Architecture Monitor allocations Interpret heap objects as code Maintain a global heap health metric: normalized surface area

Local vs. Global Detection Code or Data? Local Detection: Is this object dangerous? Code and data: same on x86 Local detection: 80% FP rate 000000000000000000000000000000000000000000000000000000000000000000000000 000000000000 add [eax], al Global Detection: Is my heap under attack? 0101010101 and ah, [edx] Nozzle: collections of objects Sprayed heap: large attack surface 10

Nozzle Global Heap Metric Normalize to (approx): P(jump will cause exploit) obj Bi SA(Bi) SA(o) SA(H) NSA(H) build CFG Compute threat of entire heap dataflow Compute threat of single block Compute threat of single object

Surface Area Calculation: Dataflow Extract control flow graph (CFG) from heap object SA(Bi) = likelihood of ending in Bi if we land within object boundaries A BB contributes its effective size to another BB’s SA, if there is a path to that other BB BB containing prohibitive instructions has zero effective size int, out, hlt, or ltr An example object from visiting google.com 12

Nozzle Experimental Summary 0 False Positives 10 popular AJAX-heavy sites 150 top Web sites 0 False Negatives 12 published heap spraying exploits and 2,000 synthetic rogue pages generated using Metasploit Runtime Overhead As high as 2x without sampling 5-10% with sampling

economist.com versus mw-612 (actual attack) Normalized Surface Area Logical time (number of allocations/frees)

False Positive Results No more than 12% of max SA reported No false positives reported for 20% threshold What about SA for rogue sites? 15

False Negative Evaluation 12 published heap spray pages 2,000 synthetic heap spray pages using MetaSploit advanced NOP engine Shellcode database

Normalized Surface Area Locally

Global Detection is Necessary P. Akritidis, E. P. Markatos, M. Polychronakis, and K. G. Anagnostakis, STRIDE: Polymorphic sled detection through instruction sequence

Nozzle Runtime Overhead 19

Nozzle is more compatible and more selective Nozzle vs. DEP DEP prevents code execution in memory But, Can be disabled at runtime Has compatibility issue Circumvented with Java (Applet) Nozzle is more compatible and more selective 20

Demo

Conclusion Nozzle: effective heap spraying prevention No false positives, no false negatives Can be used for online or offline scanning

Contact us Ben Livshits (livshits@microsoft.com) Nozzle MSR _