1. Memory Protection through Dynamic Access Control Kun Zhang, Tao Zhang and Santosh Pande College of Computing Georgia Institute of Technology

2. 2 Introduction Released software contains many vulnerabilities Various types of attacks – stack/heap buffer overflow, format string vuln. Solution: Intrusion Detection Systems (IDS) – Network vs. Host Based – Signature vs. Anomaly Detection “Strange” control flow paths taken

3. 3 Motivation Memory tampering is the starting point of attacks Many attacks don’t modify control flow Propose: IDS scheme with compiler & micro-architecture support that detects memory tampering

4. 4 Basic Idea Compiler – Identify regions that critical object are R_Only / WR – Keep state for every crucial object – Change state before & after every store instruction Hardware – On every store check the state of the object written

5. 5 Baseline Scheme Compiler – Identify regions that critical object are R_Only / WR – Keep state for every crucial object – Change state before & after every store instruction add special instructions Hardware – On every store check the state of the object written

6. 6 Examples

7. 7 Baseline Scheme Pros – Some store instruction has to initiate memory corruption  Coverage 100% Cons – Extremely large overhead – Too many new instructions added Solution: Compiler Optimizations

8. 8 Compiler Framework Overview

9. 9 Static Analysis to find as many target addresses as possible

10. 10 Compiler Framework Overview Identify all the store instructions

11. 11 Compiler Framework Overview Write Range: The shortest distance between two store operations on the same object Baseline Case: two state transitions within a write range Used for later optimization phases

12. 12 Compiler Framework Overview Define Hot / Cold blocks Move Protection Operations to Cold Blocks Tradeoff between performance and security

13. 13 Compiler Framework Overview Protecting every single object becomes not feasible Cost/Benefit analysis to select protection points Analysis unit = write range Protect a write range if WR.benefit/WR.cost is low

14. 14 Compiler Framework Overview Clustering of protection operations Re-arrange layout of objects in memory Decrease number of instructions executed

15. 15 Compiler Framework Overview Profile-driven analysis to identify the possible target addresses Observation: limited number of addresses accessed by a pointer dereference Keep these addresses into a table Don’t check if an address is not present ( - )

16. 16 Compiler Framework Overview Need to define what action to take on every given time Maintain a hash table with all the actions to be taken. Access the table by PC address The table must be filled on run time ( -- ) Need to worry about the security of the table ( --- )

17. 17 Architectural Support

18. 18 Experimental Results - Real attacks and injected bugs tested

19. 19 Experimental Results

20. 20 Experimental Results

21. 21 Conclusion IDS system to identify memory tampering Few of architectural support + Compiler Optimizations Baseline System  100% coverage but 50% overhead Final system  14% overhead, 92.7% randomly injected bugs detected Poorly Written

22. 22 Q & A