1. Enhanced Operating System Security Through Efficient and Fine-grained Address Space Randomization Vikram Reddy Enukonda

2. Outline Kernel-level Exploitation Existing Countermeasures Address Space Randomization Challenges in OS-Level ASR Design for OS-Level ASR OS-Architecture ASR Transformation ASR Performance

3. Kernel-level Exploitation Kernel-level exploitation is increasingly gaining momentum. Many exploits available for Windows, Linux, BSD, Mac OS X, iOS. Plenty of memory error vulnerabilities to choose from. Plethora of internet-connected users running the same kernel version. Many attack opportunities for both local and remote exploits.

4. Existing Countermeasures Preserving kernel code integrity. Kernel hook protection. Control-flow integrity. Comprehensive memory error protection. Virtualization support required, high overhead.

5. Address Space Randomization Well-established defense mechanism against memory error exploits. Application-level support in all the major operating systems. The operating system itself typically not randomized at all. Only recent Windows releases perform basic text randomization. Goal: Fine-grained ASR for operating systems.

6. Challenges in OS-level ASR Instrumentation. Run-time constraints. Attack model. Information leakage. Brute forcing.

7. A Design for OS-level ASR Make both location and layout of memory objects unpredictable. LLVM-based link-time transformations for safe and efficient ASR. Minimal amount of untrusted code exposed to the runtime. Live re-randomization to maximize unobservability of the system. No changes in the software distribution model.

8. The OS Architecture

9. ASR Transformations Code Randomization Static Data Randomization Stack Randomization Dynamic Data Randomization

10. Live Re-randomization First stateful live re-randomization technique. Periodically re-randomize the memory address space layout. Support arbitrary memory layout changes at re- randomization time. Support all the standard C idioms with minimal manual effort. Sandbox the re-randomization code to recover from run-time errors.

11. ASRR Metadata Types Global variables Static variables String constants Functions Dynamic memory allocations

12. Re-randomization Process

13. ASR Performance

14. ASRR Performance

15. Summary A new fine-grained ASR technique for operating systems. Better performance and security than prior ASR solutions. Live re-randomization and ILR to counter information leakage. No heavyweight instrumentation exposed to the runtime. Process-based isolation to recover from run-time ASRR errors.

16. References https://compsec.comp.nus.edu.sg/www/Slides/GroupRead ing.pptx https://compsec.comp.nus.edu.sg/www/Slides/GroupRead ing.pptx http://michael-rushanan.blogspot.com/2013/03/review- enhanced-operating-system.html http://michael-rushanan.blogspot.com/2013/03/review- enhanced-operating-system.html https://scholar.google.com/citations?view_op=view_citation &hl=en&user=2QmtNQsAAAAJ&citation_for_view=2Qmt NQsAAAAJ:zYLM7Y9cAGgC https://scholar.google.com/citations?view_op=view_citation &hl=en&user=2QmtNQsAAAAJ&citation_for_view=2Qmt NQsAAAAJ:zYLM7Y9cAGgC http://dl.acm.org/citation.cfm?id=2362793.2362833

17. Thank You ………………………………………………………………………………………………………………..