1. Nozzle: A Defense Against Heap Spraying Attacks
Ben Livshits, Paruj Ratanaworabhan, and Ben Zorn
Microsoft Research
Redmond, WA

2. A Brief History of Memory Exploits
Stack overflow
Heap exploit
Heap spraying
Frequency
Vista heap, layout
randomization
Nozzle
StackGuard
Year
2000
2002
2004
2006
2008
2010

3. Stack Overflow Exploit
return address 2
jump
NOP sled
shellcode
<IFRAME SRC=file://BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB … NAME="CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC …
഍഍"></IFRAME> 1
exploit

4. Heap Corruption Exploit2
jump
vtable pointer
NOP sled
shellcode
<IFRAME SRC=file://BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB … NAME="CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC …
഍഍"></IFRAME> 1
exploit

5. Heap Spraying Exploit in a Browser
sled
shellcode
sled
shellcode
<SCRIPT language="text/javascript">
shellcode = unescape("%u4343%u4343%...'');
oneblock = unescape("%u0C0C%u0C0C");
var fullblock = oneblock;
while (fullblock.length<0x40000) {
fullblock += fullblock; }
sprayContainer = new Array();
for (i=0; i<1000; i++) {
sprayContainer[i] = fullblock + shellcode;
</SCRIPT>
sled
shellcode
sled
shellcode
sled
shellcode
<IFRAME SRC=file://BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB … NAME="CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC …
഍഍"></IFRAME>
sled
shellcode
sled
shellcode
vtable pointer
sled
shellcode
sled
shellcode
sled
shellcode
sled
shellcode 1
spray 2
exploit 3
jump

6. Kittens of Doom. Is no Data Sacred?
Spraying: general attack
Embed malicious code in images, documents, DLLs…
Image example: Comments, transformed data
Documented at BlackHat’08
cmd.exe opened

7. Visiting a Site Can Compromise Your Whole Machine

8. Nozzle Overview Heap Spraying Nozzle
Relies on pre-existing exploit (in C/C++)
Spraying in type-safe language
JavaScript, C#, Java
JIT-ed languages: good targets
Randomization doesn’t help
Browsers are popular target
Detect / mitigate heap spray attack
Monitors heap for suspicious activity
Compare to HW “no-execute” page protection
More compatible
Doesn’t just crash
Focus on browser, but applicable to all applications

9. Nozzle Architecture Monitor allocations Interpret heap objects as code
Maintain a global heap health metric: normalized surface area

10. Local vs. Global Detection
Code or Data?
Local Detection:
Is this object dangerous?
Code and data: same on x86
Local detection: 80% FP rate
add [eax], al
Global Detection:
Is my heap under attack?
and ah, [edx]
Nozzle: collections of objects
Sprayed heap: large attack surface 10

11. Nozzle Global Heap Metric
Normalize to (approx):
P(jump will cause exploit)
obj Bi
SA(Bi)
SA(o)
SA(H)
NSA(H)
build CFG
Compute threat
of entire heap
dataflow
Compute threat of
single block
Compute threat of
single object

12. Surface Area Calculation: Dataflow
Extract control flow graph (CFG) from heap object
SA(Bi) = likelihood of ending in Bi if we land within object boundaries
A BB contributes its effective size to another BB’s SA, if there is a path to that other BB
BB containing prohibitive instructions has zero effective size
int, out, hlt, or ltr
An example object from visiting google.com 12

13. Nozzle Experimental Summary
0 False Positives
10 popular AJAX-heavy sites
150 top Web sites
0 False Negatives
12 published heap spraying exploits and
2,000 synthetic rogue pages generated using Metasploit
Runtime Overhead
As high as 2x without sampling
5-10% with sampling

14. economist.com versus mw-612 (actual attack)
Normalized Surface Area
Logical time (number of allocations/frees)

15. False Positive Results
No more than 12% of max SA reported
No false positives reported for 20% threshold
What about SA for rogue sites? 15

16. False Negative Evaluation
12 published heap spray pages
2,000 synthetic heap spray pages using MetaSploit
advanced NOP engine
Shellcode database

17. Normalized Surface Area Locally

18. Global Detection is Necessary
P. Akritidis, E. P. Markatos, M. Polychronakis, and K. G. Anagnostakis, STRIDE: Polymorphic sled detection through instruction sequence

19. Nozzle Runtime Overhead19

20. Nozzle is more compatible and more selective
Nozzle vs. DEP
DEP prevents code execution in memory
But,
Can be disabled at runtime
Has compatibility issue
Circumvented with Java (Applet)
Nozzle is more compatible and more selective 20

21. Demo

22. Conclusion Nozzle: effective heap spraying prevention
No false positives, no false negatives
Can be used for online or offline scanning

23. Contact us
Ben Livshits
Nozzle MSR _