Journal of the Korea Academia-Industrial cooperation Society (한국산학기술학회논문지)

The Korea Academia-Industrial cooperation Society (한국산학기술학회)
권호 표지
DOI QR코드

DOI QR Code

Return address stack for protecting from buffer overflow attack

버퍼오버플로우 공격 방지를 위한 리턴주소 스택

  • Cho, Byungtae (Department of Computer Science and Engineering, Chungnam National University) ;
  • Kim, Hyungshin (Department of Computer Science and Engineering, Chungnam National University)
  • 조병태 (충남대학교 컴퓨터공학과) ;
  • 김형신 (충남대학교 컴퓨터공학과)
  • Received : 2012.07.23
  • Accepted : 2012.10.11
  • Published : 2012.10.31
Download PDF
⟨ Previous Next ⟩

Abstract

Many researches have been performed to resist buffer overflow attacks. However, the attack still poses one of the most important issue in system security field. It is because programmers are using library functions containing security hole and once buffer overflow vulnerability has been found, the security patches are distributed after the attacks are widely spreaded. In this paper, we propose a new cache level return address stack architecture for resisting buffer overflow attack. We implemented our hardware onto SimpleScalar simulator and verified its functionality. Our circuit can overcome the various disadvantages of previous works with small overhead.

버퍼오버플로우 취약점을 이용한 공격기법을 예방하기 위해서 그 동안 많은 연구가 진행되었으며, 여러 가지 탐지기술과 보안패치 등의 노력이 진행되었음에도 불구하고, 여전히 시스템 보안에 있어 가장 중요한 이슈로 지목되고 있는 이유는 아직까지도 프로그램 개발 시 버퍼오버플로우에 취약한 함수와 라이브러리를 이용하여 프로그램을 개발하고 있다는 점과 실제 버퍼오버플로우 취약점이 노출되어 시스템이 공격받은 후에 패치가 이루어진다는 점이다. 본 연구에서는 버퍼오버플로우 예방을 위한 하드웨어적인 보호기법으로 캐시레벨 기반의 리턴주소 스택을 이용한 버퍼오버플로우 보호기법에 대한 연구를 진행하였다. 제안한 스택구조의 성능평가는 SimpleScalar 시뮬레이터를 이용하여 진행하였으며, 본 연구에서 제안한 보호기법은 기존 버퍼오버플로우 취약점을 완벽히 보호할 수 있으며, 일부의 프로그램을 제외한 대부분의 프로그램에서 성능상의 차이가 발견되지 않은 시스템을 개발하였다.

Keywords

References

  1. D.Wagner, J. S. Foster, E. A. Brewer, and A. Aiken. "A first step towards automated detection of buffer overrun vulnerabilities". In Proceedings of Network and Distributed System Security Symposium, pp.3-7, Feb. 2000.
  2. D. Evans and D. Larochelle. "Improving security using extensible lightweight static analysis". IEEE Software, Vol.19, No. 1, pp.42-51, February 2002. https://doi.org/10.1109/52.976940
  3. ICAT Metabase A CVE Based Vulnerability Database, http://www.icat.nist.gov/icat.cfm
  4. C.C. Center. CERT/cc statistics 1988-2003. http://www.cert.org/stats
  5. Mark W. Eichin and Jon A.Rochlis. With microscope and tweezers: An analysis of the Internet virus of November 1988. Proceeding of the IEEE Symposium on Research in Security and Privacy, 1989.
  6. Roman Danyliw and Allen Householder. CERT Advisory CA-2001-19: Code Red Worm Exploiting Buffer Overflow IN IIS Indexing Service DLL. http://www.cert.org/advisories/CA-2001-19.html, Jul. 2001.
  7. The SimpleScalar Toolset, Version 3.0. http://www.simplescalar.com
  8. Lee, R. B., Karig, D. K., McGregor, J. P., and Shi, Z., "Enlisting Hardware Architecture to Thwart Malicious Code Injection," in Proceedings of the Security in Pervasive Computing, Boppard, Germany, 2003, pp.237-252.
  9. SPEC: Standard Performance Evaluation Corporation. http://www.spec.org, September 2000.
  10. clint : A source code checker for C++, http://www.sourceforge.net/projects/clint/
  11. Wagner, D., Foster, J.S, Brewer, E. A., and Aiken, A., "A First Step Towards Automated Detection of Buffer Overrun Vulnerabilities," in Proceedings of the Networks and Distributed System Security Symposium (NDCS), San Diego, CA, USA, 2000.
  12. Cowan, C., Pu, C., Maier, D., Walpole, J., Bakke, P., Beattie, S., Grier, A., Wagle, P., Zhang, Q., and Hinton, H., "Stackguard: Automatic Adaptive Detection and Prevention of Buffer Overflow Attacks," in Proceedings of the 7th USENIX Security Conference, San Antonio, TX, USA, pp. 63-78, 1998.
  13. Oppenheimer, D. L. and Martonosi, M. R., "Performance Signatures: A Mechanism for Intrusion Detection," in Proceedings of the 1997 IEEE Information Survivability Workshop, San Diego, CA, USA, 1997.
  14. Sekar, R., Bendre, M., Dhurjati, D., and Bollineni, P., "A Fast Automaton-Based Method for Detecting Anomalous Program Behaviors," in Proceedings of the IEEE Symposium on Security and Privacy, Oakland, CA, USA, 144-155, 2001.
  15. Ozdoganoglu, H., Brodley, C. E., Vijaykumar, T. N., Kuperman, B. A., and Jalote, A., "SmashGuard: A Hardware Solution to Prevent Security Attacks on the Function Return Address," Purdue University, TR-ECE 03-13, November 22, 2003.
  16. Ye, D. and Kaeli, D., "A Reliable Return Address Stack: Microarchitectural Features to Defeat Stack Smashing," in Proceedings of the Workshop on Architectural Support for Security and Anti-Virus (WASSA), Boston, MA, USA, pp. 69-76, 2004.
  17. Nergel, "The advanced return-into-lib(c) exploits: PaX case study". Phrack Magazine 11(56), Oct. 2004
  18. Ralph Merkle. "Protocols for public key cryptosystems". IEEE Symposium on Security and privacy, pp. 122-134. 1980.
  19. Yong-Joon Park, Gyungo Lee, "Microarchitectural Protection Against Stack-Based Buffer Overflow Attacks", IEEE Micro 2006, Vol. 26, No. 4, pp. 62-71
  20. INOUE Koji, "Return address protection on cache memories". IEICE transactions on electronics (IEICE trans. electron.) 2006, vol. 89, no12, pp. 1937-1947