FORECAST: Fast Generation of Accurate Context-Aware Signatures of Control-Hijacking Attacks

•Descargar como PPT, PDF•

0 recomendaciones•308 vistas

$Alexey Smirnov, Huijia Lin, and Tzi-cker Chiueh Experimental Computer Systems Lab, Department of Computer Science, SUNY Stony Brook FORECAST: Fast Generation of Accurate Context-Aware Signatures of Control-Hijacking Attacks Contact Information ECSL Lab at SUNY Stony Brook: http://www.ecsl.cs.sunysb.edu E-mail: {alexey,lhj,chiueh}@cs.sunysb.edu Evaluation Test suite: named — a DNS daemon from BIND 8.1 program ghttpd — an HTTP server drcatd — a remote cat program squid – web caching daemon passlogd – syslog sniffer. Instrumentation Overheads: Signatures Evaluation: named signature ghttpd signature FORECAST System Architecture FORCAST compiler is an extension to GNU C Compiler. FORECAST run-time library has functions for attack detection, packet identification, and signature generation. The main idea is to log each memory update that a program performs at run-time in a memory updates log. At compile time , FORECAST instruments the program so that it can generate log records and detect an attack. At run-time , the instrumented program generates memory updates log records and uses this information when an attack is detected. ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],FTP Sever Example A vulnerable FTP server code Memory updates log Saved return address is in buf[17] FTP server GET multi-packet attack Signature char buf [ 16 ]; Is_auth = is_user =0; // user not authenticated initially while (1) { recv_packet( p ); if (! strncmp ( p , “QUIT”,4)) break ; if (! strncmp ( p , “USER”, 4)) { is_user =1; continue ; } if (! strncmp ( p , “PASS”, 4) && is_user ) { is_auth =1; continue ; } if (! is_auth ) continue ; // authentication required if (! strncmp ( p , “GET”, 3)) { strcpy ( buf , p+4 ); // overflow occurs send_file( buf ); } } Attack Detection Most control-hijacking attacks modify a control sensitive data structure in the victim program, for example a return address. The attacker gets control when the function returns. At the function prolog, the return address is stored in the return address repository. At the function epilog, the return address on the stack is compared with the value stored in the return address repository. If they are different then an attack is detected. Control and Data Dependencies A data dependency is created between variable X and Y when X=Y is executed. A control dependency is created between X and Y when Y defines X’s value using a conditional expression: if (Y>1) X=1; else X=2. For each conditional and loop expression FORECAST inserts a special log record . Memory updates log allows to identify control and data dependencies. Using data dependencies only is insufficient, for example for an FTP server that requires authentication. Memory Updates Logging Memory updates log record: For assignment statement X = Y, For X = Y + Z, an entry is created for each operand. Standard library functions are proxied: recv(socket, &buf, sizeof(buf), 0) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]$

Más contenido relacionado

La actualidad más candente

Instruction Combine in LLVMWang Hsiangkai

First session quizKeroles karam khalil

CNIT 127 Ch 2: Stack overflows on LinuxSam Bowne

Specialized Compiler for Hash CrackingPositive Hack Days

ocelotsean chen

[COSCUP 2021] A trip about how I contribute to LLVMDouglas Chen

Matlab isim linkMohamed Abdelsalam

Unit 1siddr

TLPI - 6 ProcessShu-Yu Fu

Unix processesSunil Rm

Machine Trace MetricsWang Hsiangkai

How Functions WorkSaumil Shah

Operating Systems - A PrimerSaumil Shah

GCCKir Chou

How it's made: C++ compilers (GCC)Sławomir Zborowski

Productive OpenCL Programming An Introduction to OpenCL Libraries with Array...AMD Developer Central

GCC Compiler as a Performance Testing tool for C programsDaniel Ilunga

GNU Compiler Collection - August 2005Saleem Ansari

Code gpu with cuda - CUDA introductionMarina Kolpakova

GCC compilerAnil Pokhrel

La actualidad más candente (20)

Instruction Combine in LLVM

First session quiz

CNIT 127 Ch 2: Stack overflows on Linux

Specialized Compiler for Hash Cracking

ocelot

[COSCUP 2021] A trip about how I contribute to LLVM

Matlab isim link

Unit 1

TLPI - 6 Process

Unix processes

Machine Trace Metrics

How Functions Work

Operating Systems - A Primer

GCC

How it's made: C++ compilers (GCC)

Productive OpenCL Programming An Introduction to OpenCL Libraries with Array...

GCC Compiler as a Performance Testing tool for C programs

GNU Compiler Collection - August 2005

Code gpu with cuda - CUDA introduction

GCC compiler

Similar a FORECAST: Fast Generation of Accurate Context-Aware Signatures of Control-Hijacking Attacks

DIRA: Automatic Detection, Identification, and Repair of Controll-Hijacking a...Alexey Smirnov

MacOS forensics and anti-forensics (DC Lviv 2019) presentationOlehLevytskyi1

Ngrep commandsRishu Seth

Unix And Shell ScriptingJaibeer Malik

MPIZongYing Lyu

Tutorial of SF-TAP Flow AbstractorYuuki Takano

Hunting for APT in network logs workshop presentationOlehLevytskyi1

Linux 系統程式--第一章 i/o 函式艾鍗科技

What`s new in Java 7Georgian Micsa

Operating system conceptsGreen Ecosystem

Creating Great REST and gRPC API Experiences (in Swift)Tim Burks

Buffer overflowEvgeni Tsonev

1-Information sharing 2-Computation speedup3-Modularity4-.docxSONU61709

C library for input output operations.cstdio.(stdio.h)leonard horobet-stoian

Dc 12 Chiuehwollard

Dive into exploit developmentPayampardaz

Backtrack Manual Part6Nutan Kumar Panda

project_docsAndrey Lavrinovic

Unit5 C arnold 7490

Reverse shellIlan Mindel

Similar a FORECAST: Fast Generation of Accurate Context-Aware Signatures of Control-Hijacking Attacks (20)

DIRA: Automatic Detection, Identification, and Repair of Controll-Hijacking a...

MacOS forensics and anti-forensics (DC Lviv 2019) presentation

Ngrep commands

Unix And Shell Scripting

MPI

Tutorial of SF-TAP Flow Abstractor

Hunting for APT in network logs workshop presentation

Linux 系統程式--第一章 i/o 函式

What`s new in Java 7

Operating system concepts

Creating Great REST and gRPC API Experiences (in Swift)

Buffer overflow

1-Information sharing 2-Computation speedup3-Modularity4-.docx

C library for input output operations.cstdio.(stdio.h)

Dc 12 Chiueh

Dive into exploit development

Backtrack Manual Part6

project_docs

Unit5 C

Reverse shell

Último

Modern Roaming for Notes and Nomad – Cheaper Faster Better Strongerpanagenda

Digital Identity is Under Attack: FIDO Paris Seminar.pptxLoriGlavin3

UiPath Community: Communication Mining from Zero to HeroUiPathCommunity

Moving Beyond Passwords: FIDO Paris Seminar.pdfLoriGlavin3

Long journey of Ruby standard library at RubyConf AU 2024Hiroshi SHIBATA

Take control of your SAP testing with UiPath Test SuiteDianaGray10

Unleashing Real-time Insights with ClickHouse_ Navigating the Landscape in 20...Alkin Tezuysal

New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024BookNet Canada

Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptxLoriGlavin3

Enhancing User Experience - Exploring the Latest Features of Tallyman Axis Lo...Scott Andery

Genislab builds better products and faster go-to-market with Lean project man...Farhan Tariq

Generative Artificial Intelligence: How generative AI works.pdfIngrid Airi González

The Future Roadmap for the Composable Data Stack - Wes McKinney - Data Counci...Wes McKinney

Decarbonising Buildings: Making a net-zero built environment a realityIES VE

A Framework for Development in the AI AgeCprime

Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxLoriGlavin3

Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24Mark Goldstein

What is DBT - The Ultimate Data Build Tool.pdfMounikaPolabathina

Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024BookNet Canada

A Deep Dive on Passkeys: FIDO Paris Seminar.pptxLoriGlavin3

FORECAST: Fast Generation of Accurate Context-Aware Signatures of Control-Hijacking Attacks

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Similar a FORECAST: Fast Generation of Accurate Context-Aware Signatures of Control-Hijacking Attacks

Similar a FORECAST: Fast Generation of Accurate Context-Aware Signatures of Control-Hijacking Attacks (20)

Último

Último (20)

FORECAST: Fast Generation of Accurate Context-Aware Signatures of Control-Hijacking Attacks