CONTROL-FLOW INTEGRITY PROTECTIONS FOR MODERN SOFTWARE X IAOYANG X U - - PowerPoint PPT Presentation

▶
control flow integrity protections for modern software
SMART_READER_LITE
LIVE PREVIEW

CONTROL-FLOW INTEGRITY PROTECTIONS FOR MODERN SOFTWARE X IAOYANG X U - - PowerPoint PPT Presentation

Sep 28, 2022 348 likes •514 views

C ON FIRM: EVALUATING COMPATIBILITY AND RELEVANCE OF CONTROL-FLOW INTEGRITY PROTECTIONS FOR MODERN SOFTWARE X IAOYANG X U , M ASOUD G HAFFARINIA , Z HIQIANG L IN W ENHAO W ANG , AND K EVIN W. H AMLEN T HE O HIO S TATE U NIVERSITY T HE U NIVERSITY

slide-1
SLIDE 1

CONFIRM: EVALUATING COMPATIBILITY AND RELEVANCE OF CONTROL-FLOW INTEGRITY PROTECTIONS FOR MODERN SOFTWARE

Supported in part by: ONR award N00014-17-2995, DARPA award FA8750-19- C-0006, NSF awards #1513704 and #1834215, and an NSF I/UCRC Award from Lockheed Martin

Any opinions, findings, conclusions, or recommendations expressed in this presentation are those of the author(s) and do not necessarily reflect the views of the ONR, DARPA, NSF, or Lockheed Martin.

XIAOYANG XU, MASOUD GHAFFARINIA, WENHAO WANG, AND KEVIN W. HAMLEN THE UNIVERSITY OF TEXAS AT DALLAS ZHIQIANG LIN THE OHIO STATE UNIVERSITY

slide-2
SLIDE 2

Compiler-based CFI transformation

Compiler

Source-agnostic CFI transformation

Control-Flow Integrity

[M. Abadi, M. Budiu, Ú. Erlingsson, and J. Ligatti; CCS’05. ]

2

Source code Binary code

CFI instrumented binary code

Control-flow graph policies

slide-3
SLIDE 3

CFI Research Timeline

3

1993 … 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018

SFI [Wahbe et al.]

  • Prog. Shepherding [Kiriansky]

ExecShield [van de Ven & Moinar] CFI [Abadi et al.] XFI [Erlingsson et al.] PittSFIeld [McCamant & Morrisett] NaCl [Yee et al.] Hypersafe [Wang & Jiang] CFLocking [Bletsch et al.]

MIP [Niu & Tan] kBouncer [Pappas et al.] CFRestrictor [Pewny & Holz] CCFIR [Zhang et al.]

MoCFI [Davi et al.] Reins [Wartell et al.] STIR [Wartell et al.]

ROPecker [Cheng et al.] KCoFI [Criswell et al.] SafeDispatch [Jang et al.] T-VIP [Gawlik] RockJIT [Niu & Tan] VTV [Tice et al.] MCFI [Niu & Tan] IFCC [Tice et al.]

C-CFI [Mashtizadeh et al.] vfGuard [Prakash et al.] VTint [Zhang et al.] PathArmor [van der Veen] CFIGuard [Yuan et al.] Microsoft CFG πCFI [Niu & Tan] LLVM CFI Lockdown [Payer et al.] VTI [Bounov et al.] Kernel CFI [Ge et al.] TypeArmor [van der Veen] VTrust [Zhang et al.] VTPin [Sarbinowski et al.]

vCFI [Li et al.] RAGuard [Zhang et al.] ECFI [Abbasi et al.] PT-CFI [Gu et al.] PittyPat [Ding et al.] OFI [Wang et al.] CFI [Muntean et al.] VM-CFI [Kwon et al.] LPCFI [Barbar et al.] CFIXX [Burow et al.] LEA-CFI [Qiu et al.] uCFI [Hu et al.] …

CFI: Precision, Security, and Performance [Burow et al., CSUR’17]

slide-4
SLIDE 4

Scalability Gap

4 88% 2% 9% 1%

Desktop OS Market Share (2019-07)

Windows Linux MacOS Other 100 200 300 400 500 600

Top 10 Security Vulnerabilities Exploited by Hackers in 2018

4% 94% 2%

CFI Research Papers (2005-2018 )

Windows Linux Other

*Papers containing at least one experiment where at least one COMPLETE non-benchmark application for the indicated OS was rewritten & secured

 Windows/MacOS in mission-critical

environments

 “About 75% of control systems are on

Windows XP or other nonsupported OSes.”

–Daryl Haegley, Office of Assistant Secretary of Defense for Energy, Installations and Environment

 More than 25% of all government computers

currently run an outdated Windows or MacOS operating system. [BitSight, 6/1/17]

 DHS, Coast Guard, and Secret Service

currently store top secret information on

  • utdated Windows 2003 servers. [OIG-18-56,

3/1/18]

 Hundreds of satellites run Windows 95

and/or are controlled by Windows Mobile devices.

slide-5
SLIDE 5

Why are the limitations?

5

 Compatibility of CFI solutions are

under-studied

 CFI implementations are commonly

evaluated in terms of performance and security

 CPU benchmarks are widely adopted

for CFI evaluation

 A systematic study for CFI

compatibility problems

 A new testing suite designed

specifically for CFI evaluation

CONFIRM (CONtrol-Flow Integrity Relevance Metrics)

Goals

Our solution: CONFIRM

 A set of 20 widespread classes of

compatibility problems identified

 The first testing suite designed specifically

for CFI solution evaluation

 Reevaluation of 12 CFI implementations

◼ These CFI implementations pass 53% of

CONFIRM’s compatibility and security tests

 Correlation with CPU benchmarks

Problems

https://github.com/SoftwareLanguagesSecurityLab/Confirm

slide-6
SLIDE 6

20 Widespread Classes of CFI Compatibility Problems

6

Compatibility Problem Real-world Software Examples

Function Pointers 7-Zip, Adobe Reader, Apache, Calculator, Chrome, Dropbox, Firefox, JVM, … Callbacks 7-Zip, Adobe Reader, Apache, Calculator, Chrome, Dropbox, Firefox, JVM, … Dynamic Linking 7-Zip, Adobe Reader, Apache, Calculator, Chrome, Dropbox, Firefox, JVM, … Delay-Loading Adobe Reader, Calculator, Chrome, Firefox, JVM, MS Paint, MS Powerpoint, … Exporting/Importing Data Symbols 7-Zip, Apache, Calculator, Chrome, Dropbox, Firefox, MS Paint, MS Powerpoint, … Virtual Functions 7-Zip, Adobe Reader, Calculator, Chrome, Dropbox, Firefox, JVM, Notepad, … Writable Vtables programs with UI’s based on GTK+ (Linux) or COM (Windows) Tail Calls programs compiled with tail-call optimization (e.g., -O2 or /O2) Switch-Case Statements 7-Zip, Adobe Reader, Apache, Calculator, Chrome, Dropbox, Firefox, JVM, … Returns almost every benign program Unmatched Call/Return Pairs Adobe Reader, Apache, Chrome, Firefox, JVM, MS PowerPoint, Visual Studio, … Exceptions 7-Zip, Adobe Reader, Apache, Calculator, Chrome, Dropbox, Firefox, JVM, … Calling Conventions almost every program has functions Multithreading 7-Zip, Adobe Reader, Apache, Calculator, Chrome, Dropbox, Firefox, JVM, … TLS Callbacks Adobe Reader, Chrome, Firefox, MS Paint, TeXstudio, UPX Position-Independent Code 7-Zip, Adobe Reader, Apache, Calculator, Chrome, Dropbox, Firefox, JVM, … Memory Management 7-Zip, Adobe Reader, Apache, Chrome, Dropbox, Firefox, MS PowerPoint, … JIT Code Adobe Flash, Chrome, Dropbox, Firefox, JVM, MS PowerPoint, PotPlayer, … Self-Unpacking programs decompressed by self-extractors (e.g., UPX, NSIS) Runtime API Hooking Microsoft Office, including MS Excel, MS PowerPoint, etc.

slide-7
SLIDE 7

ConFIRM: Control-Flow Integrity Relevance Metrics

7

slide-8
SLIDE 8

A Compatibility Problem Example — Returns

8

Source Code

1 void authenticate() { 2

…

3

f();

4

authenticated = 1;

5

…

6 } 7 void print_prompt() { 8

…

9

f();

10

…

11 } 12 void f() { 13

…

14

return;

15 }

Assembly Code

1 _authenticate: 2 … 3 call _f 4 mov [authenticated], 1 5 … 6 _print_prompt: 7 … 8 call _f 9 … 10 _f: 11 … 12

ret

12

if (!is_valid_target([esp]))

13

jmp security_abort

CFI Hardened Assembly Code

14

slide-9
SLIDE 9

9

Source Code

int main() { f(); return 0; } void f() { try { g(); } catch (int e) { // Exception handler code } return; } void g() { h(); return; } void h() { throw 3; return; }

Stack

… EIP Return address to previous function TOP Return address from f to main Return address from g to f Return address from h to g

Stack unwinding

Shadow Stack

… Return address to previous function TOP Return address from f to main Return address from g to f Return address from h to g

Some shadow stack implementations are based on traditional call/return matching

POLICY VIOLATION: return address on the stack ≠ return address on the shadow stack

Another Compatibility Problem Example — Unmatched Call/Return Pairs

int main() { void f() { void g() { void h() { throw 3; return;

slide-10
SLIDE 10

20 Widespread Classes of CFI Compatibility Problems

10

Compatibility Metric Real-world Software Examples

Function Pointers 7-Zip, Adobe Reader, Apache, Calculator, Chrome, Dropbox, Firefox, JVM, … Callbacks 7-Zip, Adobe Reader, Apache, Calculator, Chrome, Dropbox, Firefox, JVM, … Dynamic Linking 7-Zip, Adobe Reader, Apache, Calculator, Chrome, Dropbox, Firefox, JVM, … Delay-Loading Adobe Reader, Calculator, Chrome, Firefox, JVM, MS Paint, MS Powerpoint, … Exporting/Importing Data Symbols 7-Zip, Apache, Calculator, Chrome, Dropbox, Firefox, MS Paint, MS Powerpoint, … Virtual Functions 7-Zip, Adobe Reader, Calculator, Chrome, Dropbox, Firefox, JVM, Notepad, … Writable Vtables programs with UI’s based on GTK+ (Linux) or COM (Windows) Tail Calls programs compiled with tail-call optimization (e.g., -O2 or /O2) Switch-Case Statements 7-Zip, Adobe Reader, Apache, Calculator, Chrome, Dropbox, Firefox, JVM, … Returns almost every benign program Unmatched Call/Return Pairs Adobe Reader, Apache, Chrome, Firefox, JVM, MS PowerPoint, Visual Studio, … Exceptions 7-Zip, Adobe Reader, Apache, Calculator, Chrome, Dropbox, Firefox, JVM, … Calling Conventions almost every program has functions Multithreading 7-Zip, Adobe Reader, Apache, Calculator, Chrome, Dropbox, Firefox, JVM, … TLS Callbacks Adobe Reader, Chrome, Firefox, MS Paint, TeXstudio, UPX Position-Independent Code 7-Zip, Adobe Reader, Apache, Calculator, Chrome, Dropbox, Firefox, JVM, … Memory Management 7-Zip, Adobe Reader, Apache, Chrome, Dropbox, Firefox, MS PowerPoint, … JIT Code Adobe Flash, Chrome, Dropbox, Firefox, JVM, MS PowerPoint, PotPlayer, … Self-Unpacking programs decompressed by self-extractors (e.g., UPX, NSIS) Runtime API Hooking Microsoft Office, including MS Excel, MS PowerPoint, etc.

slide-11
SLIDE 11

Cross-Thread Stack-Smashing Attack

11

Thread 1 (malicious)

1 while (1) { 2

// smash thread 2’s

3

// return address

4

*p = 0xDEADBEEF

5 }

Thread 2 (CFI instrumented)

1 _f: 2 … 3 if (!is_valid_target([esp])) 4 jmp security_abort 5 ret

TOCTOU window

slide-12
SLIDE 12

ConFIRM: Control-Flow Integrity Relevance Metrics

12

slide-13
SLIDE 13

CFI Performance Measurement Problems

13

slide-14
SLIDE 14

Conclusions

14

 Compatibility of CFI solutions are under-studied

 Complicated compatibility problems lurking in large COTS software products

 CFI implementations are commonly evaluated in terms of performance and

security using CPU benchmarks.

 Proposed solution: CONFIRM  A set of 20 CFI-relevant compatibility problems  The first testing suite designed specifically for CFI solution evaluation  Reevaluation of 12 CFI implementations  Correlation with SPEC CPU benchmarks  https://github.com/SoftwareLanguagesSecurityLab/Confirm

slide-15
SLIDE 15

THANK YOU

Supported in part by: ONR award N00014-17-2995, DARPA award FA8750-19- C-0006, NSF awards #1513704 and #1834215, and an NSF I/UCRC Award from Lockheed Martin

Any opinions, findings, conclusions, or recommendations expressed in this presentation are those of the author(s) and do not necessarily reflect the views of the ONR, DARPA, NSF, or Lockheed Martin.

https://github.com/SoftwareLanguagesSecurityLab/Confirm