Data is Flowing in the Wind: A Review of Data-Flow Integrity - - PowerPoint PPT Presentation

▶
data is flowing in the wind a review of data flow
SMART_READER_LITE
LIVE PREVIEW

Data is Flowing in the Wind: A Review of Data-Flow Integrity - - PowerPoint PPT Presentation

Jan 10, 2023 226 likes •961 views

Data is Flowing in the Wind: A Review of Data-Flow Integrity Methods to Overcome Non-Control-Data Attacks Irene Dez-Franco, Igor Santos DeustoTech, University of Deusto irene.diez@deusto.es isantos@deusto.es Rationale Rationale Program

slide-1
SLIDE 1

Data is Flowing in the Wind: A Review of Data-Flow Integrity Methods to Overcome Non-Control-Data Attacks

Irene Díez-Franco, Igor Santos

DeustoTech, University of Deusto irene.diez@deusto.es isantos@deusto.es

slide-2
SLIDE 2

Rationale

slide-3
SLIDE 3

Rationale

Program Control-Data Defences for Control-Data

slide-4
SLIDE 4

Program Control-Data Program Non-Control-Data Defences for Control-Data Defences for Non-Control-Data

Rationale

slide-5
SLIDE 5

Rationale

Program Control-Data Program Non-Control-Data Defences for Control-Data Defences for Non-Control-Data Maybe I should switch to attack non-control data?

slide-6
SLIDE 6

Rationale

Program Control-Data Program Non-Control-Data Defences for Control-Data Defences for Non-Control-Data Maybe I should switch to attack non-control data? I can sense a storm coming….

slide-7
SLIDE 7

Rationale

Program Control-Data Program Non-Control-Data Defences for Control-Data Defences for Non-Control-Data Maybe I should switch to attack non-control data? I can sense a storm coming…. Non-Control-Data Attacks Are Realistic Threats. Chen et al. Usenix Sec’05

slide-8
SLIDE 8

Control Data VS Non-Control-Data Attacks

slide-9
SLIDE 9

Control Data VS Non-Control-Data Attacks

Control-Data Attacks

Modify the control-flow of a program

slide-10
SLIDE 10

Control Data VS Non-Control-Data Attacks

Control-Data Attacks

Modify the control-flow of a program

slide-11
SLIDE 11

Control Data VS Non-Control-Data Attacks

Code injection Code reuse

Control-Data Attacks

Modify the control-flow of a program

slide-12
SLIDE 12

Control Data VS Non-Control-Data Attacks

Code injection Code reuse

Control-Data Attacks

Modify the control-flow of a program

Modify the values of ret, call, jmp

instructions

slide-13
SLIDE 13

Control Data VS Non-Control-Data Attacks

Code injection Code reuse

Control-Data Attacks Non-Control-Data Attacks

Modify the control-flow of a program Do not affect the control-flow of a program

Modify the values of ret, call, jmp

instructions

slide-14
SLIDE 14

Control Data VS Non-Control-Data Attacks

Code injection Code reuse

Control-Data Attacks Non-Control-Data Attacks

Modify the control-flow of a program Do not affect the control-flow of a program

Modify the values of ret, call, jmp

instructions

slide-15
SLIDE 15

Control Data VS Non-Control-Data Attacks

Code injection Code reuse

Control-Data Attacks Non-Control-Data Attacks

Modify the control-flow of a program Do not affect the control-flow of a program Remain invisible to techniques which only focus on control-data

Modify the values of ret, call, jmp

instructions

slide-16
SLIDE 16

Control Data VS Non-Control-Data Attacks

Code injection Code reuse

Control-Data Attacks Non-Control-Data Attacks

Modify the control-flow of a program Do not affect the control-flow of a program Remain invisible to techniques which only focus on control-data What data do they target? → decision making data, user input etc.

Modify the values of ret, call, jmp

instructions

slide-17
SLIDE 17

Security-Critical Non-Control Data

Chen et al. Usenix Sec’05 Hu et al. Usenix Sec’15

slide-18
SLIDE 18

Security-Critical Non-Control Data

Configuration data User input data User identity data Decision-making data

Chen et al. Usenix Sec’05 Hu et al. Usenix Sec’15

slide-19
SLIDE 19

Security-Critical Non-Control Data

Configuration data User input data User identity data Decision-making data Passwords & private keys Randomised values System call parameters

Chen et al. Usenix Sec’05 Hu et al. Usenix Sec’15

slide-20
SLIDE 20

A sample non-control-data attack

slide-21
SLIDE 21

A sample non-control-data attack

struct passwd { uid_t pw_uid; ... } *pw; ... int uid = getuid(); pw->pq_uid = uid; // save current uid // [ format string vulnerability ] ... void passive(void) { … setuid(0); // become root … seteuid(pw->pw_uid); // drop root priv } From wu-ftpd web server. Hu et al. Usenix Sec’15

slide-22
SLIDE 22

A sample non-control-data attack

struct passwd { uid_t pw_uid; ... } *pw; ... int uid = getuid(); pw->pq_uid = uid; // save current uid // [ format string vulnerability ] ... void passive(void) { … setuid(0); // become root … seteuid(pw->pw_uid); // drop root priv }

int uid = getuid(); pw->pq_uid = uid; // save current uid // [ format string vulnerability ] // [ exploit it to overwrite ‘uid’ ] // [ pw->pq_uid = 0; ] void passive(void) { … setuid(0); // become root … seteuid(pw->pw_uid); // avoid priv. drop }

From wu-ftpd web server. Hu et al. Usenix Sec’15

slide-23
SLIDE 23

A sample non-control-data attack

struct passwd { uid_t pw_uid; ... } *pw; ... int uid = getuid(); pw->pq_uid = uid; // save current uid // [ format string vulnerability ] ... void passive(void) { … setuid(0); // become root … seteuid(pw->pw_uid); // drop root priv }

int uid = getuid(); pw->pq_uid = uid; // save current uid // [ format string vulnerability ] // [ exploit it to overwrite ‘uid’ ] // [ pw->pq_uid = 0; ] void passive(void) { … setuid(0); // become root … seteuid(pw->pw_uid); // avoid priv. drop }

Circumvents Control Flow Integrity?

From wu-ftpd web server. Hu et al. Usenix Sec’15

slide-24
SLIDE 24

Data-Flow Stitching

Hu et al. Usenix Sec’15

slide-25
SLIDE 25

Data-Flow Stitching

Hu et al. Usenix Sec’15

struct passwd

{ uid_t pw_uid; ... } *pw; … int uid = getuid(); pw->pq_uid = uid; // [ format string vulnerability ] ... void passive(void) { … setuid(0); // become root … seteuid(pw->pw_uid); }

slide-26
SLIDE 26

Data-Flow Stitching

Hu et al. Usenix Sec’15

struct passwd

{ uid_t pw_uid; ... } *pw; … int uid = getuid(); pw->pq_uid = uid; // [ format string vulnerability ] ... void passive(void) { … setuid(0); // become root … seteuid(pw->pw_uid); } 20

pw &uid time

Stack address of seteuid’s arg

Addresses

slide-27
SLIDE 27

Data-Flow Stitching

Hu et al. Usenix Sec’15

struct passwd

{ uid_t pw_uid; ... } *pw; … int uid = getuid(); pw->pq_uid = uid; // [ format string vulnerability ] ... void passive(void) { … setuid(0); // become root … seteuid(pw->pw_uid); } 20 20

pw &uid time

Stack address of seteuid’s arg

Addresses

slide-28
SLIDE 28

Data-Flow Stitching

Hu et al. Usenix Sec’15

struct passwd

{ uid_t pw_uid; ... } *pw; … int uid = getuid(); pw->pq_uid = uid; // [ format string vulnerability ] ... void passive(void) { … setuid(0); // become root … seteuid(pw->pw_uid); } 20 20

pw &uid time

Stack address of seteuid’s arg

Addresses

slide-29
SLIDE 29

Data-Flow Stitching

Hu et al. Usenix Sec’15

struct passwd

{ uid_t pw_uid; ... } *pw; … int uid = getuid(); pw->pq_uid = uid; // [ format string vulnerability ] ... void passive(void) { … setuid(0); // become root … seteuid(pw->pw_uid); } 20 20

pw &uid time

Stack address of seteuid’s arg 20

Addresses

slide-30
SLIDE 30

Data-Flow Stitching

Hu et al. Usenix Sec’15

struct passwd

{ uid_t pw_uid; ... } *pw; … int uid = getuid(); pw->pq_uid = uid; // [ format string vulnerability ] ... void passive(void) { … setuid(0); // become root … seteuid(pw->pw_uid); } 20 20

pw &uid time

Stack address of seteuid’s arg 20

pw &uid time

Stack address of seteuid’s arg

Addresses Addresses

slide-31
SLIDE 31

Data-Flow Stitching

Hu et al. Usenix Sec’15

struct passwd

{ uid_t pw_uid; ... } *pw; … int uid = getuid(); pw->pq_uid = uid; // [ format string vulnerability ] ... void passive(void) { … setuid(0); // become root … seteuid(pw->pw_uid); } 20 20

pw &uid time

Stack address of seteuid’s arg 20 20 20

pw &uid time

Stack address of seteuid’s arg

Addresses Addresses

slide-32
SLIDE 32

Data-Flow Stitching

Hu et al. Usenix Sec’15

struct passwd

{ uid_t pw_uid; ... } *pw; … int uid = getuid(); pw->pq_uid = uid; // [ format string vulnerability ] ... void passive(void) { … setuid(0); // become root … seteuid(pw->pw_uid); } 20 20

pw &uid time

Stack address of seteuid’s arg 20 20 20

pw &uid time

Stack address of seteuid’s arg

Addresses Addresses

slide-33
SLIDE 33

Data-Flow Stitching

Hu et al. Usenix Sec’15

struct passwd

{ uid_t pw_uid; ... } *pw; … int uid = getuid(); pw->pq_uid = uid; // [ format string vulnerability ] ... void passive(void) { … setuid(0); // become root … seteuid(pw->pw_uid); } 20 20

pw &uid time

Stack address of seteuid’s arg 20 20 20

pw &uid time

Stack address of seteuid’s arg

Addresses Addresses

slide-34
SLIDE 34

Data-Flow Stitching

Hu et al. Usenix Sec’15

struct passwd

{ uid_t pw_uid; ... } *pw; … int uid = getuid(); pw->pq_uid = uid; // [ format string vulnerability ] ... void passive(void) { … setuid(0); // become root … seteuid(pw->pw_uid); } 20 20

pw &uid time

Stack address of seteuid’s arg 20 20 20

pw &uid time

Stack address of seteuid’s arg

Addresses Addresses

Privilege escalation

slide-35
SLIDE 35

Data-Flow Stitching

Hu et al. Usenix Sec’15

struct passwd

{ uid_t pw_uid; ... } *pw; … int uid = getuid(); pw->pq_uid = uid; // [ format string vulnerability ] ... void passive(void) { … setuid(0); // become root … seteuid(pw->pw_uid); } 20 20

pw &uid time

Stack address of seteuid’s arg 20 20 20

pw &uid time

Stack address of seteuid’s arg

Addresses Addresses

Privilege escalation

slide-36
SLIDE 36

Data-Oriented Programming (DOP)

Hu et al. Oakland’16

slide-37
SLIDE 37

Data-Oriented Programming (DOP)

Hu et al. Oakland’16

Code-reuse attacks with Control-Data ROP, JOP, SROP

slide-38
SLIDE 38

Data-Oriented Programming (DOP)

Hu et al. Oakland’16

Code-reuse attacks with Control-Data ROP, JOP, SROP

0x000b8f ... ... Addresses of ROP gadgets ROP payload

(compute) ret

…. CFG Gadgets

slide-39
SLIDE 39

Data-Oriented Programming (DOP)

Hu et al. Oakland’16

Code-reuse attacks with Control-Data ROP, JOP, SROP Requirements: 1. Classic gadgets 2. The gadgets must be chained

0x000b8f ... ... Addresses of ROP gadgets ROP payload

(compute) ret

…. CFG Gadgets

slide-40
SLIDE 40

Data-Oriented Programming (DOP)

Code-reuse attacks with Non-Control-Data DOP

Hu et al. Oakland’16

Code-reuse attacks with Control-Data ROP, JOP, SROP Requirements: 1. Classic gadgets 2. The gadgets must be chained

0x000b8f ... ... Addresses of ROP gadgets ROP payload

(compute) ret

…. CFG Gadgets

slide-41
SLIDE 41

Data-Oriented Programming (DOP)

Code-reuse attacks with Non-Control-Data DOP

Hu et al. Oakland’16

Code-reuse attacks with Control-Data ROP, JOP, SROP Requirements: 1. Classic gadgets 2. The gadgets must be chained

0x000b8f ... ... Addresses of ROP gadgets ROP payload

(compute) ret

…. CFG Gadgets

while (cond) { // mem error // control local vars }

Dispatcher Operations that change the program’s logic (Data-oriented gadgets)

slide-42
SLIDE 42

Data-Oriented Programming (DOP)

Code-reuse attacks with Non-Control-Data DOP Requirements: 1. Data-oriented gadgets 2. Gadget dispatcher

Hu et al. Oakland’16

Code-reuse attacks with Control-Data ROP, JOP, SROP Requirements: 1. Classic gadgets 2. The gadgets must be chained

0x000b8f ... ... Addresses of ROP gadgets ROP payload

(compute) ret

…. CFG Gadgets

while (cond) { // mem error // control local vars }

Dispatcher Operations that change the program’s logic (Data-oriented gadgets)

slide-43
SLIDE 43

Data-Oriented Programming (DOP)

Code-reuse attacks with Non-Control-Data DOP Requirements: 1. Data-oriented gadgets 2. Gadget dispatcher 3. Must follow the legitimate execution path

Hu et al. Oakland’16

Code-reuse attacks with Control-Data ROP, JOP, SROP Requirements: 1. Classic gadgets 2. The gadgets must be chained

0x000b8f ... ... Addresses of ROP gadgets ROP payload

(compute) ret

…. CFG Gadgets

while (cond) { // mem error // control local vars }

Dispatcher Operations that change the program’s logic (Data-oriented gadgets)

slide-44
SLIDE 44

Data-Flow Integrity (DFI)

Castro et al. OSDI’06

slide-45
SLIDE 45

Data-Flow Integrity (DFI)

1 - Offline: DFG computation

Castro et al. OSDI’06

slide-46
SLIDE 46

Data-Flow Integrity (DFI)

1 - Offline: DFG computation

x = 100; a = 0; if (...) { x = 0;

// mem. error

} y = x * 2; Castro et al. OSDI’06

slide-47
SLIDE 47

Data-Flow Integrity (DFI)

1 - Offline: DFG computation

d1: x = 100; d2: a = 0; if (. . .) d3: x = 0; d4: y = x * 2;

x = 100; a = 0; if (...) { x = 0;

// mem. error

} y = x * 2; Data Flow Graph (DFG) Castro et al. OSDI’06

slide-48
SLIDE 48

Data-Flow Integrity (DFI)

1 - Offline: DFG computation

d1: x = 100; d2: a = 0; if (. . .) d3: x = 0; d4: y = x * 2;

x = 100; a = 0; if (...) { x = 0;

// mem. error

} y = x * 2;

2 - Runtime: DFG enforcement

Data Flow Graph (DFG) Castro et al. OSDI’06

slide-49
SLIDE 49

Data-Flow Integrity (DFI)

1 - Offline: DFG computation

d1: x = 100; d2: a = 0; if (. . .) d3: x = 0; d4: y = x * 2;

x = 100; a = 0; if (...) { x = 0;

// mem. error

} y = x * 2; x → { d1, d3 } a → { d2 } y → { d4 }

2 - Runtime: DFG enforcement

Data Flow Graph (DFG) Enforced DFG Castro et al. OSDI’06

slide-50
SLIDE 50

Data-Flow Integrity (DFI)

1 - Offline: DFG computation

d1: x = 100; d2: a = 0; if (. . .) d3: x = 0; d4: y = x * 2;

x = 100; a = 0; if (...) { x = 0;

// mem. error

} y = x * 2; x → { d1, d3 } a → { d2 } y → { d4 }

2 - Runtime: DFG enforcement

Data Flow Graph (DFG) Enforced DFG

d1: x = ...; d2: a = ...; if (...) d4: y = ….;

Execution 1 Castro et al. OSDI’06

slide-51
SLIDE 51

Data-Flow Integrity (DFI)

1 - Offline: DFG computation

d1: x = 100; d2: a = 0; if (. . .) d3: x = 0; d4: y = x * 2;

x = 100; a = 0; if (...) { x = 0;

// mem. error

} y = x * 2; x → { d1, d3 } a → { d2 } y → { d4 }

2 - Runtime: DFG enforcement

Data Flow Graph (DFG) Enforced DFG

d1: x = ...; d2: a = ...; if (...) d4: y = ….;

Execution 1 Castro et al. OSDI’06

slide-52
SLIDE 52

Data-Flow Integrity (DFI)

1 - Offline: DFG computation

d1: x = 100; d2: a = 0; if (. . .) d3: x = 0; d4: y = x * 2;

x = 100; a = 0; if (...) { x = 0;

// mem. error

} y = x * 2; x → { d1, d3 } a → { d2 } y → { d4 }

d1: x = ...; d2: a = ….; if (. . .)

Execution 2 Data Flow Graph (DFG) Enforced DFG

d1: x = ...; d2: a = ...; if (...) d4: y = ….;

Execution 1 Castro et al. OSDI’06

2 - Runtime: DFG enforcement

slide-53
SLIDE 53

Data-Flow Integrity (DFI)

1 - Offline: DFG computation

d1: x = 100; d2: a = 0; if (. . .) d3: x = 0; d4: y = x * 2;

x = 100; a = 0; if (...) { x = 0;

// mem. error

} y = x * 2; x → { d1, d3 } a → { d2 } y → { d4 }

2 - Runtime: DFG enforcement

d1: x = ...; d2: a = ….; if (. . .) d3: x = ….;

Execution 2 Data Flow Graph (DFG) Enforced DFG

d1: x = ...; d2: a = ...; if (...) d4: y = ….;

Execution 1 Castro et al. OSDI’06

slide-54
SLIDE 54

Data-Flow Integrity (DFI)

1 - Offline: DFG computation

d1: x = 100; d2: a = 0; if (. . .) d3: x = 0; d4: y = x * 2;

x = 100; a = 0; if (...) { x = 0;

// mem. error

} y = x * 2; x → { d1, d3 } a → { d2 } y → { d4 }

2 - Runtime: DFG enforcement

d1: x = ...; d2: a = ….; if (. . .) d3: x = ….; dmem_error: x = ….;

Execution 2 Data Flow Graph (DFG) Enforced DFG

d1: x = ...; d2: a = ...; if (...) d4: y = ….;

Execution 1 Castro et al. OSDI’06

slide-55
SLIDE 55

Data-Flow Integrity (DFI)

1 - Offline: DFG computation

d1: x = 100; d2: a = 0; if (. . .) d3: x = 0; d4: y = x * 2;

x = 100; a = 0; if (...) { x = 0;

// mem. error

} y = x * 2; x → { d1, d3 } a → { d2 } y → { d4 }

2 - Runtime: DFG enforcement

d1: x = ...; d2: a = ….; if (. . .) d3: x = ….; dmem_error: x = ….;

Execution 2 Data Flow Graph (DFG) Enforced DFG

d1: x = ...; d2: a = ...; if (...) d4: y = ….;

Execution 1 Castro et al. OSDI’06

slide-56
SLIDE 56

Kernel Data-Flow Integrity

Song et al. NDSS’16

slide-57
SLIDE 57

Kernel Data-Flow Integrity

Protect the kernel against memory-corruption-based privilege escalation attacks

Song et al. NDSS’16

slide-58
SLIDE 58

Kernel Data-Flow Integrity

Protect the kernel against memory-corruption-based privilege escalation attacks

Song et al. NDSS’16

Protect the access control mechanisms

slide-59
SLIDE 59

Kernel Data-Flow Integrity

Protect the kernel against memory-corruption-based privilege escalation attacks

Song et al. NDSS’16

Protect the access control mechanisms

Access control checks Integrity of the code & data of the access controls

slide-60
SLIDE 60

Kernel Data-Flow Integrity

Protect the kernel against memory-corruption-based privilege escalation attacks

Song et al. NDSS’16

Protect the access control mechanisms

Access control checks Integrity of the code & data of the access controls InferDists

slide-61
SLIDE 61

Kernel Data-Flow Integrity

Protect the kernel against memory-corruption-based privilege escalation attacks

Song et al. NDSS’16

Protect the access control mechanisms

Access control checks Integrity of the code & data of the access controls InferDists Control-Data + Non-Control-Data Which are essential to enforce the security invariants?

slide-62
SLIDE 62

ProtectDists

Kernel Data-Flow Integrity

Protect the kernel against memory-corruption-based privilege escalation attacks

Song et al. NDSS’16

Protect the access control mechanisms

Access control checks Integrity of the code & data of the access controls InferDists Control-Data + Non-Control-Data Which are essential to enforce the security invariants?

slide-63
SLIDE 63

ProtectDists

Kernel Data-Flow Integrity

Protect the kernel against memory-corruption-based privilege escalation attacks

Song et al. NDSS’16

Protect the access control mechanisms

Access control checks Integrity of the code & data of the access controls InferDists Control-Data + Non-Control-Data Which are essential to enforce the security invariants? ND ND D ND D D D: distinguishing, ND:non-distinguishing

slide-64
SLIDE 64

ProtectDists

Kernel Data-Flow Integrity

Protect the kernel against memory-corruption-based privilege escalation attacks

Song et al. NDSS’16

Protect the access control mechanisms

Access control checks Integrity of the code & data of the access controls InferDists Control-Data + Non-Control-Data Which are essential to enforce the security invariants? ND ND D ND D D ∅ D: distinguishing, ND:non-distinguishing

slide-65
SLIDE 65

ProtectDists

Kernel Data-Flow Integrity

Protect the kernel against memory-corruption-based privilege escalation attacks

Song et al. NDSS’16

Protect the access control mechanisms

Access control checks Integrity of the code & data of the access controls InferDists Control-Data + Non-Control-Data Which are essential to enforce the security invariants? ND ND D ND D D DFI ∅ D: distinguishing, ND:non-distinguishing

slide-66
SLIDE 66

ProtectDists

Kernel Data-Flow Integrity

Protect the kernel against memory-corruption-based privilege escalation attacks

Song et al. NDSS’16

Protect the access control mechanisms

Access control checks Integrity of the code & data of the access controls InferDists Control-Data + Non-Control-Data Which are essential to enforce the security invariants? ND ND D ND D D DFI DFI ∅ D: distinguishing, ND:non-distinguishing

slide-67
SLIDE 67

Closing remarks

slide-68
SLIDE 68

Closing remarks

slide-69
SLIDE 69

Closing remarks

Defences for Control-Data Defences for Non-Control-Data

slide-70
SLIDE 70

Closing remarks

Defences for Control-Data Defences for Non-Control-Data Why are they constantly making my life harder?

slide-71
SLIDE 71

Closing remarks

Defences for Control-Data Defences for Non-Control-Data Why are they constantly making my life harder? Haters gonna hate

slide-72
SLIDE 72

Data is Flowing in the Wind: A Review of Data-Flow Integrity Methods to Overcome Non-Control-Data Attacks

Irene Díez-Franco, Igor Santos

DeustoTech, University of Deusto irene.diez@deusto.es isantos@deusto.es