Enabling Client-Side Crash-Resistance to Overcome Diversification - - PowerPoint PPT Presentation

▶
enabling client side crash resistance to overcome
SMART_READER_LITE
LIVE PREVIEW

Enabling Client-Side Crash-Resistance to Overcome Diversification - - PowerPoint PPT Presentation

Mar 01, 2024 30 likes •662 views

Enabling Client-Side Crash-Resistance to Overcome Diversification and Information Hiding Robert Gawlik , Benjamin Kollenda, Philipp Koppe, Behrad Garmany, Thorsten Holz Ruhr University Bochum Horst Grtz Institute for IT-Security Bochum,

slide-1
SLIDE 1

Enabling Client-Side Crash-Resistance to Overcome Diversification and Information Hiding

Ruhr University Bochum Horst Görtz Institute for IT-Security Bochum, Germany Robert Gawlik, Benjamin Kollenda, Philipp Koppe, Behrad Garmany, Thorsten Holz

slide-2
SLIDE 2

Crash-Resistance

slide-3
SLIDE 3

NDSS 2016 | San Diego | 02/24/2016

char* addr = 0; void crash(){ addr++; printf("reading %x", addr); char content = *(addr); printf("read done"); } int main(){ MSG msg; SetTimer(0, 0, 1, crash); while(1){ GetMessage(&msg, NULL, 0, 0); DispatchMessage(&msg); } }

Crash-Resistance

slide-4
SLIDE 4

NDSS 2016 | San Diego | 02/24/2016

char* addr = 0; void crash(){ addr++; printf("reading %x", addr); char content = *(addr); printf("read done"); } int main(){ MSG msg; SetTimer(0, 0, 1, crash); while(1){ GetMessage(&msg, NULL, 0, 0); DispatchMessage(&msg); } }

Crash-Resistance

  • Set timer callback crash()
slide-5
SLIDE 5

NDSS 2016 | San Diego | 02/24/2016

char* addr = 0; void crash(){ addr++; printf("reading %x", addr); char content = *(addr); printf("read done"); } int main(){ MSG msg; SetTimer(0, 0, 1, crash); while(1){ GetMessage(&msg, NULL, 0, 0); DispatchMessage(&msg); } }

Crash-Resistance

  • Set timer callback crash()
  • Dispatch crash() each ms
slide-6
SLIDE 6

NDSS 2016 | San Diego | 02/24/2016

char* addr = 0; void crash(){ addr++; printf("reading %x", addr); char content = *(addr); printf("read done"); } int main(){ MSG msg; SetTimer(0, 0, 1, crash); while(1){ GetMessage(&msg, NULL, 0, 0); DispatchMessage(&msg); } }

Crash-Resistance

  • Set timer callback crash()
  • Dispatch crash() each ms
  • crash() generates a fault on

first execution

slide-7
SLIDE 7

NDSS 2016 | San Diego | 02/24/2016

char* addr = 0; void crash(){ addr++; printf("reading %x", addr); char content = *(addr); printf("read done"); } int main(){ MSG msg; SetTimer(0, 0, 1, crash); while(1){ GetMessage(&msg, NULL, 0, 0); DispatchMessage(&msg); } }

Program should terminate abnormally Crash-Resistance

  • Set timer callback crash()
  • Dispatch crash() each ms
  • crash() generates a fault on

first execution

slide-8
SLIDE 8

NDSS 2016 | San Diego | 02/24/2016

slide-9
SLIDE 9

NDSS 2016 | San Diego | 02/24/2016

slide-10
SLIDE 10

NDSS 2016 | San Diego | 02/24/2016

char* addr = 0; void crash(){ addr++; printf("reading %x", addr); char content = *(addr); printf("read done"); } int main(){ MSG msg; SetTimer(0, 0, 1, crash); while(1){ GetMessage(&msg, NULL, 0, 0); DispatchMessage(&msg); } }

Program should terminate abnormally Crash-Resistance

  • Set timer callback crash()
  • Dispatch crash() each ms
  • crash() generates a fault on

first execution

slide-11
SLIDE 11

NDSS 2016 | San Diego | 02/24/2016

char* addr = 0; void crash(){ addr++; printf("reading %x", addr); char content = *(addr); printf("read done"); } int main(){ MSG msg; SetTimer(0, 0, 1, crash); while(1){ GetMessage(&msg, NULL, 0, 0); DispatchMessage(&msg); } }

Instead: Program runs endlessly

Crash-Resistance

  • Set timer callback crash()
  • Dispatch crash() each ms
  • crash() generates a fault on

first execution

slide-12
SLIDE 12

NDSS 2016 | San Diego | 02/24/2016

char* addr = 0; void crash(){ addr++; printf("reading %x", addr); char content = *(addr); printf("read done"); } int main(){ MSG msg; SetTimer(0, 0, 1, crash); while(1){ GetMessage(&msg, NULL, 0, 0); DispatchMessage(&msg); } }

Crash-Resistance

  • Set timer callback crash()
  • Dispatch crash() each ms
  • crash() generates a fault on

first execution

slide-13
SLIDE 13

NDSS 2016 | San Diego | 02/24/2016

char* addr = 0; void crash(){ addr++; printf("reading %x", addr); char content = *(addr); printf("read done"); } int main(){ MSG msg; SetTimer(0, 0, 1, crash); while(1){ GetMessage(&msg, NULL, 0, 0); DispatchMessage(&msg); } }

DispatchMessage: __try { crash() } __except(expr) { } return

Crash-Resistance

Behind the Scenes

slide-14
SLIDE 14

NDSS 2016 | San Diego | 02/24/2016

char* addr = 0; void crash(){ addr++; printf("reading %x", addr); char content = *(addr); printf("read done"); } int main(){ MSG msg; SetTimer(0, 0, 1, crash); while(1){ GetMessage(&msg, NULL, 0, 0); DispatchMessage(&msg); } }

DispatchMessage: __try { crash() } __except(expr) { } return

Crash-Resistance

Behind the Scenes

Access violation

slide-15
SLIDE 15

NDSS 2016 | San Diego | 02/24/2016

char* addr = 0; void crash(){ addr++; printf("reading %x", addr); char content = *(addr); printf("read done"); } int main(){ MSG msg; SetTimer(0, 0, 1, crash); while(1){ GetMessage(&msg, NULL, 0, 0); DispatchMessage(&msg); } }

DispatchMessage: __try { crash() } __except(expr) { } return

Crash-Resistance

Behind the Scenes

Access violation expr returns 1

slide-16
SLIDE 16

NDSS 2016 | San Diego | 02/24/2016

char* addr = 0; void crash(){ addr++; printf("reading %x", addr); char content = *(addr); printf("read done"); } int main(){ MSG msg; SetTimer(0, 0, 1, crash); while(1){ GetMessage(&msg, NULL, 0, 0); DispatchMessage(&msg); } }

DispatchMessage: __try { crash() } __except(expr) { } return

Crash-Resistance

Behind the Scenes

execute handler Access violation expr returns 1

slide-17
SLIDE 17

NDSS 2016 | San Diego | 02/24/2016

char* addr = 0; void crash(){ addr++; printf("reading %x", addr); char content = *(addr); printf("read done"); } int main(){ MSG msg; SetTimer(0, 0, 1, crash); while(1){ GetMessage(&msg, NULL, 0, 0); DispatchMessage(&msg); } }

DispatchMessage: __try { crash() } __except(expr) { } return

Crash-Resistance

Behind the Scenes

execute handler continue execution Access violation expr returns 1

slide-18
SLIDE 18

NDSS 2016 | San Diego | 02/24/2016

char* addr = 0; void crash(){ addr++; printf("reading %x", addr); char content = *(addr); printf("read done"); } int main(){ MSG msg; SetTimer(0, 0, 1, crash); while(1){ GetMessage(&msg, NULL, 0, 0); DispatchMessage(&msg); } }

DispatchMessage: __try { crash() } __except(expr) { } return

Crash-Resistance

Behind the Scenes

slide-19
SLIDE 19

NDSS 2016 | San Diego | 02/24/2016

char* addr = 0; void crash(){ addr++; printf("reading %x", addr); char content = *(addr); printf("read done"); } int main(){ MSG msg; SetTimer(0, 0, 1, crash); while(1){ GetMessage(&msg, NULL, 0, 0); DispatchMessage(&msg); } }

Crash-Resistance

Behind the Scenes

If a fault is generated, execution is transferred to the end

  • f the loop
slide-20
SLIDE 20

NDSS 2016 | San Diego | 02/24/2016

char* addr = 0; void crash(){ addr++; printf("reading %x", addr); char content = *(addr); printf("read done"); } int main(){ MSG msg; SetTimer(0, 0, 1, crash); while(1){ GetMessage(&msg, NULL, 0, 0); DispatchMessage(&msg); } }

Crash-Resistance

Behind the Scenes

If a fault is generated, execution is transferred to the end

  • f the loop

Program continues running despite producing faults

slide-21
SLIDE 21

NDSS 2016 | San Diego | 02/24/2016

char* addr = 0; void crash(){ addr++; printf("reading %x", addr); char content = *(addr); printf("read done"); } int main(){ MSG msg; SetTimer(0, 0, 1, crash); while(1){ GetMessage(&msg, NULL, 0, 0); DispatchMessage(&msg); } }

Crash-Resistance

Behind the Scenes

If a fault is generated, execution is transferred to the end

  • f the loop

Program continues running despite producing faults

slide-22
SLIDE 22

Client-Side Crash-Resistance

slide-23
SLIDE 23

NDSS 2016 | San Diego | 02/24/2016

Client-Side Crash-Resistance

  • Server applications respawn upon abnormal termination
slide-24
SLIDE 24

NDSS 2016 | San Diego | 02/24/2016

Client-Side Crash-Resistance

  • Server applications respawn upon abnormal termination

→ Attacks: ASLR de-randomization [1]; Hacking Blind [2];

Missing the Point(er) [3]

slide-25
SLIDE 25

NDSS 2016 | San Diego | 02/24/2016

Client-Side Crash-Resistance

  • Server applications respawn upon abnormal termination

→ Attacks: ASLR de-randomization [1]; Hacking Blind [2];

Missing the Point(er) [3]

  • Client programs do not restart upon a crash (e.g., web

browsers)

slide-26
SLIDE 26

NDSS 2016 | San Diego | 02/24/2016

Client-Side Crash-Resistance

  • Server applications respawn upon abnormal termination

→ Attacks: ASLR de-randomization [1]; Hacking Blind [2];

Missing the Point(er) [3]

  • Client programs do not restart upon a crash (e.g., web

browsers)

  • Crash-resistant code constructs are available in browsers
slide-27
SLIDE 27

NDSS 2016 | San Diego | 02/24/2016

Client-Side Crash-Resistance

  • Server applications respawn upon abnormal termination

→ Attacks: ASLR de-randomization [1]; Hacking Blind [2];

Missing the Point(er) [3]

  • Client programs do not restart upon a crash (e.g., web

browsers)

  • Crash-resistant code constructs are available in browsers
  • Crash-resistant code prevents abnormal termination
  • f browsers
slide-28
SLIDE 28

NDSS 2016 | San Diego | 02/24/2016

Client-Side Crash-Resistance

  • Server applications respawn upon abnormal termination

→ Attacks: ASLR de-randomization [1]; Hacking Blind [2];

Missing the Point(er) [3]

  • Client programs do not restart upon a crash (e.g., web

browsers)

  • Crash-resistant code constructs are available in browsers
  • Crash-resistant code prevents abnormal termination
  • f browsers
  • It is possible to access memory more than once with wrong

permissions

slide-29
SLIDE 29

NDSS 2016 | San Diego | 02/24/2016

Client-Side Crash-Resistance

  • Server applications respawn upon abnormal termination

→ Attacks: ASLR de-randomization [1]; Hacking Blind [2];

Missing the Point(er) [3]

  • Client programs do not restart upon a crash (e.g., web

browsers)

  • Crash-resistant code constructs are available in browsers
  • Crash-resistant code prevents abnormal termination
  • f browsers
  • It is possible to access memory more than once with wrong

permissions

→ Client-Side Crash-Resistance is usable as an attack primitive

slide-30
SLIDE 30

Attacks with Client-Side Crash-Resistance

slide-31
SLIDE 31

NDSS 2016 | San Diego | 02/24/2016

  • Vulnerability needed to read/write address space

Memory Oracles with JavaScript

slide-32
SLIDE 32

NDSS 2016 | San Diego | 02/24/2016

  • Vulnerability needed to read/write address space

(1) Use crash-resistance primitive to try reading attacker- set address

Memory Oracles with JavaScript

slide-33
SLIDE 33

NDSS 2016 | San Diego | 02/24/2016

  • Vulnerability needed to read/write address space

(1) Use crash-resistance primitive to try reading attacker- set address (2) Recognize if read succeeds or fails

Memory Oracles with JavaScript

slide-34
SLIDE 34

NDSS 2016 | San Diego | 02/24/2016

  • Vulnerability needed to read/write address space

(1) Use crash-resistance primitive to try reading attacker- set address (2) Recognize if read succeeds or fails

→ If address is readable, content is returned into

JavaScript variable

Memory Oracles with JavaScript

slide-35
SLIDE 35

NDSS 2016 | San Diego | 02/24/2016

  • Vulnerability needed to read/write address space

(1) Use crash-resistance primitive to try reading attacker- set address (2) Recognize if read succeeds or fails

→ If address is readable, content is returned into

JavaScript variable

→ On a fault, reset address and try reading again

Memory Oracles with JavaScript

slide-36
SLIDE 36

NDSS 2016 | San Diego | 02/24/2016

Memory Oracle in Internet Explorer (32-bit)

  • setInterval() in web worker is crash-resistant
  • callback function set with setInterval() queries memory
  • ≈ 63 probes/s

Memory Oracles with JavaScript

slide-37
SLIDE 37

NDSS 2016 | San Diego | 02/24/2016

Memory Oracle in Internet Explorer (32-bit)

  • setInterval() in web worker is crash-resistant
  • callback function set with setInterval() queries memory
  • ≈ 63 probes/s

Memory Oracles with JavaScript

Memory Oracle in Mozilla Firefox (64-bit)

  • asm.js uses exception handling for certain memory

accesses

  • Modification of metadata allows crash-resistant memory

queries

  • ≈ 700 probes/s (Windows)
  • ≈ 18,000 probes/s (Linux)
slide-38
SLIDE 38

NDSS 2016 | San Diego | 02/24/2016

Unveiling reference-less hidden memory regions

  • memory region is randomized by ASLR
  • no references exist to memory region

Crash-Resistant Memory Scanning

Address space : readable memory : nonreadable memory : hidden memory First program run

slide-39
SLIDE 39

NDSS 2016 | San Diego | 02/24/2016

Unveiling reference-less hidden memory regions

  • memory region is randomized by ASLR
  • no references exist to memory region

Crash-Resistant Memory Scanning

Address space : readable memory : nonreadable memory : hidden memory Second program run

slide-40
SLIDE 40

NDSS 2016 | San Diego | 02/24/2016

Unveiling reference-less hidden memory regions

Crash-Resistant Memory Scanning

  • Use memory oracles to probe address space
slide-41
SLIDE 41

NDSS 2016 | San Diego | 02/24/2016

Unveiling reference-less hidden memory regions

Crash-Resistant Memory Scanning

  • Use memory oracles to probe address space
  • Discover readable addresses
slide-42
SLIDE 42

NDSS 2016 | San Diego | 02/24/2016

Unveiling reference-less hidden memory regions

Crash-Resistant Memory Scanning

  • Use memory oracles to probe address space
  • Discover readable addresses
  • Read memory and verify that discovered memory is

structured in the same way as hidden region

slide-43
SLIDE 43

NDSS 2016 | San Diego | 02/24/2016

Unveiling reference-less hidden memory regions

Crash-Resistant Memory Scanning

  • Use memory oracles to probe address space
  • Discover readable addresses
  • Read memory and verify that discovered memory is

structured in the same way as hidden region

→ Discovery of sensitive data helpful for adversary to

mount subsequent attacks

slide-44
SLIDE 44

NDSS 2016 | San Diego | 02/24/2016

Unveiling reference-less hidden memory regions

Crash-Resistant Memory Scanning

  • Use memory oracles to probe address space
  • Discover readable addresses
  • Read memory and verify that discovered memory is

structured in the same way as hidden region

→ Discovery of sensitive data helpful for adversary to

mount subsequent attacks

  • TEB: ≈ 1min (Windows 32-bit)
slide-45
SLIDE 45

NDSS 2016 | San Diego | 02/24/2016

Unveiling reference-less hidden memory regions

Crash-Resistant Memory Scanning

  • Use memory oracles to probe address space
  • Discover readable addresses
  • Read memory and verify that discovered memory is

structured in the same way as hidden region

→ Discovery of sensitive data helpful for adversary to

mount subsequent attacks

  • TEB: ≈ 1min (Windows 32-bit)
  • Pointer protection metadata: < 1s (Linux 64-bit)
slide-46
SLIDE 46

NDSS 2016 | San Diego | 02/24/2016

Overcome hidden code and code re-randomization

Crash-Resistant Memory Scanning

  • Scan memory to discover data regions that contain function

pointers

slide-47
SLIDE 47

NDSS 2016 | San Diego | 02/24/2016

Overcome hidden code and code re-randomization

Crash-Resistant Memory Scanning

  • Scan memory to discover data regions that contain function

pointers

  • Resolve available function pointers within discovered data
slide-48
SLIDE 48

NDSS 2016 | San Diego | 02/24/2016

Overcome hidden code and code re-randomization

Crash-Resistant Memory Scanning

  • Scan memory to discover data regions that contain function

pointers

  • Resolve available function pointers within discovered data

There was no Control Flow Hijacking

involved yet !

slide-49
SLIDE 49

NDSS 2016 | San Diego | 02/24/2016

Overcome hidden code and code re-randomization

Crash-Resistant Memory Scanning

  • Scan memory to discover data regions that contain function

pointers

  • Resolve available function pointers within discovered data

There was no Control Flow Hijacking

involved yet !

To mount a control flow hijacking attack, perform whole function code reuse

slide-50
SLIDE 50

Crash-Resistant Oriented Programming (CROP)

slide-51
SLIDE 51

NDSS 2016 | San Diego | 02/24/2016

CROP

  • Crash-resistant primitive (Internet Explorer) catches

execution violations

slide-52
SLIDE 52

NDSS 2016 | San Diego | 02/24/2016

CROP

  • Crash-resistant primitive (Internet Explorer) catches

execution violations (1) Prepare attacker controlled memory with parameters and exported system call

slide-53
SLIDE 53

NDSS 2016 | San Diego | 02/24/2016

CROP

  • Crash-resistant primitive (Internet Explorer) catches

execution violations (1) Prepare attacker controlled memory with parameters and exported system call (2) Set return address for system call to NULL in controlled memory

slide-54
SLIDE 54

NDSS 2016 | San Diego | 02/24/2016

CROP

  • Crash-resistant primitive (Internet Explorer) catches

execution violations (1) Prepare attacker controlled memory with parameters and exported system call (2) Set return address for system call to NULL in controlled memory (3) Use control flow hijacking to dispatch system call on indirect call site in crash-resistant mode

slide-55
SLIDE 55

NDSS 2016 | San Diego | 02/24/2016

CROP

  • Crash-resistant primitive (Internet Explorer) catches

execution violations (1) Prepare attacker controlled memory with parameters and exported system call (2) Set return address for system call to NULL in controlled memory (3) Use control flow hijacking to dispatch system call on indirect call site in crash-resistant mode (4) Read return data of system call and proceed to step (1)

slide-56
SLIDE 56

Conclusion

slide-57
SLIDE 57

NDSS 2016 | San Diego | 02/24/2016

Conclusion

  • Browsers can indeed operate in crash-resistant mode

despite having a hard crash-policy

slide-58
SLIDE 58

NDSS 2016 | San Diego | 02/24/2016

Conclusion

  • Browsers can indeed operate in crash-resistant mode

despite having a hard crash-policy

  • Complete memory scanning is possible in client programs,

previously it was only shown for server applications

slide-59
SLIDE 59

NDSS 2016 | San Diego | 02/24/2016

Conclusion

  • Browsers can indeed operate in crash-resistant mode

despite having a hard crash-policy

  • Complete memory scanning is possible in client programs,

previously it was only shown for server applications

  • Client-Side Crash-Resistance weakens defenses based on

hiding and diversification

slide-60
SLIDE 60

NDSS 2016 | San Diego | 02/24/2016

Conclusion

  • Browsers can indeed operate in crash-resistant mode

despite having a hard crash-policy

  • Complete memory scanning is possible in client programs,

previously it was only shown for server applications

  • Client-Side Crash-Resistance weakens defenses based on

hiding and diversification

  • Correct exception handling can prevent Crash-Resistance
  • CVE 2015-6161 [4] (MS15-124 / MS15-125)
  • Bug 1135903 (Mozilla Firefox) [5]
slide-61
SLIDE 61

NDSS 2016 | San Diego | 02/24/2016

Conclusion

  • Browsers can indeed operate in crash-resistant mode

despite having a hard crash-policy

  • Complete memory scanning is possible in client programs,

previously it was only shown for server applications

  • Client-Side Crash-Resistance weakens defenses based on

hiding and diversification

  • Correct exception handling can prevent Crash-Resistance
  • CVE 2015-6161 [4] (MS15-124 / MS15-125)
  • Bug 1135903 (Mozilla Firefox) [5]
  • Defenses that prevent memory corruption vulnerabilities,

can prevent current crash-resistance primitives

slide-62
SLIDE 62

Q & A

slide-63
SLIDE 63

NDSS 2016 | San Diego | 02/24/2016

References

[1] Shacham et al. On the effectiveness of address- space randomization. CCS 2004 [2] Bittau et al. Hacking blind. Security & Privacy 2014 [3] Evans et al. Missing the Point(er). Security & Privacy 2015 [4] https://www.cve.mitre.org/cgi-bin/cvename.cgi? name=CVE-2015-6161 [5] https://bugzilla.mozilla.org/show_bug.cgi?id=1135903