PointlessTain,ng? Evalua,ngthePrac,calityofPointer Tain,ng - PowerPoint PPT Presentation

Pointless
Tain,ng?
 Evalua,ng
the
Prac,cality
of
Pointer
 Tain,ng
 Asia
Slowinska,
Herbert
Bos
 Vrije
Universiteit
Amsterdam


Why
pointer
tain,ng?
 • AFacks
 Exploit
low‐level
memory
errors
 Buffer
overflows
 Dangling
pointers
 Format
strings



Why
pointer
tain,ng?
 • AFacks
 Exploit
low‐level
memory
errors
 Buffer
overflows
 Dangling
pointers
 Format
strings

 Control‐diver,ng


Why
pointer
tain,ng?
 • AFacks
 Exploit
low‐level
memory
errors
 Buffer
overflows
 Dangling
pointers
 Format
strings

 Control‐diver,ng
 Non‐control‐diver,ng


Why
pointer
tain,ng?
 • Keyloggers,
etc.

 • AFacks
 Installed
by
users
or
by
the
way
of
exploits
 Exploit
low‐level
memory
errors
 e.g.,
trojan
 Buffer
overflows
 Dangling
pointers
 Format
strings

 Control‐diver,ng
 Non‐control‐diver,ng


Why
pointer
tain,ng?
 • Keyloggers,
etc.

 • AFacks
 Installed
by
users
or
by
the
way
of
exploits
 Exploit
low‐level
memory
errors
 e.g.,
trojan
 Buffer
overflows
 Dangling
pointers
 • Pointer
tain*ng 
 Format
strings

 • Capable
of
detec,ng
 Control‐diver,ng
 • Memory
corrup,on
aFacks
 • Both
control‐
and
non‐control‐ Non‐control‐diver,ng
 diver,ng

 • Privacy‐breaching
malware
 • PROBLEMATIC


Basic
tain,ng
 memory



taint
tag
 App
1
 App
2
 App
3
 Guest
OS
 Emulator
 Host
OS


Basic
tain,ng
 memory



taint
tag
 ret
 App
1
 App
2
 App
3
 Guest
OS
 Emulator
 Host
OS


Basic
tain,ng
 1.
Mark
network
data
 as
tainted.
 memory



taint
tag
 ret
 App
1
 App
2
 App
3
 Guest
OS
 Emulator
 Host
OS


Basic
tain,ng
 1.
Mark
network
data
 as
tainted.
 memory



taint
tag
 ret
 App
1
 App
2
 App
3
 Guest
OS
 Emulator
 Host
OS


Basic
tain,ng
 1.
Mark
network
data
 as
tainted.
 memory



taint
tag
 2.
Propagate
taint
 through
the
OS.
 ret
 App
1
 App
2
 App
3
 Guest
OS
 Emulator
 Host
OS


Basic
tain,ng
 1.
Mark
network
data
 as
tainted.
 memory



taint
tag
 2.
Propagate
taint
 through
the
OS.
 ret
 App
1
 App
2
 App
3
 Guest
OS
 Emulator
 Host
OS


Basic
tain,ng
 1.
Mark
network
data
 as
tainted.
 memory



taint
tag
 2.
Propagate
taint
 through
the
OS.
 ret
 App
1
 App
2
 App
3
 Guest
OS
 Emulator
 Host
OS


Basic
tain,ng
 1.
Mark
network
data
 as
tainted.
 memory



taint
tag
 2.
Propagate
taint
 through
the
OS.
 ret
 3.
Alert
for
 App
1
 App
2
 App
3
 dereferences
due
 to
tainted
jumps,
 func,on
calls/ Guest
OS
 returns.
 Emulator
 Host
OS


Basic
tain,ng
 1.
Mark
network
data
 as
tainted.
 memory



taint
tag
 2.
Propagate
taint
 through
the
OS.
 ret
 3.
Alert
for
 App
1
 App
2
 App
3
 dereferences
due
 to
tainted
jumps,
 func,on
calls/ Guest
OS
 returns.
 Emulator
 Host
OS


Basic
tain,ng
 1.
Mark
network
data
 as
tainted.
 memory



taint
tag
 2.
Propagate
taint
 through
the
OS.
 ret
 3.
Alert
for
 App
1
 App
2
 App
3
 dereferences
due
 to
tainted
jumps,
 func,on
calls/ Guest
OS
 returns.
 Emulator
 Host
OS


AFacks:
(in)effec,veness
of
basic
tain,ng
 void serve(int fd) { reply
msg
 char *reply = ...; char request[64]; read(fd, request, 128); srv_send(fd, reply, 1024); } reply
 request


AFacks:
(in)effec,veness
of
basic
tain,ng
 void serve(int fd) { reply
msg
 char *reply = ...; server
private
 char request[64]; data
 read(fd, request, 128); srv_send(fd, reply, 1024); } reply
 request


Pointer
tain,ng
 1.
Mark
network
data
as
 tainted.
 2.
Propagate
taint
through
 the
OS.
 • AFacks
 3.
Alert
for
dereferences
 due
to
tainted
jumps,
 func,on
calls/returns.
 + 
If
 p 
is
tainted,
raise
an
alert
 on
any
dereference
of
 p

Pointer
tain,ng
 1.
Mark
network
data
as
 tainted.
 2.
Propagate
taint
through
 the
OS.
 • AFacks
 • Keylogger
detec,on
 + 
If
 p 
is
tainted,
any
 3.
Alert
for
dereferences
 due
to
tainted
jumps,
 dereference
of
 p 
taints
the
 func,on
calls/returns.
 des,na,on

 + 
If
 p 
is
tainted,
raise
an
alert
 on
any
dereference
of
 p

AFacks:
effec,veness
of
pointer
tain,ng
 void serve(int fd) { reply
msg
 char *reply = ...; server
private
 char request[64]; data
 read(fd, request, 128); srv_send(fd, reply, 1024); } reply
 request


Pointer
tain,ng:
FPs
likely
 void serve(int fd) { char *reply; char request; read(fd, request, 1); srv_send(fd, reply, 1); }

Pointer
tain,ng:
FPs
likely
 void serve(int fd) { char *reply; char request; read(fd, request, 1); reply = to_lower[request]; srv_send(fd, reply, 1); }

Pointer
tain,ng:
FPs
likely
 void serve(int fd) { char *reply; char request; read(fd, request, 1); 0x143
 0x63
(‘c’)
 reply = to_lower[request]; 0x142
 0x62
(‘b’)
 srv_send(fd, reply, 1); 0x141
 0x61
(‘a’)
 } 0x100


Pointer
tain,ng:
FPs
likely
 void serve(int fd) { char *reply; char request; read(fd, request, 1); 0x143
 0x63
(‘c’)
 reply = to_lower[request]; 0x142
 0x62
(‘b’)
 srv_send(fd, reply, 1); 0x141
 0x61
(‘a’)
 } request = 0x41 ‘A’ 0x100


Pointer
tain,ng:
FPs
likely
 void serve(int fd) { char *reply; char request; read(fd, request, 1); 0x143
 0x63
(‘c’)
 reply = to_lower[request]; 0x142
 0x62
(‘b’)
 srv_send(fd, reply, 1); 0x141
 0x61
(‘a’)
 } request = 0x41 ‘A’ 0x100
 addr = 0x100 + request reply = *addr

Pointer
tain,ng:
FPs
likely
 void serve(int fd) { char *reply; char request; read(fd, request, 1); 0x143
 0x63
(‘c’)
 reply = to_lower[request]; 0x142
 0x62
(‘b’)
 srv_send(fd, reply, 1); 0x141
 0x61
(‘a’)
 } request = 0x41 ‘A’ 0x100
 addr = 0x100 + request reply = *addr

Keylogger
detec,on
 memory



taint
tag
 App
1
 App
2
 App
3
 Guest
OS
 Emulator
 Host
OS
 Poten,al
malware
 Internet
browser


Keylogger
detec,on
 memory



taint
tag
 App
1
 App
2
 App
3
 Guest
OS
 Emulator
 Host
OS
 Poten,al
malware
 Internet
browser


Keylogger
detec,on
 memory



taint
tag
 App
1
 App
2
 App
3
 Guest
OS
 Emulator
 Host
OS
 Poten,al
malware
 Internet
browser


Keylogger
detec,on
 memory



taint
tag
 App
1
 App
2
 App
3
 Guest
OS
 Emulator
 Host
OS
 Poten,al
malware
 Internet
browser


Keylogger
detec,on
 memory



taint
tag
 App
1
 App
2
 App
3
 Guest
OS
 Emulator
 Host
OS
 Poten,al
malware
 Internet
browser


Keylogger
detec,on
 memory



taint
tag
 App
1
 App
2
 App
3
 Guest
OS
 Emulator
 Host
OS
 Poten,al
malware
 Internet
browser


Keylogger
detec,on:
FPs
likely
(again)
 struct hlist_head *head = get_list_head(filename);

Keylogger
detec,on:
FPs
likely
(again)
 struct hlist_head *head = get_list_head(filename); base


Keylogger
detec,on:
FPs
likely
(again)
 struct hlist_head *head = get_list_head(filename); index = hash(filename) base


Keylogger
detec,on:
FPs
likely
(again)
 struct hlist_head *head = get_list_head(filename); index = hash(filename) base


Keylogger
detec,on:
FPs
likely
(again)
 struct hlist_head *head = get_list_head(filename); index = hash(filename) base


Keylogger
detec,on:
FPs
likely
(again)
 struct hlist_head *head = get_list_head(filename); struct dentry *dentry = head->first;

Keylogger
detec,on:
FPs
likely
(again)
 dentry
of
foo.txt
 struct hlist_head *head = next
=
NULL
 get_list_head(filename); info
 struct dentry *dentry = head->first;

Keylogger
detec,on:
FPs
likely
(again)
 dentry
of
foo.txt
 struct hlist_head *head = next
=
NULL
 get_list_head(“test.txt”); info
 struct dentry *dentry = head->first;

Keylogger
detec,on:
FPs
likely
(again)
 dentry
of
foo.txt
 struct hlist_head *head = next
=
NULL
 get_list_head(“test.txt”); info
 dentry
of
test.txt
 struct dentry next
 *dentry = head->first; info