TY - GEN
T1 - Using Diversity to Harden Multithreaded Programs Against Exploitation
AU - Tagatac, David M.
AU - Polychronakis, Michalis
AU - Stolfo, Salvatore J.
N1 - Publisher Copyright:
© 2016 IEEE.
PY - 2016/6/30
Y1 - 2016/6/30
N2 - Multithreaded programming is here to stay, and concurrency bugs are the focus of a growing number of cyberattacks. While most defensive efforts against such attacks seek to identify bugs during debugging, an alternative method seeks to make exploitation harder without the need to first identify the bugs - or even the fact that there are any. Time randomization introduces more diversity among instances of the same software. In much the same way that ASLR-induced diversity in memory locations thwarts attacks crafted for specific addresses, time randomization-induced diversity in thread timing aims to thwart concurrency attacks crafted for specific vulnerability windows. We study three implementations of time randomization, all using the injection of NOPs to alter program timing. Their application to two real-world concurrency bugs results in a marked increase in the cost to exploit those bugs. After demonstrating the effectiveness of the method, especially when NOPs are injected before library function calls following synchronization points, methods for improving the efficiency of this defense against concurrency attacks in future research are proposed.
AB - Multithreaded programming is here to stay, and concurrency bugs are the focus of a growing number of cyberattacks. While most defensive efforts against such attacks seek to identify bugs during debugging, an alternative method seeks to make exploitation harder without the need to first identify the bugs - or even the fact that there are any. Time randomization introduces more diversity among instances of the same software. In much the same way that ASLR-induced diversity in memory locations thwarts attacks crafted for specific addresses, time randomization-induced diversity in thread timing aims to thwart concurrency attacks crafted for specific vulnerability windows. We study three implementations of time randomization, all using the injection of NOPs to alter program timing. Their application to two real-world concurrency bugs results in a marked increase in the cost to exploit those bugs. After demonstrating the effectiveness of the method, especially when NOPs are injected before library function calls following synchronization points, methods for improving the efficiency of this defense against concurrency attacks in future research are proposed.
KW - concurrency bugs
KW - software diversity
KW - time randomization
UR - https://www.scopus.com/pages/publications/84979776572
U2 - 10.1109/BigDataSecurity-HPSC-IDS.2016.24
DO - 10.1109/BigDataSecurity-HPSC-IDS.2016.24
M3 - Conference contribution
AN - SCOPUS:84979776572
T3 - Proceedings - 2nd IEEE International Conference on Big Data Security on Cloud, IEEE BigDataSecurity 2016, 2nd IEEE International Conference on High Performance and Smart Computing, IEEE HPSC 2016 and IEEE International Conference on Intelligent Data and Security, IEEE IDS 2016
SP - 208
EP - 213
BT - Proceedings - 2nd IEEE International Conference on Big Data Security on Cloud, IEEE BigDataSecurity 2016, 2nd IEEE International Conference on High Performance and Smart Computing, IEEE HPSC 2016 and IEEE International Conference on Intelligent Data and Security, IEEE IDS 2016
A2 - Qiu, Meikang
PB - Institute of Electrical and Electronics Engineers Inc.
T2 - 2nd IEEE International Conference on Big Data Security on Cloud, IEEE BigDataSecurity 2016, 2nd IEEE International Conference on High Performance and Smart Computing, IEEE HPSC 2016 and IEEE International Conference on Intelligent Data and Security, IEEE IDS 2016
Y2 - 9 April 2016 through 10 April 2016
ER -