Control Hijacking Defenses

Control Hijacking Defenses

• Control hijacking attacks exploit vulnerabilities in software design, allowing attackers to redirect program execution. These vulnerabilities often arise from mixing data and control flow in memory.
• Key attacks include stack smashing (overwriting return addresses), heap spraying (exploiting heap overflows), use-after-free (writing to freed memory), integer overflows, and format string vulnerabilities.
• The fundamental flaw involves mixing data and control, enabling injection of control signals. This allows attackers to manipulate program flow.
• AT&T recognized this issue as early as 1971, demonstrating the longstanding problem.

Preventing Hijacking Attacks

• Fixing bugs: Auditing software with automated tools (like Coverity, Infer) to find vulnerabilities, and rewriting software in type-safe languages such as Java, Go, or Rust can help prevent control hijacking.
• Platform defenses: Preventing the execution of attacker code, and halting processes when exploits are detected using techniques like StackGuard, ShadowStack, memory tagging (ASan, MTE), are important.

Marking Memory as Non-executable (DEP)

• This technique prevents attack code execution by marking the stack and heap as non-executable memory.
• NX-bit on AMD64, XD-bit on Intel x86, and XN-bit on ARM provide this functionality.
• All major operating systems, including Windows DEP, have implemented this defense since XP SP2.
• Limitations exist, as some applications require executable heaps (like JITs) and there are specific bypasses, such as using Return-Oriented Programming (ROP).

Attack: Return-Oriented Programming (ROP)

• Control hijacking without code injection, using existing code sequences within the program (gadgets).
• The stack is manipulated to execute these pre-existing code "gadgets" for malicious purposes.

ROP: Further Detail

• Exploiting vulnerabilities to manipulate the stack can redirect program flow, allowing malicious code execution.

ROP: In Even More Detail

• Demonstrating how specific instructions (pop rdi, pop rsi, pop rax, syscall, ret) can be combined to achieve malicious code execution.

Randomization

• Address Space Layout Randomization (ASLR) randomly shifts the memory layout of code, making it more difficult to exploit the system when running.
• The location of code and data segments is randomized.
• DynamicBase is used, and windows 8 implemented random memory layout randomization.
• Other methods like Sys-call randomization and Instruction Set Randomization (ISR) are also possible.

kBouncer

• A different approach checking if ret instruction sequence is abnormal using Intel's Last Branch Recording (LBR).
• Checking for abnormalities in prior return instructions is used as a defense mechanism.

Hardening the Executable

• Run-time checking (StackGuard): Inserts "canaries" into the stack frame to detect tampering with memory integrity. Implementing runtime stack checking.

Canary Types

• Random canary: A random string inserted into each stack frame and verified against corruption. If the random string changes, a program problem is detected.
• Terminator canary: String functions avoid writing past this terminal character to protect the stack.

StackGuard (Continuous)

• StackGuard operates as a GCC patch, requiring recompilation. The performance impact is minimal, with a measured 8% impact on Apache.

StackGuard Enhancement: ProPolice

• Improves StackGuard by rearranging the stack layout to prevent pointer overflows.
• Safeguard pointer arguments and local pointers from buffer overflow exploits on the stack.

MS Visual Studio/GS (BufferSecurityCheck)

• Combines ProPolice and random canaries for enhanced stack protection. If the cookie (ProPolice) or canary mismatch is detected, the program exits.

Summary: Canaries

• Canaries are a vital defense, but aren't foolproof. Some stack-smash attacks can avoid corrupting canaries, and heap-based and integer overflow attacks still pose threats.

Even worse: Canary Extraction

• In some crash-recovery schemes, restarting a process after a failure potentially involves failing to change the canary value. The attacker can then exploit this.

Similarly, Extract ASLR Randomness

• Malicious code could extract the return address or the code location and use that information to exploit subsequent processes.

Other Methods: Shadow Stack

• Keeps a copy of the stack in memory for verifying integrity when dealing with ret instructions. Validating the return address on the actual stack confirms that no process modifications were made.
• Memory corruption should not modify the shadow stack's integrity.

ARM Memory Tagging Extension (MTE)

• Uses tags on memory pointers and regions to detect buffer overflows and use-after-free vulnerabilities. This prevents out-of-bounds access to memory. Hardware exceptions are triggered if the memory tags do not match.

AddressSanitizer (ASan)

• Is a software tool recording the allocation status of memory. It can detect buffer overflows. It inserts "guard" references to memory locations to check for valid memory access. In the case of invalid access, this will trigger a crash.

Control Flow Integrity (CFI)

• This method ensures control flow adheres to the graph by building a list of possible call targets. It validates the target of every indirect call to confirm that it is valid.

Coarse CFI: Control Flow Guard (CFG)

• Indirect calls are protected by checking against a bitmask of valid function entry points in the executable..

Coarse CFI using EndBranch (Intel) and BTI (ARM)

• This method inserts instructions to prevent hijacking indirect jumps to invalid locations or procedures. A C-language compiler checks and ensures target address is valid. A #CP fault occurs if this validation fails.

CFG, EndBranch, BTI: Limitations

• These approaches do not prevent all attacks, as some clever attacker tactics can cause jumps to valid but incorrect functions. Creating static control flow graphs to identify potential targets has limitations.

An Example of Control Flow Hijacking

• Demonstrating the principle of how an attacker could exploit, through buffer overflow, control flow to call an invalid function after the jump.

Cryptographic Control Flow Integrity (CCFI)

• Uses cryptographic hashes for verifying pointers and code flow to protect against attacks.

Back to the Example

• Demonstrating how CCFI would protect against an attempt to change a handler pointer from buffer overflow and the importance of pointer authentication.

This quiz explores control hijacking attacks and their defenses in software design. You will learn about various key attacks, including stack smashing and heap spraying, as well as strategies to prevent such vulnerabilities. Understanding these concepts is crucial for enhancing software security.