|
Instruction-set randomization (ISR) is a technique based on
randomizing the "language" understood by a system to protect it from
code-injection attacks. Such attacks were used
by many computer worms in the past, but still pose a threat
as it was confirmed by the recent Conficker worm outbreak,
and the latest exploits targeting some of Adobe's most popular products.
We created a tool that offers a fast and practical implementation
of ISR that can be applied on currently deployed
software. It builds on Intel's Pin
binary instrumentation
tool to provide the ISR-enabled execution environment entirely in software.
Applications are randomized using a simple XOR function and a 16-bit key that
is randomly generated every time an application is launched. Shared libraries
can be also randomized using separate keys, and their randomized versions can
be used by all applications running under ISR.
Moreover, we introduce a key management system to keep track of the keys used
in the system.
Our tool is freely available for Linux operating systems, and can be
obtained from here.
Basic concept of ISR
Instruction-set randomization can be also implemented in hardware, as the
original ISR work proposed. Additionally, ISR can be adopted globally
across the
software stack, preventing the execution of unauthorized binaries and
scripts regardless of their origin. This approach requires that
programs are randomized with different keys during a user-controlled
installation, effectively combining the benefits of code
whitelisting/signing and runtime program integrity. Such an
environment for binaries can be implemented with little
overhead in hardware, while higher-overhead software-only
alternatives, like ISR using Pin, are also possible.
People
Prof. Angelos Keromytis, Columbia University
Georgios Portokalidis, Columbia University
Related papers
|
Global ISR: Toward a Comprehensive Defense Against
Unauthorized Code Execution [PDF] |
| Georgios Portokalidis, Angelos D. Keromytis |
|
In ARO Workshop on Moving Target Defense, October 2010. |
|
Fast and Practical Instruction-Set Randomization for Commodity
Systems [PDF] |
| Georgios Portokalidis, Angelos D. Keromytis |
|
In Proceedings of the Annual Computer Security Applications
Conference (ACSAC), December 2010. (Acceptance rate: 17%) |
|
On The General Applicability of Instruction-Set Randomization
(more...)
|
|
Stephen W. Boyd, Gaurav S. Kc, Michael E. Locasto, Angelos D. Keromytis, and Vassilis Prevelakis
|
|
In IEEE Transactions on Dependable and Secure Computing (TDSC), vol. 7, no. 3, pp. 255 - 270, July - September 2010
|
|
Randomized Instruction Sets and Runtime Environments: Past Research and Future Directions
(more...)
|
|
Angelos D. Keromytis
|
|
In IEEE Security & Privacy Magazine, vol. 7, no. 1, pp. 18 - 25, January/February 2009
|
|
Countering Code-Injection Attacks With Instruction-Set Randomization
(more...)
|
|
Gaurav S. Kc, Angelos D. Keromytis, and Vassilis Prevelakis
|
|
In CCS 2003, Washington, DC, October 2003
|
|
