|
Instruction-set randomization (ISR) is a technique based on
randomizing the "language" understood by a system to protect it from
code-injection attacks. Such attacks were used
by many computer worms in the past, but still pose a threat
as it was confirmed by the recent Conficker worm outbreak,
and the latest exploits targeting some of Adobe's most popular products.
We created a tool that offers a fast and practical implementation
of ISR that can be applied on currently deployed
software. It builds on Intel's Pin
binary instrumentation
tool to provide the ISR-enabled execution environment entirely in software.
Applications are randomized using a simple XOR function and a 16-bit key that
is randomly generated every time an application is launched. Shared libraries
can be also randomized using separate keys, and their randomized versions can
be used by all applications running under ISR.
Moreover, we introduce a key management system to keep track of the keys used
in the system.
Our tool is freely available for Linux operating systems, and can be
obtained from here.
Basic concept of ISR
Instruction-set randomization can be also implemented in hardware, as the
original ISR work proposed. Additionally, ISR can be adopted globally
across the
software stack, preventing the execution of unauthorized binaries and
scripts regardless of their origin. This approach requires that
programs are randomized with different keys during a user-controlled
installation, effectively combining the benefits of code
whitelisting/signing and runtime program integrity. Such an
environment for binaries can be implemented with little
overhead in hardware, while higher-overhead software-only
alternatives, like ISR using Pin, are also possible.
People
Prof. Angelos Keromytis, Columbia University
Georgios Portokalidis, Columbia University
Related papers
Fatal error: Uncaught ArgumentCountError: gmmktime() expects at least 1 argument, 0 given in /var/www/html/projects/minestrone/functions.inc:5
Stack trace:
#0 /var/www/html/projects/minestrone/functions.inc(5): gmmktime()
#1 /var/www/html/projects/minestrone/isr/description.inc(51): print_pubs('ISR', '../')
#2 /var/www/html/projects/minestrone/isr/index.php(32): include('/var/www/html/p...')
#3 {main}
thrown in /var/www/html/projects/minestrone/functions.inc on line 5
|
