Abstract:Return-Oriented Programming (ROP) is one of the most common techniques to exploit software vulnerabilities. However, existing defense techniques can be defeated by attackers, or suffer from high performance overhead. In this paper, we propose a defense framework, named ROPSentry, to detect ROP attacks at runtime. It is built on the observation that ROP exploits usually trigger different hardware events than normal programs generated by compilers. Hence, we leverage hardware performance counters to track such hardware events and analyze behavioral patterns of ROP attacks. ROPSentry has two approaches. The ROP-only defense approach detects ROP attacks via capturing the patterns of ROP exploits, where we propose to sample the hardware performance counters at mispredicted return events instead of at every microinstruction for a low performance overhead. To further reduce performance overhead, we propose a self-adaptive defense approach to dynamically switch between low and high sampling rates. It detects the patterns of spraying attacks (i.e., one common ROP payload delivery technique) at a low sampling rate, and then switches to a high sampling rate for detecting the patterns of ROP exploits. Our evaluation on 11 real-world ROP exploits, 50 synthetically generated ROP exploits and 1000 benign websites has shown that, the ROP-only and self-adaptive approaches are effective in detecting ROP attacks with low performance overhead (11% and 1% respectively) as well as low false positive; and they significantly outperform the state-of-the-art techniques in terms of performance overhead without losing the detection accuracy.

Defending ROP Attacks Using Basic Block Level Randomization

What You See is Not What You Get! Thwarting Just-in-Time ROP with Chameleon

Instantly Obsoleting the Address-code Associations: A New Principle for Defending Advanced Code Reuse Attack

ROPNN: Detection of ROP Payloads Using Deep Neural Networks

Runtime Code Reuse Attacks: A Dynamic Framework Bypassing Fine-Grained Address Space Layout Randomization.

De-randomizing the Code Segment with Timing Function Attack

Different is Good

Fully Randomized Pointers

ROP Defense Using Trie Graph for System Security.

Return-Oriented Rootkit Without Returns (on the X86)

Blender: Self-randomizing Address Space Layout for Android Apps

Breaking and Fixing Destructive Code Read Defenses

Lightweight and Seamless Memory Randomization for Mission-Critical Services in a Cloud Platform

Program Attack and Protection Based on Return-Oriented Programming

The Illusion of Randomness: An Empirical Analysis of Address Space Layout Randomization Implementations

DSLR–: A Low-Overhead Data Structure Layout Randomization for Defending Data-Oriented Programming

A Static Recognition Mechanism For Indirect Call Based On Static Single Assignment

A Practical Approach for Adaptive Data Structure Layout Randomization.

ROPSentry: Runtime Defense Against ROP Attacks Using Hardware Performance Counters.

Automatic Construction of Jump-Oriented Programming Shellcode (on the X86)

A New Data Randomization Method to Defend Buffer Overflow Attacks