Abstract:Memory corruption attacks remain the primary threat for computer security. Information flow tracking or taint analysis has been proven to be effective against most memory corruption attacks. However, there are two shortcomings with current taint analysis based techniques. First, these techniques cause application slowdown by about 76% thereby limiting their practicality. Second, these techniques cannot handle non-control data attacks i.e., attacks that do not overwrite control data such as return address, but instead overwrite critical application configuration data or user identity data. In this work, to address these problems, we describe a coarse-grained taint analysis technique that uses information flow tracking at the level of application data objects. We propagate a one-bit taint over each application object that is modified by untrusted data thereby reducing the taint management overhead considerably. We performed extensive experimental evaluation of our approach and show that it can detect all critical attacks such as buffer overflows, and format string attacks, including non-control data attacks. Unlike the currently known approaches that can detect such a wide range of attacks, our approach does not require the source code or any hardware extensions. Run-time performance overhead evaluation shows that, on an average, our approach causes application slowdown by only 37% which is an order of magnitude improvement over existing approaches. Finally, since our approach performs run-time binary instrumentation, it is easier to integrate it with existing applications and systems.

Dynamic Binary Instrumentation Based Defense Solution Against Virtual Function Table Hijacking Attacks at C++ Binary Programs.

VTint: Protecting Virtual Function Tables' Integrity.

DR AF T VTrust : Regaining Trust on Virtual Calls

Dynamic Analysis and Debugging of Binary Code for Security Applications

VTrust: Regaining Trust on Virtual Calls.

A Dynamic Detection Method Against ROP and JOP

Arbiter: Bridging the Static and Dynamic Divide in Vulnerability Discovery on Binary Programs

Active Checking Buffer Overflow Vulnerability In Binaries With Symbolic Execution

Program Execution Tracer based on Dynamic Binary Instrumentation

Layered Object-Oriented Programming: Advanced VTable Reuse Attacks on Binary-Level Defense

Dynamic Detection of Buffer-overflow Vulnerabilities in Binary Environment

A Vulnerability Exploits Detection Method Based on Binary Program Behavior Analysis

An Effective Taint‐based Software Vulnerability Miner

Identify Stack Overflow Exploits with Dynamic Binary Instrumentation

Dynamic Taint Analysis Based on Virtual Technology

Dynamic Symbolic Execution Based Defect Detection System for Binary Programs

C plus plus Memory Detection Tool Based on Dynamic Instrumentation

Coarse-grained Dynamic Taint Analysis for Defeating Control and Non-control Data Attacks

Research on Automatic Instrumentation for Bytecode Testing and Debugging

Constructing a Hybrid Taint Analysis Framework for Diagnosing Attacks on Binary Programs

Dynamic Malicious Code Detection Based on Binary Translator