Abstract:Return-Oriented Programming (ROP) is one of the most common techniques to exploit software vulnerabilities. However, existing defense techniques can be defeated by attackers, or suffer from high performance overhead. In this paper, we propose a defense framework, named ROPSentry, to detect ROP attacks at runtime. It is built on the observation that ROP exploits usually trigger different hardware events than normal programs generated by compilers. Hence, we leverage hardware performance counters to track such hardware events and analyze behavioral patterns of ROP attacks. ROPSentry has two approaches. The ROP-only defense approach detects ROP attacks via capturing the patterns of ROP exploits, where we propose to sample the hardware performance counters at mispredicted return events instead of at every microinstruction for a low performance overhead. To further reduce performance overhead, we propose a self-adaptive defense approach to dynamically switch between low and high sampling rates. It detects the patterns of spraying attacks (i.e., one common ROP payload delivery technique) at a low sampling rate, and then switches to a high sampling rate for detecting the patterns of ROP exploits. Our evaluation on 11 real-world ROP exploits, 50 synthetically generated ROP exploits and 1000 benign websites has shown that, the ROP-only and self-adaptive approaches are effective in detecting ROP attacks with low performance overhead (11% and 1% respectively) as well as low false positive; and they significantly outperform the state-of-the-art techniques in terms of performance overhead without losing the detection accuracy.

What You See is Not What You Get! Thwarting Just-in-Time ROP with Chameleon

Instantly Obsoleting the Address-code Associations: A New Principle for Defending Advanced Code Reuse Attack

ROPNN: Detection of ROP Payloads Using Deep Neural Networks

Defending ROP Attacks Using Basic Block Level Randomization

Runtime Code Reuse Attacks: A Dynamic Framework Bypassing Fine-Grained Address Space Layout Randomization.

De-randomizing the Code Segment with Timing Function Attack

ROPocop - Dynamic Mitigation of Code-Reuse Attacks

Lightweight and Seamless Memory Randomization for Mission-Critical Services in a Cloud Platform

ROP Defense Using Trie Graph for System Security.

Breaking and Fixing Destructive Code Read Defenses

HARM: Hardware-Assisted Continuous Re-randomization for Microcontrollers

Using Name Confusion to Enhance Security

Practical Control Flow Integrity and Randomization for Binary Executables

Return-Oriented Rootkit Without Returns (on the X86)

ROPSentry: Runtime Defense Against ROP Attacks Using Hardware Performance Counters.

Automatic Construction of Jump-Oriented Programming Shellcode (on the X86)

The never ending war in the stack and the reincarnation of ROP attacks

What you can read is what you can't execute

PhantomCache: Obfuscating Cache Conflicts with Localized Randomization

DROP: Detecting Return-Oriented Programming Malicious Code

Program Attack and Protection Based on Return-Oriented Programming