@conference {706, title = {Known/chosen key attacks against software instruction set randomization}, booktitle = {Computer Security Applications Conference, 2006. ACSAC{\textquoteright}06. 22nd Annual}, year = {2006}, month = {12/2006}, publisher = {IEEE}, organization = {IEEE}, address = {Miami, FL, Estados Unidos}, abstract = {

Instruction set randomization (ISR) has been proposed as a form of defense against binary code injection into an executing program. One proof-of-concept implementation is randomized instruction set emulator (RISE), based on the open-source Valgrind IA-32 to IA-32 binary translator. Although RISE is effective against attacks that are not RISE-aware, it is vulnerable to pure data and hybrid data-code attacks that target its data, as well to some classes of brute-force guessing. In order to enable the design of a production version, we describe implementation-specific and generic vulnerabilities that can be used to overcome RISE in its current form. We present and discuss attacks and solutions in three categories: known-key attacks that rely on the key being leaked and then used to pre-scramble the attacking code; chosen-key attacks that use implementation weaknesses to allow the attacker to define its own key, or otherwise affect key generation; and key-guessing ("brute-force") attacks, about which we explore the design of mini-malistic loaders which can be used to minimize the number of mask bytes required for a successful key-guessing attack. All the described attacks were tested in real-world scenarios

}, keywords = {Binary codes, Computer aided instruction, Emulation, genetics, Hardware, Open source software, Production, Protection, Security, Testing}, isbn = {0-7695-2716-7}, doi = {10.1109/ACSAC.2006.33}, url = {http://ieeexplore.ieee.org/document/4041180/}, author = {Weiss, Yoav and Barrantes, Elena Gabriela} } @conference {702, title = {Randomized instruction set emulation to disrupt binary code injection attacks}, booktitle = {Proceedings of the 10th ACM conference on Computer and communications security}, year = {2003}, month = {10/2003}, publisher = {ACM}, organization = {ACM}, address = {Washington D.C., USA}, abstract = {

Binary code injection into an executing program is a common form of attack. Most current defenses against this form of attack use a {\textquoteright}guard all doors{\textquoteright} strategy, trying to block the avenues by which execution can be diverted. We describe a complementary method of protection, which disrupts foreign code execution regardless of how the code is injected. A unique and private machine instruction set for each executing program would make it difficult for an outsider to design binary attack code against that program and impossible to use the same binary attack code against multiple machines. As a proof of concept, we describe a randomized instruction set emulator (RISE), based on the open-source Valgrind x86-to-x86 binary translator. The prototype disrupts binary code injection attacks against a program without requiring its recompilation, linking, or access to source code. The paper describes the RISE implementation and its limitations, gives evidence demonstrating that RISE defeats common attacks, considers how the dense x86 instruction set affects the method, and discusses potential extensions of the idea.

}, keywords = {Automated Diversity, Emulation, Information Hiding, Language Randomiza- tion, Obfuscation, Security}, isbn = {ISBN:1-58113-738-9 }, doi = {10.1145/948109.948147}, url = {https://dl.acm.org/citation.cfm?id=948147}, author = {Barrantes, Elena Gabriela and Ackley, David H and Palmer, Trek S and Stefanovic, Darko and Zovi, Dino Dai} }