Software-level defense method for non-control data attack

Abstract

The invention provides a non-control data attack-oriented software-level defense method. The method comprises the following steps of: identifying target data in a target program; collecting correct instruction positions for accessing target data in the program to form a correct access instruction set; according to the access mode of the program to the target data and the protection level of the target data, modifying the access permission of the memory page where the target data in the target program is located; according to the modified page permission, code modification is carried out on the page failure processing function, and the modified page failure processing function identifies and distinguishes correct access and incorrect access to the target data; when the program accesses the target data, the page failure processing function judges whether the access to the target data is correct or not, that is, whether an instruction address for accessing the target data is within a previously collected set range or not; if not, incorrect access is determined, an administrator is notified, and automatic termination is carried out; if yes, the access is normal, and the current operation is allowed.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a software-level defense method for non-control data attacks. Background Art

[0002] Non-control data attacks are attacks that target non-control data that does not affect the instruction pointer register. When conventional code reuse attacks are difficult to succeed under control flow integrity (CFI) defense, non-control data attacks become a new option for attackers. This attack may be as serious as a control data attack, and attackers can even build a Turing-complete attack using only non-control data. Currently, although CFI defense is deployed on many platforms, it is difficult to prevent non-control data attacks. Existing defenses against non-control data attacks include:

[0003] Data flow integrity (DFI): Ensure that the flow of data in the program follows the expected legal path. Prevent non-control data from being maliciously tampered with or used by monitoring the source and destination of data. This is the first technology used to defend against non-control data attacks, but it has a high performance overhead. Hardware-assisted methods (HDFI, Hardscope): Use hardware characteristics to enhance defense against non-control data attacks. Provide more efficient and reliable protection by implementing data flow monitoring and verification at the hardware level. This method relies on hardware modifications and requires hardware redesign or upgrades, limiting its wide applicability. Data randomization encryption method (DSR, CoDaRR): DSR randomizes the representation of data by encrypting data in memory with an XOR key, and cannot defend against information leakage attacks. CoDaRR uses a dynamic data space randomization scheme with a high performance overhead. CVI and IDM: Identify and protect secure data, requiring an external measurement engine or virtual machine monitor to protect critical data. Data-oriented programming defenders (Dopdefender and DopdefenderPlus): specifically targeting DOP attacks in non-control data attacks. They can only prevent this type of attack and cannot defend against all attacks on non-control data.

[0004] It should be noted that the types and complexity of non-control data attacks are constantly evolving, so defense measures also need to be continuously updated and improved. The above defense methods have the defects of high performance overhead, requiring hardware modifications or requiring additional virtual machine monitors to detect and defend against attacks. Therefore, it is necessary to propose a lightweight method to defend against non-control data attacks. Summary of the invention

[0005] Purpose of the invention: The purpose of the present invention is to solve the technical problems existing in the background technology. To this end, a software-level defense method for non-control data attacks is provided.

[0006] Technical solution, in order to achieve the above purpose, the present invention proposes a software-level defense method for non-control data attacks, the method comprising the following steps:

[0007] Step S1: identifying target data in a target program;

[0008] Step S2: Collect the correct instruction locations for accessing target data in the program to form a correct access instruction set;

[0009] Step S3: modifying the access rights of the memory page where the target data in the target program is located according to the program's access mode to the target data and the protection level of the target data;

[0010] Step S4: modify the code of the page failure processing function according to the modified page permissions, and the modified page failure processing function is responsible for identifying and distinguishing correct access and incorrect access to the target data;

[0011] Step S5: When the program accesses the target data, the page fault processing function is executed. The page fault processing function determines whether the access to the target data is correct, that is, whether the instruction address accessing the target data is within the previously collected set range; if not, it is an incorrect access, and the program notifies the administrator and terminates automatically; if so, it is a normal access and the current operation is allowed.

[0012] Furthermore, in step S1, the target data in the target program is identified to include: configuration data of the target program, user input, user identity information, decision data of the target program, a GOT table, and a link_map linked list.

[0013] The configuration data of the target program refers to the data read by the program from the user configuration file, such as the CGI-BIN directory of the network service program Apache, the server name and port number of the FTP service program proftpd, the number of concurrent processes of the network service program Nginx, etc.

[0014] The decision data of the target program refers to the branch condition data that affects the control flow of the target program, usually the variables used in the if conditional judgment. For example, a web application may need to decide whether to allow access to a specific page or perform a specific operation based on the user's permission level. Here, the user's permission level is the decision data of the target program. In addition, in software configuration, a switch (flag) is a common decision data used to control whether certain functions are enabled. When processing network requests, the response code is an important decision data that indicates whether the request is successful and how to handle the response.

[0015] Furthermore, in step S1, target data is identified, and the method further includes:

[0016] (1.1) Use objdump to obtain the address of the program GOT segment, and obtain the address of the GOT table and link_map list to be protected;

[0017] (1.2) Analyze the target's functions to obtain configuration data, user input, and user identity data;

[0018] (1.3) Generate a control flow graph based on the target program binary file to obtain decision data.

[0019] Furthermore, in step S2, the correct instruction locations for accessing the target data in the program are collected, an instruction tracker is used to locate the instructions for accessing the target data, and the instruction addresses are printed when the program accesses a specific memory location to form an instruction set, wherein the correct instructions refer to the normal read and write operations of the target program on the target data when it is not attacked.

[0020] Furthermore, in step S3, the access permissions of the memory page where the target data is located in the target program are modified according to the program's access method to the target data and the protection level of the target data. If the program's access method to the target data is read-only or the protection level of the target data is anti-leakage, the permission of the memory page where the target data is located is modified to inaccessible; if the program's access method to the target data is read-write and the protection level of the target data is tamper-proof, the permission of the memory page where the target data is located is modified to read-only; different modification operations are performed on target data of different storage locations and different types, and the page permissions are modified after the target data is initialized and after each correct access collected.

[0021] Furthermore, the modification of the access rights of the memory page where the target data in the target program is located also includes:

[0022] Through code instrumentation, after the configuration data is initialized, new memory is allocated for it, the data is moved to a new page, and the page is set to be non-writable; the pointer to the data is changed, and the value on the original page is cleared to zero;

[0023] By means of code instrumentation, a pointer pointing to the user input is recorded and checked whether the pointer is the same as the verified user input pointer;

[0024] Through code instrumentation, after the user identity information is stored in the process memory, a separate page is allocated and the data is moved to that page, the new page storing the user identity data is set to inaccessible, and the original memory location is erased;

[0025] By means of code instrumentation, the decision data is transformed from a local variable into a pointer to a new mapping page. The value of the decision data is stored on the new page, and the page is set to be inaccessible. To prevent the pointer from being overwritten, the decision data pointer is encrypted with an XOR key, and the XOR key is inaccessible except for the page fault handler.

[0026] Through code instrumentation, all global offset table GOT entries are encrypted with an XOR key. The key is stored in a new page and marked as inaccessible after encryption. The encrypted GOT entries are periodically re-encrypted with a new XOR key.

[0027] Through code instrumentation, the physical page of the link_map structure is mapped to two virtual pages, and the two virtual pages have different permissions. One virtual page is the original page used by the ld.so library, which has read and write permissions to allow ld.so to execute normally; the other virtual page is used by the target program, and it has only read permissions.

[0028] Further, in step S4, the page failure processing function is modified to detect incorrect target data access operations, and the method includes:

[0029] (4.1) Register a new page failure processing function to the kernel through the sigaction system call to handle the target data access failure caused by the page permission change;

[0030] (4.2) Once the target program accesses the target data, the change in page permissions causes a page fault to occur, and the control flow is transferred to execute the page fault handling function, which checks whether the damaged address is the page storing the target data;

[0031] (4.3) If it is a page storing target data, the page fault handling function further checks whether the instruction register value at the damage point belongs to the correct access instruction set;

[0032] (4.4) If it is in the set, the page fault handling function sets the page where the current target data is located as accessible and resumes normal execution; otherwise, the page fault handling function detects an invalid access.

[0033] Beneficial effects: Compared with the prior art, the technical solution of the present invention has the following beneficial technical effects:

[0034] The present invention adopts a new lightweight defense method that can resist various known user-mode non-control data attacks. At the same time, it brings very low performance overhead. It is implemented by software, and only the code of the protected program is modified without modifying the compiler, operating system kernel, virtual machine monitor or hardware. Therefore, it is very easy to deploy. It can also be used to protect commercial off-the-shelf (COTS) programs, not just programs with source code. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required to be used in the embodiments or the prior art are briefly introduced below.

[0036] Figure 1 is a flowchart of the method of the present invention;

[0037] Figure 2 It is a flowchart of the present invention for identifying security data in a protected program;

[0038] Figure 3 It is a flowchart of modifying the security data in the page authority protection program of the present invention;

[0039] Figure 4 It is a processing flow chart of the page failure processing function in the present invention. DETAILED DESCRIPTION

[0040] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention can be implemented in many other ways different from those described herein, and those skilled in the art can make similar improvements without violating the connotation of the present invention, so the present invention is not limited by the specific embodiments disclosed below.

[0041] like Figure 1 As shown, the present invention proposes a software-level defense method for non-control data attacks, which includes the following steps:

[0042] Step S1: Identify target data in the target program

[0043] Specifically, it includes a series of data including identification configuration data, user input, user identity information, decision data, GOT table, link_map linked list, etc.

[0044] Step S2: Collect the correct instruction locations for accessing target data in the program to form a correct access instruction set;

[0045] Step S3: modifying the access rights of the memory page where the target data in the target program is located according to the program's access mode to the target data and the protection level of the target data;

[0046] Step S4: modifying the code of the page failure processing function according to the modified page permissions, and the modified page failure processing function identifies and distinguishes correct access and incorrect access to the target data;

[0047] Step S5, when the program accesses the target data, the page fault processing function is executed. The page fault processing function determines whether the access to the target data is correct, that is, whether the instruction address to access the target data is within the previously collected set range; if not, it is an incorrect access, and the program notifies the administrator and terminates automatically; if so, it is a normal access and the current operation is allowed.

[0048] Figure 2 The flowchart of the present invention for identifying the security data in the protected program is shown. The specific implementation steps are as follows:

[0049] Identify and locate the GOT table, which is used to store the address of the dynamic library function, and is usually located at a fixed offset at the beginning of the code segment. It is a valuable resource for attackers. By destroying its entries, attackers can hijack the control flow. By leaking its content, attackers can obtain the address of the dynamic library and destroy the address space layout randomization (ASLR) protection. The present invention obtains the address of the GOT table to be protected by obtaining the address of the program GOT segment through the objdump instruction.

[0050] Identify and locate the link_map linked list, which is used to manage and control the loading of all dynamic libraries. It stores some metadata of the library and is interpreted by the dynamic loader ld.so. The attacker will modify the link map structure and insert some malicious redirection metadata on the linked list. Subsequently, the victim program will call the dlopen() function. dlopen() will patch some codes and addresses based on these malicious metadata. Ultimately, the malicious metadata will trigger internal code fragments (gadgets), and the attackers will achieve their goals. Since the address of the link_map linked list is stored in the first entry of the GOT table, the present invention obtains the address of the link_map linked list to be protected by obtaining the address of the program GOT segment through the objdump instruction.

[0051] Identify and locate user configuration data, which is often used to control the behavior of the program, especially some key configuration data, such as CGI-BIN path. The present invention collects user configuration data by locating global variables used to store configuration data. The specific steps are: first locate some functions that take the configuration file path as input. Then, analyze these functions. They usually read the configuration file, parse its content, and store the value on some global structure. This global variable is the location where the configuration data to be protected is stored. The configuration data of the target program refers to the data read by the program from the user configuration file, such as the CGI-BIN directory of the network service program Apache, the server name and port number of the FTP service program proftpd, the number of concurrent processes of the network service program Nginx, and other data.

[0052] Identify and locate user input. User input data is critical to security. Attackers often use the following methods to break into the system. First, use legal input to pass the input validation check in the program. Then, tamper with the input data to make it malicious data. Finally, force the program to use these tampered data. The present invention locates the input data by locating the receiving buffer. By locating the function that receives input in the program, the corresponding receiving buffer can be found.

[0053] Identify and locate user identity data, which includes user ID (uid), group ID (gid), effective user ID (euid) and the private key of the server. Once these data are tampered by an attacker, serious consequences will occur, such as privilege escalation. The method of collecting these data in the present invention is to first identify functions, such as geteuid(). Then, identify the variables that store these key data.

[0054] Identify and locate decision data, which can affect the control flow of the program. In the program, key conditional branches make decisions based on certain Boolean values. These data are decision data. Attackers can tamper with these data to affect the control flow of the program and ultimately achieve their goals, such as bypassing authentication. In order to collect decision data, the present invention performs control flow analysis on the entire program and finds the best path in the program based on the control flow graph. Among these paths, the data that affects the conditional jump is the decision data.

[0055] The decision data of the target program refers to the branch condition data that affects the control flow of the target program, usually the variables used in the if conditional judgment. For example, a web application may need to decide whether to allow access to a specific page or perform a specific operation based on the user's permission level. Here, the user's permission level is the decision data of the target program. In addition, in software configuration, a switch (flag) is a common decision data used to control whether certain functions are enabled. When processing network requests, the response code is an important decision data that indicates whether the request is successful and how to handle the response.

[0056] Figure 3 The flowchart of modifying the security data in the page permission protection program of the present invention is shown, and the specific implementation steps are as follows:

[0057] Protect the GOT table. All GOT entries are encrypted with an XOR key that is protected by a page fault protection method. The XOR key is stored in a new page and is marked as inaccessible after encryption. GOT entries always remain encrypted. Although attackers can leak the GOT table, they cannot obtain the plaintext of the GOT function address. To prevent the GOT table from being tampered with, the encrypted GOT entries are periodically re-encrypted with a new XOR key to ensure that the addresses used by the attacker to tamper with the GOT table entries are also encrypted. Since the attacker does not know the encryption key used by the protected program, the address it provides cannot be decrypted in the handler. Therefore, the attacker cannot hijack the control flow by tampering with the GOT table entries.

[0058] Protect the link_map list and prevent the link_map list from being tampered with by mapping the physical page where the link_map list structure is located to two virtual pages. The two virtual pages have different permissions. One of the virtual pages is the original page used by the ld.so library. It has read and write permissions to allow normal execution of ld.so, assuming that the ld.so library is trusted. The other virtual page is used by the protected program. Since the protected program does not have the right to modify the structure, this page has only read permissions.

[0059] To protect user configuration data, the protected program is instrumented to prevent the configuration data from being tampered with. After the configuration data is initialized, a new page is allocated for the data, the data is moved to the new page, and the page is set to be non-writable. At the same time, the pointer to the data is changed and the value on the original page is cleared to zero.

[0060] Protect user input by monitoring the pointer to the user input to prevent attackers from modifying the local pointer to the user input after security verification to point to something malicious. When the user input is used in a critical operation, such as as a parameter to the execl() function, insert code to detect whether the user input has passed the previous verification step. The way to check whether the user input has been verified is to ensure that the pointer used in the verification is the same as the pointer used later. First record the pointer to the user input in the verification step. Then, before the critical use of the user input string, add some code to check whether the pointer is the same as the verified pointer. To avoid the recorded pointer from being tampered with, use the page fault method to protect it. Allocate a new page for it and set it to inaccessible except for the checking code. Once the check is completed, you can erase the value and unmap the page.

[0061] To protect user identity data, allocate a separate page when the user identity information is stored in the process's memory and move the data to that page. Most of the time, the program allocates a heap object to store the user identity information. In this case, simply change the object pointer to point to the new page. Sometimes, the program uses a global object to store the user identity information. In this case, modify the code to change the global structure to a global pointer. At each access point in the program that accesses the global structure for the user identity information, change the access mode from object access to pointer access. Then, make the new page storing the user identity information inaccessible and erase the original memory location.

[0062] Protecting decision data,Decision data is usually stored as local variables, and its value is saved on the stack. By modifying the program code, these local variables are converted into a pointer that points to a newly mapped page, and the value of the decision data is stored on this new page to protect the decision data from tampering. When the program needs to access the decision data, it first accesses this pointer and then accesses its value by dereferencing the pointer. This new page is set to be inaccessible. In the page failure handler, valid access and illegal access can be distinguished. In order to avoid the pointer being overwritten, the pointer is encrypted with an XOR key. This XOR key is inaccessible except for the page failure handler. Therefore, attackers cannot directly manipulate the decision data value on the protected page. At the same time, they cannot corrupt the pointer to point to some malicious value, thereby indirectly tampering with the decision data. In this way, the security and integrity of the decision data can be ensured. Even if attackers try to access or modify this data in some way, they will fail because they cannot obtain the necessary keys or access rights.

[0063] Figure 4 The processing flow chart of the page fault processing function of the present invention is shown, and the specific implementation steps are as follows:

[0064] First, register a new page fault handling function. In the handling function, determine whether the current SIGSEGV (segment fault) signal is caused by GOT encryption. If so, decrypt the current address and use it to overwrite the instruction register value in the signal frame. Because when the program receives SIGSEGV, the value in the instruction register is the encrypted GOT function address, so only the instruction register value needs to be modified without decrypting the GOT entry, which always remains encrypted. Although attackers can leak the GOT table, they cannot obtain the plaintext of the function address.

[0065] If not, check whether the address that caused the error is a page storing data.

[0066] If yes, it is further checked whether the instruction register value at the point where the error occurred is in the pre-computed valid set.

[0067] If it is in the valid set, make the page accessible to the program and resume normal execution.

[0068] If not, illegal access is detected, at which point you can exit the program immediately or report it to the administrator.

[0069] It is important to note that when all valid access points are collected, code is inserted to ensure that the page is reset to inaccessible after each valid access. This is done to ensure that even if an attack occurs between two valid accesses, the attacker cannot use the page to perform illegal operations.

[0070] By moving information to protected pages and changing access modes, the present invention ensures that only authorized code can access the data, while further reducing the risk of data leakage by erasing the original memory location. This protection mechanism is of great significance for preventing memory-based attacks, such as buffer overflow attacks, especially when processing user information, and can ensure the correct execution of programs and the accuracy of data.

[0071] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A software-level defense method for non-control data attacks, characterized in that: The method comprises the following steps: Step S1, identifying target data in a target program; Step S2, collecting the correct instruction locations for accessing the target data in the program to form a correct access instruction set; Step S3, modifying the access rights of the memory page where the target data in the target program is located according to the program's access mode to the target data and the protection level of the target data; Step S4, modifying the code of the page failure processing function according to the modified page permissions, so that the modified page failure processing function identifies and distinguishes between correct access and incorrect access to the target data; Step S5, when the program accesses the target data, the page fault processing function is executed. The page fault processing function determines whether the access to the target data is correct, that is, whether the instruction address to access the target data is within the previously collected set range; if not, it is an incorrect access, and the program notifies the administrator and terminates automatically; if so, it is a normal access and the current operation is allowed.

2. A software-level defense method for non-control data attacks according to claim 1, characterized in that: In step S1, the target data to be identified includes: configuration data of the target program, user input, user identity information, decision data of the target program, GOT table, link_map linked list; the configuration data of the target program refers to the data read by the program from the user configuration file; the decision data of the target program refers to the branch condition data that affects the control flow of the target program.

3. A software-level defense method for non-control data attacks according to claim 2, characterized in that: In step S1, target data is identified, and the method further comprises: (1.1) Use objdump to obtain the address of the program GOT segment, and obtain the address of the GOT table and link_map list to be protected; (1.2) Analyze the target's functions to obtain configuration data, user input, and user identity data; (1.3) Generate a control flow graph based on the target program binary file to obtain decision data.

4. The software-level defense method for non-control data attacks according to claim 1, characterized in that: In step S2, the correct instruction locations for accessing the target data in the program are collected, and the instructions for accessing the target data are located using an instruction tracker. When the program accesses a specific memory location, the instruction address is printed to form an instruction set, where the correct instruction refers to the normal read and write operations of the target program on the target data when it is not attacked.

5. The software-level defense method for non-control data attacks according to claim 1, characterized in that: In step S3, the access permissions of the memory page where the target data is located in the target program are modified according to the program's access method to the target data and the protection level of the target data. If the program's access method to the target data is read-only or the protection level of the target data is anti-leakage, the permission of the memory page where the target data is located is modified to inaccessible; if the program's access method to the target data is read-write and the protection level of the target data is tamper-proof, the permission of the memory page where the target data is located is modified to read-only; different modification operations are performed on target data of different storage locations and different types, and the page permissions are modified after the target data is initialized and after each correct access collected.

6. A software-level defense method for non-control data attacks according to claim 5, characterized in that: The modification of the access rights of the memory page where the target data in the target program is located also includes: Through code instrumentation, after the configuration data is initialized, new memory is allocated for it, the data is moved to a new page, and the page is set to be non-writable; the pointer to the data is changed, and the value on the original page is cleared to zero; By means of code instrumentation, a pointer pointing to the user input is recorded and checked whether the pointer is the same as the verified user input pointer; Through code instrumentation, after the user identity information is stored in the process memory, a separate page is allocated and the data is moved to that page, the new page storing the user identity data is set to inaccessible, and the original memory location is erased; By means of code instrumentation, the decision data is transformed from a local variable into a pointer to a new mapping page. The value of the decision data is stored on the new page, and the page is set to be inaccessible. To prevent the pointer from being overwritten, the decision data pointer is encrypted with an XOR key, and the XOR key is inaccessible except for the page fault handler. Through code instrumentation, all global offset table GOT entries are encrypted with an XOR key. The key is stored in a new page and marked as inaccessible after encryption. The encrypted GOT entries are periodically re-encrypted with a new XOR key. Through code instrumentation, the physical page of the link_map structure is mapped to two virtual pages, and the two virtual pages have different permissions. One virtual page is the original page used by the ld.so library, which has read and write permissions to allow the ld.so library to execute normally; the other virtual page is used by the target program, and it has only read permissions.

7. The software-level defense method for non-control data attacks according to claim 1, characterized in that: In step S4, a page failure handling function is modified to identify incorrect target data access operations, the method comprising: (4.1) Register a new page failure processing function to the kernel through the sigaction system call to handle the target data access failure caused by the page permission change; (4.2) When the target program accesses the target data, the change of page permissions causes a page fault to occur, and the control flow is transferred to execute the page fault handling function, which checks whether the damaged address is the page storing the target data; (4.3) If it is a page storing target data, the page fault handling function further checks whether the instruction register value at the damage point belongs to the correct access instruction set; (4.4) If it is in the set, the page fault handling function sets the page where the current target data is located as accessible and resumes normal execution; otherwise, the page fault handling function detects an invalid access.

Images