Heisenbyte Destructive Code Reads for Memory Disclosure Defense

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing solutions for preventing memory disclosure attacks, such as fine-grained randomization and execute-only memory approaches, are inadequate in protecting against code reuse attacks, especially when dealing with legacy binaries and dynamically generated just-in-time code, as they fail to effectively separate code and data or are impractical to implement.

Innovation Solution

The Heisenbyte system employs destructive code reads, where executable code is garbled after being read, using hardware virtualization to identify and alter memory access permissions, allowing legitimate code execution while rendering read-accessible code unusable, thus thwarting attackers' attempts to leverage memory disclosure bugs.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If execute-only memory approach is used to prevent code reuse attacks, then security against memory disclosure attacks is improved, but compatibility with legacy binaries and JIT code is worsened

Engineering Contradiction:

Improvesecurity against memory disclosure attacksVSAvoidcompatibility with legacy binaries and JIT code

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system dynamically changes memory permissions based on access patterns and timing. Code pages are initially marked as readable and executable, then transitioned to execute-only after a delay or upon detection of read attempts, allowing legitimate code execution while preventing attacker enumeration

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system performs preliminary code execution to allow legitimate programs to run their code before restricting read access. This preliminary phase enables normal operation while setting up subsequent protection against memory disclosure attacks

Inventive Principle:

Principle #10Preliminary action

2Reliability

If fine-grained randomization is used to blind code layout, then security against code reuse attacks is improved, but runtime performance is worsened

Engineering Contradiction:

Improvesecurity against code reuse attacksVSAvoidruntime performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system applies randomization selectively to specific code regions rather than uniformly across all executable memory. This local approach maintains security for critical code sections while minimizing performance impact on frequently accessed code paths

Inventive Principle:

Principle #3Local quality

3Reliability

If static compilation techniques are used to separate code and data, then security against memory disclosure attacks is improved, but ease of implementation is worsened

Engineering Contradiction:

Improvesecurity against memory disclosure attacksVSAvoidease of implementation

Core Design Contradiction:

ReliabilityVSEase of manufacture

Solution Approach 1:

The system introduces an intermediary layer (such as a compiler wrapper or binary instrumentation tool) that automatically separates code and data sections without requiring manual source code modification. This intermediary handles the complex separation task while maintaining ease of use for developers

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11841966B2Inhibiting memory disclosure attacks using destructive code reads

Publication Date: 2023.12.12 THE TRUSTEES OF COLUMBIA UNIV IN THE CITY OF NEW YORK

AI summary

Disclosed are devices, systems, apparatus, methods, products, and other implementations, including a method that includes determining whether an operation to access a memory location containing executable code comprises a general-purpose memory access operation, and changing content of the memory location in response to a determination that the operation to access the memory location containing the executable code comprises the general-purpose memory access operation to the memory location.