ROP Attack Mitigation via Non-Executable Gadget Cloning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Return-oriented programming (ROP) attacks can bypass security measures like data execution prevention (DEP) and address space layout randomization (ASLR), as attackers can still find and execute malicious code sequences by locating gadgets in memory, leading to potential code execution vulnerabilities.
Innovation Solution
The method involves cloning machine language instruction sequences (gadgets) and marking additional copies as non-executable, distributing them randomly in memory, and using data execution prevention (DEP) to prevent execution of non-executable clones, thereby raising alerts and initiating protective actions when an attacker attempts to execute them.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If instruction location randomization (ILR) is used to prevent ROP attacks by randomizing the location of every instruction, then security against ROP attacks is improved, but process stability is reduced and end-user experience is severely degraded
Solution Approach 1:
The patent segments the instruction sequences by creating multiple copies of gadgets and marking them with different executable/non-executable attributes. This segmentation allows the system to maintain stable instruction locations while preventing ROP attacks by ensuring that not all copies are executable, thus resolving the contradiction between security and stability.
Solution Approach 2:
The patent applies local quality by marking specific copies of gadgets with non-executable attributes while leaving others executable. This selective marking allows the system to maintain overall process stability while providing localized security measures against ROP attacks, avoiding the need to randomize all instruction locations.
2Reliability
If multiple non-executable copies of machine language instruction sequences are created and distributed in memory, then the cost for attackers to find executable gadgets is increased, but memory usage and system complexity increase
Solution Approach 1:
The patent uses copying by creating multiple replicas of gadget copies in memory. These copies are marked with different executable/non-executable attributes. The copying approach increases security by forcing attackers to find the specific executable copy among many non-executable ones, while the complexity is managed through automated attribute assignment rather than manual configuration.
Solution Approach 2:
The patent changes the executable/non-executable parameter of gadget copies to create security barriers. By dynamically setting these attributes on multiple copies, the system increases the difficulty for attackers without requiring fundamental changes to the system architecture, thus managing complexity while improving security.
Data Source
AI summary
Mitigating return-oriented programming attacks. From program code and associated components needed by the program code for execution, machine language instruction sequences that may be combined and executed as malicious code are selected. A predetermined number of additional copies of each of the selected machine language instruction sequences are made, and the additional copies are marked as non-executable. The machine language instruction sequences and the non-executable copies are distributed in memory. If a process attempts to execute a machine language instruction sequence that has been marked non-executable, the computer may initiate protective action.