TY - GEN
T1 - HyperCrop
T2 - 13th International Conference on Information and Communications Security, ICICS 2011
AU - Jiang, Jun
AU - Jia, Xiaoqi
AU - Feng, Dengguo
AU - Zhang, Shengzhi
AU - Liu, Peng
N1 - Funding Information:
This work was supported by National Natural Science Foundation of China (NSFC) under Grant No. 61100228 and 61073179. Peng Liu was supported by AFOSR FA9550-07-1-0527 (MURI), ARO W911NF-09-1-0525 (MURI), and NSF CNS-0905131.
PY - 2011
Y1 - 2011
N2 - Return oriented programming (ROP) has recently caught great attention of both academia and industry. It reuses existing binary code instead of injecting its own code and is able to perform arbitrary computation due to its Turing-completeness. Hence, It can successfully bypass state-of-the-art code integrity mechanisms such as NICKLE and SecVisor. In this paper, we present HyperCrop, a hypervisor-based approach to counter such attacks. Since ROP attackers extract short instruction sequences ending in ret called "gadgets" and craft stack content to "chain" these gadgets together, our method recognizes that the key characteristics of ROP is to fill the stack with plenty of addresses that are within the range of libraries (e.g. libc). Accordingly, we inspect the content of the stack to see if a potential ROP attack exists. We have implemented a proof-of-concept system based on the open source Xen hypervisor. The evaluation results exhibit that our solution is effective and efficient.
AB - Return oriented programming (ROP) has recently caught great attention of both academia and industry. It reuses existing binary code instead of injecting its own code and is able to perform arbitrary computation due to its Turing-completeness. Hence, It can successfully bypass state-of-the-art code integrity mechanisms such as NICKLE and SecVisor. In this paper, we present HyperCrop, a hypervisor-based approach to counter such attacks. Since ROP attackers extract short instruction sequences ending in ret called "gadgets" and craft stack content to "chain" these gadgets together, our method recognizes that the key characteristics of ROP is to fill the stack with plenty of addresses that are within the range of libraries (e.g. libc). Accordingly, we inspect the content of the stack to see if a potential ROP attack exists. We have implemented a proof-of-concept system based on the open source Xen hypervisor. The evaluation results exhibit that our solution is effective and efficient.
UR - http://www.scopus.com/inward/record.url?scp=81055144635&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=81055144635&partnerID=8YFLogxK
U2 - 10.1007/978-3-642-25243-3_29
DO - 10.1007/978-3-642-25243-3_29
M3 - Conference contribution
AN - SCOPUS:81055144635
SN - 9783642252426
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 360
EP - 373
BT - Information and Communications Security - 13th International Conference, ICICS 2011, Proceedings
Y2 - 23 November 2011 through 26 November 2011
ER -