Memory Protection through Dynamic Access Control Kun Zhang, Tao Zhang and Santosh Pande College of Computing Georgia Institute of Technology

2 Introduction Released software contains many vulnerabilities Various types of attacks – stack/heap buffer overflow, format string vuln. Solution: Intrusion Detection Systems (IDS) – Network vs. Host Based – Signature vs. Anomaly Detection “Strange” control flow paths taken

3 Motivation Memory tampering is the starting point of attacks Many attacks don’t modify control flow Propose: IDS scheme with compiler & micro-architecture support that detects memory tampering

4 Basic Idea Compiler – Identify regions that critical object are R_Only / WR – Keep state for every crucial object – Change state before & after every store instruction Hardware – On every store check the state of the object written

5 Baseline Scheme Compiler – Identify regions that critical object are R_Only / WR – Keep state for every crucial object – Change state before & after every store instruction add special instructions Hardware – On every store check the state of the object written

6 Examples

7 Baseline Scheme Pros – Some store instruction has to initiate memory corruption  Coverage 100% Cons – Extremely large overhead – Too many new instructions added Solution: Compiler Optimizations

8 Compiler Framework Overview

9 Static Analysis to find as many target addresses as possible

10 Compiler Framework Overview Identify all the store instructions

11 Compiler Framework Overview Write Range: The shortest distance between two store operations on the same object Baseline Case: two state transitions within a write range Used for later optimization phases

12 Compiler Framework Overview Define Hot / Cold blocks Move Protection Operations to Cold Blocks Tradeoff between performance and security

13 Compiler Framework Overview Protecting every single object becomes not feasible Cost/Benefit analysis to select protection points Analysis unit = write range Protect a write range if WR.benefit/WR.cost is low

14 Compiler Framework Overview Clustering of protection operations Re-arrange layout of objects in memory Decrease number of instructions executed

15 Compiler Framework Overview Profile-driven analysis to identify the possible target addresses Observation: limited number of addresses accessed by a pointer dereference Keep these addresses into a table Don’t check if an address is not present ( - )

16 Compiler Framework Overview Need to define what action to take on every given time Maintain a hash table with all the actions to be taken. Access the table by PC address The table must be filled on run time ( -- ) Need to worry about the security of the table ( --- )

17 Architectural Support

18 Experimental Results - Real attacks and injected bugs tested

19 Experimental Results

20 Experimental Results

21 Conclusion IDS system to identify memory tampering Few of architectural support + Compiler Optimizations Baseline System  100% coverage but 50% overhead Final system  14% overhead, 92.7% randomly injected bugs detected Poorly Written

22 Q & A