G ENESIS : A Framework For Achieving Component Diversity John C. Knight, Jack W. Davidson, David Evans, Anh Nguyen-Tuong University of Virginia Chenxi Wang Carnegie Mellon University

University of Virginia SRS July 2005 PI Meeting2 Project Overview Existing practice: Monoculture Technical objectives: Exploit artificial diversity to break existing software monoculture Technical approach: Artificial diversity at compile, link, load, and execution times Combinations selectable with toolkit

University of Virginia SRS July 2005 PI Meeting3 Major risks and planned mitigation: Susceptibility to new class of attacks Deployment issues Ad hoc evaluation Quantitative metrics: Fraction of variants that remain susceptible to attack after transformation Expected major achievements: Significant reduction in susceptibility Task milestones (schedule 12/31/05): Complete diversity toolkit Evaluate complete spectrum of diversity techniques Project Overview

University of Virginia SRS July 2005 PI Meeting4 Genesis Diversity Toolkit

University of Virginia SRS July 2005 PI Meeting5 Genesis Diversity Generator

University of Virginia SRS July 2005 PI Meeting6

University of Virginia SRS July 2005 PI Meeting7 Strong ISR using AES and IT Randomized Instruction Set Emulation, E. G. Barrantes, D. H. Ackley, S. Forrest, and D. Stefanovi, ACM Transactions on Information System Security. 8(1), pp Current implementations of ISR execute injected code Random instruction sequences are executed Rely on probabilistic arguments that the random sequences will crash harmlessly Not realistic for critical embedded systems Recovery of application is difficult/impossible Vulnerable to attack Where’s the FEEB?, Ana Sovarel and Dave Evans, USENIX Security Conference, August Overhead issues (both space and time)

University of Virginia SRS July 2005 PI Meeting8 Strong ISR using AES and IT

University of Virginia SRS July 2005 PI Meeting9 Strong ISR using AES and IT

University of Virginia SRS July 2005 PI Meeting10 CSD: Calling sequence diversity Compile-time/runtime technique to create a software population with many different calling sequences Effective defense against “return-to-libc” attacks (also known as arc injection, Pincus and Baker, IEEE Security and Privacy, 2(4), pp ) Return-to-libc does not require injecting code into the application ISR is not an effective defense against return-to-libc type attacks

University of Virginia SRS July 2005 PI Meeting11 Return-to-libc attack void bar(int arg1, int arg2) { char buffer[100]; … scanf(“%s”, buffer) …. } … arg2 arg1 return addr Saved ebp buffer Runtime Stack … arg2 Bad arg system Saved ebp buffer Runtime Stack Buffer Overflow wget: ; chmod +x dropshell ;./dropshell

University of Virginia SRS July 2005 PI Meeting12 void bar() { … key=Keygen(key, &bar, &foo); foo(arg1, arg2); key=Keygen(key, &foo, &bar); … key=Keygen(key, &bar, &baz); baz(arg); key=Keygen(key, &baz, &bar); … } void foo(int a1, int a2) { Keycheck(key); … Keycheck(key); } CSD: Calling sequence diversity

University of Virginia SRS July 2005 PI Meeting13 CSD: Calling sequence diversity Calls to Keygen and Keycheck routines are inserted by the compiler front end (lcc, edg, Phoenix) At runtime: Strata generates a key for each function (stored in protected region) Replaces calls with inline code to generate proper key or check that the key has the proper value

University of Virginia SRS July 2005 PI Meeting14 Return-to-libc attack void bad(int arg1, int arg2) { char buffer[100]; … scanf(“%s”, buffer) …. } … arg2 arg1 return addr Saved ebp buffer Runtime Stack … arg2 Bad arg system Saved ebp buffer Runtime Stack Buffer Overflow wget: ; chmod +x dropshell ;./dropshell

University of Virginia SRS July 2005 PI Meeting15 Genesis Diversity Toolkit

University of Virginia SRS July 2005 PI Meeting16 Toolkit Execution Environment

University of Virginia SRS July 2005 PI Meeting17

University of Virginia SRS July 2005 PI Meeting18 Performance

University of Virginia SRS July 2005 PI Meeting19 Progress Towards Metric Diversity toolkit facilitates: Creation of large number of variants Operating, attacking & monitoring variants Large numbers of variants of Apache created and tested, success rate very high Disclaimers: Only one application Synthetic but realistic vulnerabilities No statistical significance

University of Virginia SRS July 2005 PI Meeting20 Impediments To Success Possibly unacceptable execution performance degradation Unknown security performance against other types of vulnerabilities Need to investigate the spectrum of diversity defense techniques Cost of deployment and maintenance of the variants might be high