RIP-ROP: uma proteção contra ataques de execução de código arbitrário baseados em Return-Oriented Programming

Abstract

ReturnOriented Programming (ROP) is the name of a technique used for the development of malicious code that has been widely used to force execution of arbitrary code on vulnerable applications. It is based on the interconnection of small fractions of code belonging to attacked processes, which allows overcoming protections widely disseminated, such as that offered by the execute bit (NX/XD). Because of its wide use in attacks against modern computing systems, protections against ROP based exploits have been widely studied. Nevertheless, it is still not known a solution capable of combining efficacy against all forms of ROP, computational efficiency and feasibility of the employment on applications protection. In order to facilitate the understanding of these requirements and the inherent implications for methods of protection against ROP attacks, this work offers a bibliographic survey of the state of the art about this subject. For this, we propose in this paper: (i) metrics for evaluation and comparison of protections against ROP attacks and (ii) taxonomies to classify these protections depending on blocking strategies and implementation approaches used in each solution. This dissertation also provides a new method of protection against arbitrary code execution attacks based on ROP that seeks to encompass the requirements of effectiveness, efficiency and viability. It was demonstrated that by controlling the frequency of indirect branch instructions performed by applications it is possible to distinguish ROP attacks from authentic codes and thus prevent their consolidation. In a dynamic binary instrumentation framework, it was developed a prototype – named RIPROP – for Windows, Linux, Android and OSX environments. Experiments conducted with malicious codes available in public repositories of exploits confirmed the feasibility of the proposed model for the protection of real applications. In addition, the computational cost imposed by RIPROP is comparable and in some cases lower than that achieved by related protections.