Protection method for global offset table based on address randomization and segment isolation

doi:10.11772/j.issn.1001-9081.2016.07.1852

Journal of Computer Applications ›› 2016, Vol. 36 ›› Issue (7): 1852-1855.DOI: 10.11772/j.issn.1001-9081.2016.07.1852

Previous Articles Next Articles

Protection method for global offset table based on address randomization and segment isolation

LIN Jian^1,2, GUO Yudong^1,2, ZHOU Shaohuang^1,2

1. Information Engineering University, Zhengzhou Henan 450001, China;
2. State Key Laboratory of Mathematical Engineering and Advanced Computing (Information Engineering University), Zhengzhou Henan 450001, China

Received:2015-12-02 Revised:2016-03-03 Online:2016-07-14 Published:2016-07-10

基于地址随机和段隔离的全局偏移表保护方法

林键^1,2, 郭玉东^1,2, 周少皇^1,2

1. 信息工程大学, 郑州 450001;
2. 数学工程与先进计算国家重点实验室(信息工程大学), 郑州 450001

通讯作者: 林键
作者简介:林键(1989-),男,四川内江人,硕士研究生,主要研究方向:信息安全;郭玉东(1964-),男,河南太康人,教授,硕士,主要研究方向:操作系统、虚拟化;周少皇(1990-),男,河南郑州人,硕士研究生,主要研究方向:信息安全。

Abstract

Abstract: In an Executable and Linkable Format (ELF) executable program, Global Offset Table (GOT) was used to store the absolute addresses of library functions. But in Linux operation system, GOT dereference and GOT overwrite are two common vulnerability exploit methods. Through analyzing the GOT feature, a protection method for GOT based on address randomization and segment isolation was proposed and implemented. With modifying the ELF loader program, all sections which pointed to the GOT were loaded into random memory addresses. Using segment isolation technology, all instructions with reference to GOT used a new segment register. The experimental results prove that the proposed method can not only defense against the exploit method of GOT effectively, but also has a very low cost of average 2.9 milliseconds.

Key words: Global Offset Table (GOT) protection, address randomization, segment isolation, GOT dereference, GOT overwrite

摘要： 在可执行和可链接格式（ELF）的可执行程序中，存在一个全局偏移表（GOT），用于存放引用库函数的绝对地址，但是在Linux系统中，GOT解引用和GOT覆写是两种比较常用的漏洞利用方法。通过分析GOT的特性，提出并实现了基于地址随机和段隔离的GOT保护方法。通过修改Linux的可执行程序加载器，将与GOT有数据指向关系的节均加载到随机内存地址；同时使用段隔离技术，对GOT的代码引用的指令使用一个新的段寄存器进行间接引用。实验结果证明，该方法不仅能够有效地防御针对GOT的漏洞利用方法，而且性能损耗极低，只有平均2.9 ms的额外开销。

关键词: 全局偏移表保护, 地址随机, 段隔离, 全局偏移表解引用, 全局偏移表覆写

CLC Number:

TP309.2

LIN Jian, GUO Yudong, ZHOU Shaohuang. Protection method for global offset table based on address randomization and segment isolation[J]. Journal of Computer Applications, 2016, 36(7): 1852-1855.

林键, 郭玉东, 周少皇. 基于地址随机和段隔离的全局偏移表保护方法[J]. 计算机应用, 2016, 36(7): 1852-1855.

References

[1] TEAM PAX. PaX address space layout randomization[EB/OL].[2003-03-15]. https://pax.grsecurity.net/docs/aslr.txt.
[2] Wikipedia. Data execution prevention[EB/OL].[2015-03-12]. https://en.wikipedia.org/wiki/Data_Execution_Prevention.
[3] MARCO-GISBERT H, RIPOLL I. On the effectiveness of full-ASLR on 64-bit Linux[EB/OL].[2015-11-20]. http://cybersecurity.upv.es/attacks/offset2lib/offset2lib-paper.pdf.
[4] ROGLIA G F, MARTIGNONI L, PALEARI R, et al. Surgically returning to randomized lib(c)[C]//ACSAC'09:Proceedings of the 2009 Annual Computer Security Applications Conference. Piscataway, NJ:IEEE, 2009:60-69.
[5] Open Security Group. How to hijack the global offset table with pointers for root shells[EB/OL].[2015-04-04]. http://www.open-security.org/texts/6.
[6] DAVI L, SADEGHI A R, LEHMANN D, et al. Stitching the gadgets:on the ineffectiveness of coarse-grained control-flow integrity protection[C]//SEC'14:Proceedings of the 23rd USENIX Security Symposium. Berkeley, CA:USENIX Association, 2014:401-416.
[7] KLEIN T. A Bug Hunter's Diary:a Guided Tour Through the Wilds of Software Security[M]. San Francisco:No Starch Press, 2011:183-185.
[8] KLEIN T. RELRO-A (not so well known) memory corruption mitigation technique[EB/OL].[2015-02-21]. http://tk-blog.blogspot.jp/2009/02/relro-not-so-well-known-memory.html.
[9] ZHANG C, DUAN L, WEI T, et al. SecGOT:secure global offset tables in ELF executables[C]//Proceedings of the 2013 International Conference on Computer Science and Electronics Engineering. Amsterdam:Atlantis Press, 2013:995-998.
[10] XU J, KALBARCZYK Z, IYER R K. Transparent runtime randomization for security[C]//Proceedings of the 22nd International Symposium on Reliable Distributed Systems. Piscataway, NJ:IEEE, 2003:260-269.
[11] Tool Interface Standards Committee. Executable and Linkable Format (ELF)[EB/OL].[2015-04-01]. http://www.cs.cmu.edu/afs/cs/academic/class/15213-f00/docs/elf.pdf.
[12] ARGYROUDIS P, GLYNOS D. Protecting the core:kernel exploitation mitigations[EB/OL].[2015-05-17]. http://census.gr/media/bheu-2011-wp.pdf.
[13] CVE Details. Vulnerability details:CVE-2013-2028[EB/OL].[2013-07-19]. http://www.cvedetails.com/cve/2013-2028.
[14] MACMANUS G, HAL, SAELO. Nginx HTTP Server 1.3.9-1.4.0 chunked encoding stack buffer overflow[EB/OL].[2015-10-24]. http://www.rapid7.com/db/modules/exploit/linux/http/nginx_chunked_size.
[15] ROEMER R, BUCHANAN E, SHACHAM H, et al. Return-oriented programming:systems, languages, and applications[J]. ACM Transactions on Information and System Security, 2012, 15(1):Article No. 2.
[16] HENNING J L. SPEC CPU2006 benchmark descriptions[J]. ACM SIGARCH Computer Architecture News, 2006, 34(4):1-17.

Protection method for global offset table based on address randomization and segment isolation

基于地址随机和段隔离的全局偏移表保护方法

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 15

Recommended Articles

Metrics

[1]	SHE Wei, MA Tianxiang, FENG Haige, TIAN Zhao, LIU Wei. Blockchain covert communication method based on contract call concealment#br# #br# [J]. Journal of Computer Applications, 0, (): 0-0.
[2]	Zhenhao ZHAO, Shibin ZHANG, Wunan WAN, Jinquan ZHANG, zhi QIN. Delegated proof of stake consensus algorithm based on reputation value and strong blind signature algorithm [J]. Journal of Computer Applications, 2024, 44(12): 3717-3722.
[3]	. fedPF: Federated learning for personalization and fairness [J]. Journal of Computer Applications, 0, (): 0-0.
[4]	. Blockchain-based model for notarization of simulation testing data in autonomous driving [J]. Journal of Computer Applications, 0, (): 0-0.
[5]	Xinyue YAN, Shuqun YANG, Yongbin GAO. Document-level relationship extraction based on evidence enhancement and multi-feature fusion [J]. Journal of Computer Applications, 2024, 44(11): 3379-3385.
[6]	Xuebin CHEN, Changsheng QU. Overview of backdoor attacks and defense in federated learning [J]. Journal of Computer Applications, 2024, 44(11): 3459-3469.
[7]	Xiang LIN, Biao JIN, Weijing YOU, Zhiqiang YAO, Jinbo XIONG. Model integrity verification framework of deep neural network based on fragile fingerprint [J]. Journal of Computer Applications, 2024, 44(11): 3479-3486.
[8]	Shuaihua ZHANG, Shufen ZHANG, Mingchuan ZHOU, Chao XU, Xuebin CHEN. Malicious traffic detection model based on semi-supervised federated learning [J]. Journal of Computer Applications, 2024, 44(11): 3487-3494.
[9]	Xiaoyu DU, Shuaiqi LIU, Zhijie HAN, Zhenxiang HUO, Yujing WANG. Patient-centric medical information sharing scheme based on IPFS and blockchain [J]. Journal of Computer Applications, 2024, 44(10): 3122-3133.
[10]	Huan ZHANG, Jingyu WANG, Lixin LIU, Xiaoyu JIANG. Multi-organization collaborative data sharing scheme with dual authorization [J]. Journal of Computer Applications, 2024, 44(10): 3307-3314.
[11]	Xuebin CHEN, Liyang SHAN, Rumin GUO. Review of histogram publication methods based on differential privacy [J]. Journal of Computer Applications, 2024, 44(10): 3114-3121.
[12]	. Network traffic classification model integrating variational autoencoder and AdaBoost-CNN [J]. Journal of Computer Applications, 0, (): 0-0.
[13]	MA Haifeng, CAI Jiewei, XUE Qingshui, YANG Jiahai, HAN Jing, LU Zixuan. Post-quantum certificateless public audit scheme based on#br# lattice #br# [J]. Journal of Computer Applications, 0, (): 0-0.
[14]	. Digital content copyright protection and fair tracking scheme based on blockchain [J]. Journal of Computer Applications, 0, (): 0-0.
[15]	REN Zhiqiang, CHEN Xuebin. FedAud: adaptive defence mechanism updated based on historical model [J]. Journal of Computer Applications, 0, (): 0-0.