Return Address Randomization Scheme for Annuling Data-Injection Buffer Overflow Attacks

• Published in: Information Security and Cryptology pp. 238 - 252
• Main Authors: Kim, Deok Jin, Kim, Tae Hyung, Kim, Jong, Hong, Sung Je
• Format: Book Chapter Conference Proceeding
• Language: English
• Published: Berlin, Heidelberg Springer Berlin Heidelberg 2006; Springer
• Series: Lecture Notes in Computer Science
• Subjects: Applied sciences; Buffer Overflow; Computer science; control theory; systems; Computer systems and distributed systems. User interface; Cryptography; Data Injection Buffer Overflow Attack; Exact sciences and technology; Information, signal and communications theory; Instruction Set; Memory and file management (including protection and security); Memory organisation. Data processing; Randomization; Return Address; return-into-libc Attack; Security; Signal and communications theory; Software; Telecommunications and information theory; Overflow(computer arithmetics); Randomization; Vulnerability; Buffer system; Cryptography; Computer security; Computer attack
• ISBN: 3540496084; 9783540496083
• ISSN: 0302-9743; 1611-3349
• DOI: 10.1007/11937807_19

Buffer overflow(BOF) has been the most common form of vulnerability in software systems today, and many methods exist to defend software systems against BOF attacks. Among them, the instruction set randomization scheme, which makes attacker not to know the specific instruction set of the target machine, is the most promising defense scheme because it defends all typical code-injection BOF attacks. However, this defense scheme can not cover data-injection BOF attacks like return-into-libc attacks. In order to defend against the data-injection BOF attacks as well as the code-injection BOF attacks, we propose an enhanced defense scheme randomizing not only the instruction sets but also the return addresses. Implementation results show that the proposed scheme can defend software systems against data-injection BOF attacks as well as code-injection BOF attacks without significant extra overheads.