Randomize the Running Function When It Is Disclosed

Address space layout randomization (ASLR) can hide code addresses, which has been widely adopted by security solutions. However, code probes can bypass it. In real attack scenarios, a single code probe can only obtain very limited code information instead of the information of the entire code segmen...

Full description

Saved in:
Bibliographic Details
Published in:IEEE transactions on computers 2024-06, Vol.73 (6), p.1516-1530
Main Authors: Li, YongGang, Bao, Yu, Chung, Yeh-Ching
Format: Article
Language:English
Subjects:
access control
Code probes
code reuse attacks
Codes
control flow
Layout
operating system
Payloads
Probes
Randomization
Runtime
Segments
Source coding
Switches
Citations: Items that this one cites
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Address space layout randomization (ASLR) can hide code addresses, which has been widely adopted by security solutions. However, code probes can bypass it. In real attack scenarios, a single code probe can only obtain very limited code information instead of the information of the entire code segment. So, randomizing the entire code segment is unnecessary. How to minimize the size of the randomized object is a key to reducing the complexity and overhead for ASLR methods. Moreover, ASLR needs to be completed between the time after code probe occurs and before the probed code is used by attackers, otherwise it is meaningless. How to select an appropriate randomization time point is a basic condition for achieving effective address hiding. In this paper, we propose a runtime partial randomization method RandFun. It only randomizes the probed function with parallel threads. And the randomization is performed when and only when potential code probes are detected. In addition, RandFun can protect the probed code from being used as gadgets, whether during or after randomization. Experiments and analysis show RandFun has a good defense effect on code probes and only introduces 1.6% overhead to CPU.
ISSN:0018-9340
1557-9956
DOI:10.1109/TC.2024.3371776