12012/02/07 YLJ@adlab

RIPE:RUNTIME INTRUSION PREVENTION EVALUATORJohn Wilander, Mariam KamkarLinkopings Universitet

Nick Nikiforakis, Yves Younan, Wouter JoosenKatholieke Universiteit Leuven Belgium

ACSAC 2011

2

Agenda

Introduction How RIPE Works Attack Forms Countermeasures Evaluated Result Future Work

2012/02/07 YLJ@adlab

3

Introduction RIPE

A deliberately vulnerable C program that attacks itself to allow evaluation of countermeasures.

Contributions 850 working buffer overflow attack forms Evaluation of 8 countermeasures 7% to 89% of attack forms prohibited

2012/02/07 YLJ@adlab

4

How RIPE Works

2012/02/07 YLJ@adlab

Backend

(C)

Can be runstand-alone,command-line

Performsone attackper execution

Frontend

(Python)

Report

Drives

5

Attack Forms

NDSS ’03 Testbed

2012/02/07 YLJ@adlab

Targ

et

Technique

locati

o

n

20 attack forms

6

Attack Forms

ACSAC ’11 Testbed

2012/02/07 YLJ@adlab

Targ

et

Technique

locati

o

n

850 attack forms

FunctionAttack code

20 attack forms

RET Old base ptr Func ptr Longjmp buffer Struct with buffer & func ptr

Direct Indirect

memcpy str(n)cpy s(n)printf str(n)cat {s|f}scanf loop equiv of memcpy

Stack (local var & param)

Heap BSS Data

Shellcode Shellcode + NOP Shellcode + Polym. NOP Return-into-libc ROP

7

Attack Forms

Example Direct Overflow Indirect Overflow Overflow Within Struct Injected Stackframe

2012/02/07 YLJ@adlab

8

Countermeasures Evaluated

ProPolice (canary-based, variable reorder)

CRED (boundary checking, referent object)

StackShield, Libverify (copy & check)

Libsafe, LibsafePlus, LibsafePlus+TIED(library wrappers)

PAE & XD (non-executable memory)2012/02/07 YLJ@adlab

9

Result

2012/02/07 YLJ@adlab

10

Future Work

Save/load offsets to allow testing of ASLR,probabilistic memory safety

Other attack forms: Heap spraying Non-control data attacks

2012/02/07 YLJ@adlab

11

Direct Overflow

2012/02/07 YLJ@adlab

12

Indirect Overflow

2012/02/07 YLJ@adlab

13

Overflow Within Struct

2012/02/07 YLJ@adlab

14

Injected Stackframe

2012/02/07 YLJ@adlab

15

ProPolice

2012/02/07 YLJ@adlab

16

CRED(C Range Error Detector)

2012/02/07 YLJ@adlab

17

StackShield

2012/02/07 YLJ@adlab

18

StackShield

2012/02/07 YLJ@adlab

19

Libverify

2012/02/07 YLJ@adlab

All Functions

20

Libsafe

2012/02/07 YLJ@adlab

21

LibsafePlus&TIED

2012/02/07 YLJ@adlab

Source code

Compile

with -g

BinaryDebug info

Offset from frame pointer and size for all buffers

Instruments all functionsto check bounds

22

XD(eXecute-Disable) + PAE(Physical Address Extension)

2012/02/07 YLJ@adlab