Shuffler: Fast and Deployable Continuous Code Re-Randomization

Transcription

1 Shuffler: Fast and Deployable Continuous Code Re-Randomization David Williams-King, Graham Gobieski, Kent Williams-King, James P. Blake, Xinhao Yuan, Patrick Colp, Michelle Zheng, Vasileios P. Kemerlis, Junfeng Yang, William Aiello OSDI 20161

2 Software Remains Vulnerable High-profile server breaches are commonplace 2

3 Software Remains Vulnerable High-profile server breaches are commonplace 90% of today s attacks utilize ROP [1] 3

4 Return-Oriented Programming Reuse fragments of legitimate code (gadgets) Program code Stack func_1 func_2 ret addr func_3 4

5 Return-Oriented Programming Reuse fragments of legitimate code (gadgets) Program code Stack ret addr 5

6 Return-Oriented Programming Reuse fragments of legitimate code (gadgets) Program code Stack ret addr data ret addr ret addr ret addr Buffer Overrun 6

7 Return-Oriented Programming Reuse fragments of legitimate code (gadgets) Program code Stack ret addr data ret addr ret addr ret addr ROP gadget chain Buffer Overrun 7

8 Modern ROP Attacks JIT-ROP [2]: iteratively read code at runtime 8

9 Modern ROP Attacks JIT-ROP [2]: iteratively read code at runtime Target program Attacker func_1 func_2 func_3 9

10 Modern ROP Attacks JIT-ROP [2]: iteratively read code at runtime Target program Attacker func_1 func_2 func_3 10

11 Modern ROP Attacks JIT-ROP [2]: iteratively read code at runtime Target program Attacker func_1 func_2 ROP gadget chain func_3 11 Inject exploit

12 Modern ROP Attacks JIT-ROP [2]: iteratively read code at runtime Target program Attacker func_1 func_2 ROP gadget chain func_3 12 Inject exploit

13 The Shuffler Idea What if we re-randomize code more rapidly than an attacker discovers gadgets? func_1 func_2 func_3 13

14 The Shuffler Idea What if we re-randomize code more rapidly than an attacker discovers gadgets? func_1 func_2 func_3 14

15 The Shuffler Idea What if we re-randomize code more rapidly than an attacker discovers gadgets? func_1 func_2 func_2 func_3 func_3 func_1 15

16 The Shuffler Idea What if we re-randomize code more rapidly than an attacker discovers gadgets??? func_2 ROP gadget chain func_3 func_1 16 Inject exploit

17 The Shuffler Idea What if we re-randomize code more rapidly than an attacker discovers gadgets? ROP gadget chain 17 Inject exploit

18 How Is This Possible? Re-randomize code before an attacker uses it 18

19 How Is This Possible? Re-randomize code before an attacker uses it faster than disclosure vulnerability execution time; faster than gadget chain computation time; or, faster than network communication time 19

20 How Is This Possible? Re-randomize code before an attacker uses it faster than disclosure vulnerability execution time; faster than gadget chain computation time; or, faster than network communication time 20

21 How Is This Possible? Re-randomize code before an attacker uses it faster than disclosure vulnerability execution time; faster than gadget chain computation time; or, faster than network communication time one memory disclosure can only travel 820 miles! 21

22 What Is Shuffler? Defense based on continuous re-randomization Defeats all known code reuse attacks millisecond shuffling, scales to 24 threads Fast: bounds attacker s available time Deployable: Defeats even attackers with zero network latency Binary analysis w/o modifying kernel, compiler,... Egalitarian: Shuffler runs in same address space, defends itself 22

23 Outline 23

24 Outline 1. Continuous re-randomization 2. Accelerating our randomization 3. Binary analysis and egalitarianism 4. Results and Demo 24

25 Continuous Re-Randomization Easy to copy code & fix direct references func_1 func_2... call func_2... func_2 25

26 Continuous Re-Randomization Easy to copy code & fix direct references func_1 (deleted)... call func_2... func_2 26

27 Continuous Re-Randomization Easy to copy code & fix direct references What about code pointers? 27

28 Continuous Re-Randomization Easy to copy code & fix direct references What about code pointers? ptr: func_1 func_2... mov $func_2, ptr... call *ptr... 28

29 Continuous Re-Randomization Easy to copy code & fix direct references What about code pointers? ptr: func_1 &func_2 func_2... mov $func_2, ptr... call *ptr... 29

30 Continuous Re-Randomization Easy to copy code & fix direct references What about code pointers? ptr: func_1... mov $func_2, ptr... call *ptr... &func_2 func_2 (deleted) func_2 30

31 Continuous Re-Randomization Easy to copy code & fix direct references What about code pointers? ptr: func_1... mov $func_2, ptr... call *ptr... &func_2 (deleted) func_2 31

32 Continuous Re-Randomization Easy to copy code & fix direct references What about code pointers? ptr: &func_2 &func_2 &func_2 &func_2 &func_2 &func_2 &func_2 func_2 (deleted) How to update all propagated pointers? &func_2 func_2 32

33 Continuous Re-Randomization Solution: add extra level of indirection ptr: f_2_idx f_2_idx f_2_idx f_2_idx f_2_idx %gs: (table) &func_2... func_2 33

34 Continuous Re-Randomization Solution: add extra level of indirection ptr: f_2_idx f_2_idx f_2_idx f_2_idx f_2_idx f_2_idx f_2_idx %gs: (table) f_2_idx &func_2... func_2 34

35 Continuous Re-Randomization Solution: add extra level of indirection ptr: f_2_idx f_2_idx f_2_idx f_2_idx f_2_idx f_2_idx %gs: (table) f_2_idx func_2 &func_2... f_2_idx func_2 35

36 Continuous Re-Randomization Solution: add extra level of indirection ptr: f_2_idx f_2_idx f_2_idx f_2_idx f_2_idx f_2_idx %gs: (table) f_2_idx func_2 &func_2... f_2_idx (deleted) 36

37 Code Pointer Abstraction Transforming *code_ptr into **code_ptr Correctness: pointer updates sound & precise Disclosure-resilience: code ptr table is hidden 37

38 Code Pointer Abstraction Transforming *code_ptr into **code_ptr Correctness: pointer updates sound & precise Disclosure-resilience: code ptr table is hidden ptr: f_2_idx func_2 %gs:... func_

39 Code Pointer Abstraction Transforming *code_ptr into **code_ptr Correctness: pointer updates sound & precise Disclosure-resilience: code ptr table is hidden ptr: f_2_idx func_2 %gs:... func_2... Rewrite call sites callq *%rax => callq *%gs:(%rax) Rewrite initialization points mov => mov $0x40054d, %rax $0x20, %rax 39

40 Outline 1. Continuous re-randomization 2. Accelerating our randomization 3. Binary analysis and egalitarianism 4. Results and Demo 40

41 Return Address Encryption Return addresses are code pointers too Could use code pointer table, but inefficient call/ret instructions highly optimized 41

42 Return Address Encryption Return addresses are code pointers too Could use code pointer table, but inefficient call/ret instructions highly optimized Alternative mechanism correct and hidden Use normal call instructions Encrypt return addresses with XOR key 42

43 Return Address Encryption Prevent return address disclosure 43

44 Return Address Encryption Prevent return address disclosure Thread Stack func_1 ret addr ret addr func_2 ret addr func_3 44

45 Return Address Encryption Prevent return address disclosure Thread Stack func_1 (encrypted) + (encrypted) + (encrypted) + func_2 func_3 XOR key 45

46 Return Address Encryption Prevent return address disclosure Thread Stack func_1 (encrypted) + (encrypted) + (encrypted) + func_2 func: ; original code ret func_3 XOR key 46

47 Return Address Encryption Prevent return address disclosure We use binary rewriting (expand basic blocks) Thread Stack func_1 (encrypted) + (encrypted) + (encrypted) + func_2 func: mov %fs:0x28,%r11 xor %r11,(%rsp) ; original code mov %fs:0x28,%r11 xor %r11,(%rsp) ret func_3 XOR key 47

48 Return Address Migration Unwind stack and re-encrypt new addresses func_1 func_2 Thread Stack (encrypted) + (encrypted) + (encrypted) + func_3 XOR key 48

49 Return Address Migration Unwind stack and re-encrypt new addresses func_1 func_2 Thread Stack (encrypted) + (encrypted) + (encrypted) func_3 func_1 + func_2 func_3 XOR key 49

50 Return Address Migration Unwind stack and re-encrypt new addresses (deleted) (deleted) Thread Stack (encrypted) + (encrypted) + (encrypted) (deleted) func_1 + func_2 func_3 XOR key 50

51 Asynchronous Randomization 51

52 Asynchronous Randomization Creating new code copies takes time 20ms shuffle period Computations 52

53 Asynchronous Randomization Creating new code copies takes time 5ms real work Computations 15ms shuffling overhead Generate permutation Make new code copy Fix call instructions Update code pointer table Stack unwind 53

54 Asynchronous Randomization Creating new code copies takes time Shuffler prepares new code asynchronously 5ms real work Computations 15ms shuffling overhead Generate permutation Make new code copy Fix call instructions Update code pointer table Stack unwind 54

55 Asynchronous Randomization Creating new code copies takes time Shuffler prepares new code asynchronously Computations Generate permutation Make new code copy 19.94ms real work 0.06ms Computations Stack unwind Fix call instructions Update code pointer table Stack unwind 55

56 Asynchronous Randomization Creating new code copies takes time Shuffler prepares new code asynchronously Each thread unwinds its own stack in parallel Computations Generate permutation Make new code copy 99.7% of runtime 0.3% Computations Stack unwind Fix call instructions Update code pointer table Stack unwind 56

57 Outline 1. Continuous re-randomization 2. Accelerating our randomization 3. Binary analysis and egalitarianism 4. Results and Demo 57

58 Augmented Binary Analysis Use additional info from unmodified compilers Symbols, to distinguish code and data (no -s) Relocations, to find all code pointers (--emit-relocs) 58

59 Augmented Binary Analysis Use additional info from unmodified compilers Symbols, to distinguish code and data (no -s) Relocations, to find all code pointers (--emit-relocs) Code pointer, or integer?.section.rodata:.quad 0x section.text: mov $0x400620, %rax 59

60 Augmented Binary Analysis Use additional info from unmodified compilers Symbols, to distinguish code and data (no -s) Relocations, to find all code pointers (--emit-relocs) Code pointer, or integer?.section.rodata:.quad 0x section.rodata:.quad section.text: mov $0x400620, %rax.section.text: mov $ , %rax 60

61 Augmented Binary Analysis Use additional info from unmodified compilers Symbols, to distinguish code and data (no -s) Relocations, to find all code pointers (--emit-relocs) Code pointer, or integer?.section.rodata:.quad 0x section.rodata:.quad section.text: mov $0x400620, %rax.section.text: mov $ , %rax Relocations (meta-data) 61

62 Augmented Binary Analysis Use additional info from unmodified compilers Symbols, to distinguish code and data (no -s) Relocations, to find all code pointers (--emit-relocs) ask linker to preserve relocations Code pointer, or integer?.section.rodata:.quad 0x section.rodata:.quad section.text: mov $0x400620, %rax.section.text: mov $ , %rax Relocations (meta-data) 62

63 Augmented Binary Analysis Allows accurate and complete disassembly 63

64 Augmented Binary Analysis Allows accurate and complete disassembly Many special cases, but we handle them 64

65 Where to Re-Randomize From Most defenses operate at higher privilege level i.e. kernel, hypervisor, hardware Or else declare their own code trusted 65

66 Where to Re-Randomize From Most defenses operate at higher privilege level i.e. kernel, hypervisor, hardware Or else declare their own code trusted Shuffler is egalitarian Same level of privilege, no system modifications Defends itself from attack 66

67 Egalitarian Bootstrapping Problem: transformations break original code e.g. memcpy uses code pointers 67

68 Egalitarian Bootstrapping Problem: transformations break original code e.g. memcpy uses code pointers memcpy s code mov jmpq 0x400620(,%rax,8),%rax *%rax 0x400620: 0x400630: 0x400640: 0x x x x x40052c 0x

69 Egalitarian Bootstrapping Problem: transformations break original code e.g. memcpy uses code pointers memcpy s code mov jmpq 0x400620(,%rax,8),%rax *%rax 0x400620: 0x400630: 0x400640: 0x x x x x40052c 0x Rewrite main, printf,..., memcpy,... 69

70 Egalitarian Bootstrapping Problem: transformations break original code e.g. memcpy uses code pointers New memcpy code memcpy s code mov jmpq 0x400620(,%rax,8),%rax *%rax 0x400620: 0x400630: 0x400640: 0x20 0x30 0x40 mov jmpq 0x400620(,%rax,8),%rax *%gs:(%rax) 0x28 0x88 0x48 Rewrite main, printf,..., memcpy,... Invalidates memcpy jump table But rewrite process uses (old) memcpy 70

71 Egalitarian Bootstrapping Problem: transformations break original code e.g. memcpy uses code pointers New memcpy code memcpy s code mov jmpq 0x400620(,%rax,8),%rax *%rax 0x400620: 0x400630: 0x400640: 0x20 0x30 0x40 0x28 0x88 0x48 mov jmpq 0x400620(,%rax,8),%rax *%gs:(%rax)?? Rewrite main, printf,..., memcpy,... Invalidates memcpy jump table But rewrite process uses (old) memcpy 71

72 Egalitarian Bootstrapping Problem: transformations break original code e.g. memcpy uses code pointers Solution: use two copies of Shuffler 72

73 Egalitarian Bootstrapping Problem: transformations break original code e.g. memcpy uses code pointers Solution: use two copies of Shuffler Other libraries C library Program Loader loads Shuffler stage 1 rewrites Shuffler stage 2 73

74 Egalitarian Bootstrapping Problem: transformations break original code e.g. memcpy uses code pointers Solution: use two copies of Shuffler Other libraries C library Program Shuffler stage 1 Loader invokes Shuffler stage 2 74

75 Egalitarian Bootstrapping Problem: transformations break original code e.g. memcpy uses code pointers Solution: use two copies of Shuffler Other libraries C library Program Shuffler stage 1 Loader erases erases Shuffler stage 2 75

76 Egalitarian Bootstrapping Problem: transformations break original code e.g. memcpy uses code pointers Solution: use two copies of Shuffler Make new copies Other libraries Other libraries C library C library Program Program Shuffler stage 2 Shuffler stage 2 76

77 Egalitarian Bootstrapping Problem: transformations break original code e.g. memcpy uses code pointers Solution: use two copies of Shuffler Make new copies Other libraries C library Program Shuffler stage 2 77

78 Egalitarian Bootstrapping Problem: transformations break original code e.g. memcpy uses code pointers Solution: use two copies of Shuffler Make new copies Other libraries Other libraries C library C library Program Program Shuffler stage 2 Shuffler stage 2 78

79 Egalitarian Bootstrapping Problem: transformations break original code e.g. memcpy uses code pointers Solution: use two copies of Shuffler Make new copies Other libraries C library Program Shuffler stage 2 79

80 Outline 1. Continuous re-randomization 2. Accelerating our randomization 3. Binary analysis and egalitarianism 4. Results and Demo 80

81 Performance Evaluation SPEC CPU overhead at 50ms = 14.9% 81

82 Performance Evaluation SPEC CPU overhead at 50ms = 14.9% Multiprocess Nginx up to 24 workers 82

83 Security Evaluation Two disclosure-based attack methodologies: Scan many pages for the desired gadgets impacted by disclosure time, network latency Explore gadget space in small number of pages impacted by ROP chain computation time (> 40 seconds) 83

84 Security Evaluation Two disclosure-based attack methodologies: Scan many pages for the desired gadgets impacted by disclosure time, network latency Explore gadget space in small number of pages impacted by ROP chain computation time (> 40 seconds) Published JIT-ROP takes ms We can re-randomize typically every ms 84

85 Demo 85

86 86

87 Conclusion Continuous re-randomization every ms 87

88 Conclusion Continuous re-randomization every ms Fast: Defeats all known code reuse attacks Asynchronous shuffling offloads overhead Deployable: Binary analysis w/o modifying kernel, compiler,... Egalitarian: No additional privileges required Shuffler defends its own code 88

89 Questions? Demo website:

90 Related Work JIT-ROP, SOSP 2013 Oxymoron, Usenix Sec 2014 Code Pointer Integrity, OSDI 2014 Stabilizer, SIGARCH 2013 Remix, CODASPY 2016 TASR, CCS more related work in our paper [1] [2] 90

91 Future Work Translating stack unwind information Cannot shuffle the loader currently Breaks C++ exceptions, pthread_cancel, etc. Breaks dlopen If shuffling takes too long, no mechanism to pause target program 91

92 Shuffler Thread Performance Asynchronous shuffling runs quickly Synchronous runtime is 0.3% of total runtime 92

93 Scalability Multithreaded program Multiprocess program 1 common Shuffler thread n Shuffler threads Computations unw Computations unw Computations unw Computations unw Computations unw unw unw unw Tradeoff for server workers Multithreaded => better performance overhead Multiprocess => no disclosures across workers Both techniques scale well in practice (up to 24x) 93