Data-Oriented Programming

Transcription

1 Data-Oriented Programming On the Expressiveness of Non-Control Data Attacks Hong Hu, Shweta Shinde, Sendroiu Adrian, Zheng Leong Chua, Prateek Saxena, Zhenkai Liang Department of Computer Science National University of Singapore

2 Control Attacks are Getting Harder 2

3 Control Attacks are Getting Harder CFG Memory space Data Code 3

4 Control Attacks are Getting Harder Code injection CFG Memory space Data Code 4

5 Control Attacks are Getting Harder Code injection Data Execution Prevention CFG Memory space Data Data w/ DEP Code 5

6 Control Attacks are Getting Harder Code injection Data Execution Prevention Code reuse return-to-libc return-oriented programming (ROP) CFG Memory space Data Data w/ DEP Code 6

7 Control Attacks are Getting Harder Code injection Data Execution Prevention Code reuse Control Flow Integrity return-to-libc return-oriented programming (ROP) CFG w/ CFI Memory space Data Data w/ DEP Code 7

8 A New Attack Class Assume: conform to CFI & DEP CFG w/ CFI Memory space Data w/ DEP Code 8

9 A New Attack Class Assume: conform to CFI & DEP Attackers capability on arbitrary vul. programs? Nothing Specific computation Turing-complete CFG w/ CFI Memory space Data w/ DEP Code 9

10 Non-Control Data Attacks Corrupt/leak several bytes of security-critical data 10

11 Non-Control Data Attacks Corrupt/leak several bytes of security-critical data //set root privilege * seteuid(0);... //set normal user privilege seteuid(pw->pw_uid); //execute user s command //offset depends on IE version + safemode = *(DWORD *) (jsobj + offset); if(safemode & 0xB == 0) { Turn_on_God_Mode(); } * Shuo Chen, Jun Xu, Emre C. Sezer, Prachi Gauriar, and Ravishankar K. Iyer. Non-Control-Data Attacks Are Realistic Threats. In USENIX Yang Yu. Write Once, Pwn Anywhere. In Black Hat USA 2014

12 Non-Control Data Attacks Corrupt/leak several bytes of security-critical data //set root privilege * seteuid(0);... //set normal user privilege seteuid(pw->pw_uid); //execute user s command //offset depends on IE version + safemode = *(DWORD *) (jsobj + offset); if(safemode & 0xB == 0) { Turn_on_God_Mode(); } Special cases relying on particular data/functions user id, safemode, private key, etc interpreter printf() (with %n ), etc Nothing Specific computation Turing-complete * Shuo Chen, Jun Xu, Emre C. Sezer, Prachi Gauriar, and Ravishankar K. Iyer. Non-Control-Data Attacks Are Realistic Threats. In USENIX Yang Yu. Write Once, Pwn Anywhere. In Black Hat USA

13 Contributions Non-control data attacks can be Turing-complete 13

14 Contributions Non-control data attacks can be Turing-complete Data-Oriented Programming (DOP) build expressive non-control data attacks independent of any specific data / functions 14

15 Contributions Non-control data attacks can be Turing-complete Data-Oriented Programming (DOP) build expressive non-control data attacks independent of any specific data / functions DOP builds attacks on real-world programs bypass ASLR w/o address leakage simulate a network bot enable code injection 15

16 Motivating Example 1 struct server{int *cur_max, total, typ;} *srv; 2 int quota = MAXCONN; int *size, *type; 3 char buf[maxlen]; 4 size = &buf[8]; type = &buf[12] while (quota--) { 7 readdata(sockfd, buf); // stack bof 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } //...(following code skipped) } Vulnerable Program 16

17 Motivating Example 1 struct server{int *cur_max, total, typ;} *srv; 2 int quota = MAXCONN; int *size, *type; 3 char buf[maxlen]; 4 size = &buf[8]; type = &buf[12] while (quota--) { 7 readdata(sockfd, buf); // stack bof 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } //...(following code skipped) } Vulnerable Program 17

18 Motivating Example 1 struct server{int *cur_max, total, typ;} *srv; 2 int quota = MAXCONN; int *size, *type; 3 char buf[maxlen]; 4 size = &buf[8]; type = &buf[12] while (quota--) { 7 readdata(sockfd, buf); // stack bof 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } //...(following code skipped) } Vulnerable Program 18

19 Motivating Example 1 struct server{int *cur_max, total, typ;} *srv; 2 int quota = MAXCONN; int *size, *type; 3 char buf[maxlen]; 4 size = &buf[8]; type = &buf[12] while (quota--) { 7 readdata(sockfd, buf); // stack bof 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } //...(following code skipped) } Vulnerable Program 1 struct Obj {struct Obj *next; int prop;} 2 3 void updatelist(struct Obj *list, int addend){ 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; 6 } Malicious Computation 19

20 Motivating Example 1 struct server{int *cur_max, total, typ;} *srv; 2 int quota = MAXCONN; int *size, *type; 3 char buf[maxlen]; 4 size = &buf[8]; type = &buf[12] while (quota--) { 7 readdata(sockfd, buf); // stack bof 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } //...(following code skipped) } Vulnerable Program CFG w/ CFI struct Obj {struct Obj *next; int prop;} 2 3 void updatelist(struct Obj *list, int addend){ 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; 6 } Malicious Computation 20

21 Motivating Example 1 struct server{int *cur_max, total, typ;} *srv; 2 int quota = MAXCONN; int *size, *type; 3 char buf[maxlen]; 4 size = &buf[8]; type = &buf[12] while (quota--) { 7 readdata(sockfd, buf); // stack bof 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } //...(following code skipped) } Vulnerable Program CFG w/ CFI struct Obj {struct Obj *next; int prop;} 2 3 void updatelist(struct Obj *list, int addend){ 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; 6 } Malicious Computation 21

22 Motivating Example 1 struct server{int *cur_max, total, typ;} *srv; 2 int quota = MAXCONN; int *size, *type; 3 char buf[maxlen]; 4 size = &buf[8]; type = &buf[12] while (quota--) { 7 readdata(sockfd, buf); // stack bof 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } //...(following code skipped) } Vulnerable Program CFG w/ CFI struct Obj {struct Obj *next; int prop;} 2 3 void updatelist(struct Obj *list, int addend){ 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; 6 } Malicious Computation 22

23 Motivating Example (cont.) 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } 15 } vulnerable program 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; malicious computation simulate? 23

24 Motivating Example (cont.) 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } 15 } vulnerable program 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; malicious computation simulate? Memory space buf[] type size quota srv stack cur_ max total typ 24

25 Motivating Example (cont.) 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } 15 } vulnerable program 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; malicious computation simulate? Memory space buf[] type size quota srv stack list addend cur_ max total typ heap next prop next prop 25

26 Motivating Example (cont.) 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } 15 } vulnerable program 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; malicious computation simulate? Memory space buf[] type size quota srv stack list addend cur_ max total typ heap next prop next prop 26

27 Motivating Example (cont.) 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } 15 } vulnerable program 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; malicious computation simulate? Memory space buf[] type size quota srv stack list addend cur_ max total typ heap next prop next prop 27

28 Motivating Example (cont.) 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } 15 } vulnerable program 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; malicious computation simulate? Memory space buf[] type size quota srv stack list addend cur_ max total typ heap next prop next prop 28

29 Motivating Example (cont.) 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } 15 } vulnerable program 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; malicious computation simulate? Memory space buf[] type size quota srv stack list addend cur_ max total typ heap next prop next prop 29

30 Motivating Example (cont.) 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } 15 } vulnerable program 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; malicious computation simulate? Memory space buf[] type size quota srv stack list addend cur_ max total typ heap next prop next prop 30

31 Motivating Example (cont.) 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } 15 } vulnerable program 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; malicious computation simulate? Memory space buf[] type list size cur_ max addend quota total srv typ cur_ max stack total typ heap next prop next prop 31

32 Motivating Example (cont.) 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } 15 } vulnerable program 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; malicious computation simulate? Memory space buf[] type size quota srv stack list addend cur_ max total typ heap next prop next prop 32

33 Motivating Example (cont.) 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } 15 } vulnerable program 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; malicious computation simulate? Memory space buf[] type size quota srv stack heap list addend cur_ max total typ cur_ max total next prop next prop typ 33

34 Motivating Example (cont.) 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } 15 } vulnerable program 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; malicious computation simulate? Memory space buf[] type size quota srv stack heap list addend cur_ max total typ cur_ max total next prop next prop typ 34

35 Motivating Example (cont.) 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } 15 } vulnerable program 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; malicious computation simulate? Memory space buf[] type size quota srv stack list addend cur_ max total typ heap next prop next prop 35

36 Motivating Example (cont.) 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } 15 } vulnerable program 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; malicious computation simulate? Memory space buf[] type size quota srv stack STREAM list addend cur_ max total typ heap next prop next prop 36

37 Motivating Example (cont.) 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } 15 } vulnerable program 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; malicious computation simulate? Memory space buf[] type size quota srv stack STREAM list addend cur_ max total typ heap next prop next prop 37

38 Motivating Example (cont.) 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } 15 } vulnerable program 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; malicious computation simulate? Memory space buf[] type size quota srv stack STREAM list addend cur_ max total typ heap next prop next prop 38

39 Motivating Example (cont.) 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } 15 } vulnerable program 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; malicious computation simulate? Memory space buf[] type size quota srv stack STREAM heap list cur_ max addend total typ cur_ max total next prop next prop typ 39

40 Motivating Example (cont.) 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } 15 } vulnerable program 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; malicious computation simulate? Memory space buf[] type size quota srv stack STREAM list addend cur_ max total typ heap next prop next prop 40

41 Motivating Example (cont.) 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } 15 } vulnerable program 4 for(; list!= NULL; list = list->next) 5 list->prop += addend; malicious computation simulate Memory space buf[] type size quota srv stack STREAM list addend cur_ max total typ heap next prop next prop 41

42 Data-Oriented Programming A Generic Technique 42

43 Data-Oriented Programming (DOP) General construction w/o dependency on specific data / functions 43

44 Data-Oriented Programming (DOP) General construction w/o dependency on specific data / functions Expressive attacks towards Turing-complete computation 44

45 Data-Oriented Programming (DOP) General construction w/o dependency on specific data / functions Expressive attacks towards Turing-complete computation Elements data-oriented gadgets gadget dispatchers 45

46 Data-Oriented Gadgets x86 instruction sequence show in normal execution (CFI) CFG

47 Data-Oriented Gadgets x86 instruction sequence show in normal execution (CFI) CFG Addition: srv->total += *size; 1 mov (%esi), %ebx //load micro-op 2 mov (%edi), %eax //load micro-op 3 add %ebx, %eax //addition 4 mov %eax, (%edi) //store micro-op 47

48 Data-Oriented Gadgets x86 instruction sequence show in normal execution (CFI) save results in memory load micro-op --> semantics micro-op --> store micro-op CFG Addition: srv->total += *size; 1 mov (%esi), %ebx //load micro-op 2 mov (%edi), %eax //load micro-op 3 add %ebx, %eax //addition 4 mov %eax, (%edi) //store micro-op 48

49 Data-Oriented Gadgets x86 instruction sequence show in normal execution (CFI) save results in memory load micro-op --> semantics micro-op --> store micro-op CFG Addition: srv->total += *size; 1 mov (%esi), %ebx //load micro-op 2 mov (%edi), %eax //load micro-op 3 add %ebx, %eax //addition 4 mov %eax, (%edi) //store micro-op Memory space 49

50 Data-Oriented Gadgets x86 instruction sequence show in normal execution (CFI) save results in memory load micro-op --> semantics micro-op --> store micro-op CFG Addition: srv->total += *size; 1 mov (%esi), %ebx //load micro-op 2 mov (%edi), %eax //load micro-op 3 add %ebx, %eax //addition 4 mov %eax, (%edi) //store micro-op Memory space Load: *size = *(srv ->cur_max); 1 mov (%esi), %ebx //load micro-op 2 mov (%edi), %eax //load micro-op 3 mov 0xb(%ebx), %eax //load 4 mov %eax, (%edx) //store micro-op 50

51 Data-Oriented Gadgets x86 instruction sequence show in normal execution (CFI) save results in memory load micro-op --> semantics micro-op --> store micro-op CFG Addition: srv->total += *size; 1 mov (%esi), %ebx //load micro-op 2 mov (%edi), %eax //load micro-op 3 add %ebx, %eax //addition 4 mov %eax, (%edi) //store micro-op Memory space Load: *size = *(srv ->cur_max); 1 mov (%esi), %ebx //load micro-op 2 mov (%edi), %eax //load micro-op 3 mov 0xb(%ebx), %eax //load 4 mov %eax, (%edx) //store micro-op 51

52 Gadget Dispatcher corruptible by mem-err round1 loop selector round2 round3 roundn 52

53 Gadget Dispatcher corruptible by mem-err round1 loop selector round2 round3 roundn Chain data-oriented gadgets legitimately loop ---> repeatedly invoke gadgets selector ---> selectively activate gadgets 53

54 Gadget Dispatcher corruptible by mem-err round1 loop selector round2 round3 roundn Chain data-oriented gadgets legitimately loop ---> repeatedly invoke gadgets selector ---> selectively activate gadgets 54

55 Gadget Dispatcher corruptible by mem-err round1 loop selector round2 round3 roundn Chain data-oriented gadgets legitimately loop ---> repeatedly invoke gadgets selector ---> selectively activate gadgets 55

56 Gadget Dispatcher corruptible by mem-err round1 loop selector round round3 roundn Chain data-oriented gadgets legitimately loop ---> repeatedly invoke gadgets selector ---> selectively activate gadgets 56

57 Gadget Dispatcher corruptible by mem-err round1 loop selector round round3 roundn Chain data-oriented gadgets legitimately loop ---> repeatedly invoke gadgets selector ---> selectively activate gadgets 57

58 Gadget Dispatcher corruptible by mem-err round1 loop selector round round3 roundn Chain data-oriented gadgets legitimately loop ---> repeatedly invoke gadgets selector ---> selectively activate gadgets 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; // loop // selector 9 if(*type == STREAM) *size = *(srv->cur_max); 10 else{ srv->typ = *type; srv->total += *size; } 14 } 58

59 Turing-completeness DOP emulates a minimal language MINDOP MINDOP is Turing-complete Semantics Statements In C Data-Oriented Gadgets in DOP arithmetic / logical a op b *p op *q assignment a = b *p = *q load a = *b *p = **q store *a = b **p = *q jump goto L vpc = &input conditional jump if (a) goto L vpc = &input if *p p &a; q &b; op any arithmetic / logical operation 59

60 Attack Construction 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } //...(code skipped) } 60

61 Gadget identification Attack Construction 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } //...(code skipped) } statically identify load-semantics-store chain from LLVM IR 61

62 Gadget identification Attack Construction 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } //...(code skipped) } statically identify load-semantics-store chain from LLVM IR Dispatcher identification static identify loops with gadgets from LLVM IR 62

63 Gadget identification Attack Construction 6 while (quota--) { 7 readdata(sockfd, buf); 8 if(*type == NONE ) break; 9 if(*type == STREAM) 10 *size = *(srv->cur_max); 11 else { 12 srv->typ = *type; 13 srv->total += *size; 14 } //...(code skipped) } statically identify load-semantics-store chain from LLVM IR Dispatcher identification static identify loops with gadgets from LLVM IR Gadget stitching select gadgets and dispatchers (manual) check stitchability (manual) 63

64 Evaluation 64

65 Evaluation Feasibility 9 x86 programs with 9 vulnerabilities Nginx, ProFTPD, Wu-FTPD, sshd, Bitcoind, Wireshark, sudo, musl libc, mcrypt 65

66 Evaluation Feasibility 9 x86 programs with 9 vulnerabilities Nginx, ProFTPD, Wu-FTPD, sshd, Bitcoind, Wireshark, sudo, musl libc, mcrypt x86 Gadgets 7518 in total, 1273 reachable via selected CVEs 8 programs can simulate all MINDOP operations x86 Dispatchers 1443 in total, 110 reachable from selected CVEs 66

67 Evaluation Feasibility 9 x86 programs with 9 vulnerabilities Nginx, ProFTPD, Wu-FTPD, sshd, Bitcoind, Wireshark, sudo, musl libc, mcrypt x86 Gadgets 7518 in total, 1273 reachable via selected CVEs 8 programs can simulate all MINDOP operations x86 Dispatchers 1443 in total, 110 reachable from selected CVEs 2 programs can build Turing-complete attack 3 end-to-end attacks 67

68 Case Study: Bypassing Randomization Previous methods information leakage to network Defeat ASLR w/o address leakage to network? 68

69 Case Study: Bypassing Randomization Previous methods information leakage to network Defeat ASLR w/o address leakage to network? Vulnerable ProFTPD use OpenSSL for authentication a dereference chain to the private key 69

70 Case Study: Bypassing Randomization Previous methods information leakage to network Defeat ASLR w/o address leakage to network? Vulnerable ProFTPD use OpenSSL for authentication a dereference chain to the private SSL_CTX * ssl_ctx BN_ULONG * d2 BIGNUM * d1 struct cert_st * cert Private Key struct rsa_st * rsa CERT_PKEY * key EVP_PKEY*privatekey 70

71 Case Study: Bypassing Randomization Gadgets MOV ADD LOAD *p = *q *X = *X + offset *Z = SSL_CTX * ssl_ctx BN_ULONG * d2 BIGNUM * d1 struct cert_st * cert Private Key struct rsa_st * rsa CERT_PKEY * key EVP_PKEY*privatekey 71

72 Case Study: Bypassing Randomization Gadgets Dispatcher MOV ADD LOAD while (1) { user_request = get_user_request(); dispatch(user_request); } *p = *q *X = *X + offset *Z = **Y func1() { memory_error; MOV;} func2() { ADD; } func3() { LOAD; SSL_CTX * ssl_ctx BN_ULONG * d2 BIGNUM * d1 struct cert_st * cert Private Key struct rsa_st * rsa CERT_PKEY * key EVP_PKEY*privatekey 72

73 Case Study: Bypassing Randomization MOV ADD MOV LOAD MOV *X = *0x080dbc28 (ssl_ctx) *X = *X + offset1 *Y = *X *Z = **Y *0x080dbc28 = *Z SSL_CTX * ssl_ctx BN_ULONG * d2 BIGNUM * d1 struct cert_st * cert Private Key struct rsa_st * rsa CERT_PKEY * key EVP_PKEY*privatekey 73

74 Case Study: Bypassing Randomization MOV ADD MOV LOAD MOV *X = *0x080dbc28 (ssl_ctx) *X = *X + offset1 *Y = *X *Z = **Y *0x080dbc28 = *Z ssl_ctx SSL_CTX * ssl_ctx BN_ULONG * d2 BIGNUM * d1 struct cert_st * cert Private Key struct rsa_st * rsa CERT_PKEY * key EVP_PKEY*privatekey 74

75 Case Study: Bypassing Randomization MOV ADD MOV LOAD MOV *X = *0x080dbc28 (ssl_ctx) *X = *X + offset1 *Y = *X *Z = **Y *0x080dbc28 = *Z SSL_CTX * ssl_ctx BN_ULONG * d2 BIGNUM * d1 struct cert_st * cert Private Key struct rsa_st * rsa CERT_PKEY * key EVP_PKEY*privatekey 75

76 Case Study: Bypassing Randomization MOV ADD MOV LOAD MOV *X = *0x080dbc28 (ssl_ctx) *X = *X + offset1 *Y = *X *Z = **Y *0x080dbc28 = *Z d2 buf write(outsock, buf, SSL_CTX * ssl_ctx BN_ULONG * d2 BIGNUM * d1 struct cert_st * cert Private Key struct rsa_st * rsa CERT_PKEY * key EVP_PKEY*privatekey 76

77 Case Study: Bypassing Randomization MOV ADD MOV LOAD MOV *X = *0x080dbc28 (ssl_ctx) *X = *X + offset1 *Y = *X *Z = **Y *0x080dbc28 = *Z d2 buf write(outsock, buf, SSL_CTX * ssl_ctx BN_ULONG * d2 BIGNUM * d1 struct cert_st * cert Private Key struct rsa_st * rsa CERT_PKEY * key EVP_PKEY*privatekey 77

78 Case Study: Bypassing Randomization MOV ADD MOV LOAD MOV *X = *0x080dbc28 (ssl_ctx) *X = *X + offset1 *Y = *X *Z = **Y *0x080dbc28 = *Z d2 buf write(outsock, buf, strlen(buf)); leak private key to SSL_CTX * ssl_ctx BN_ULONG * d2 BIGNUM * d1 struct cert_st * cert Private Key struct rsa_st * rsa CERT_PKEY * key EVP_PKEY*privatekey 78

79 dlopen() Dynamic Linking Interface Load the dynamic library into memory space resolve symbols based on binary metadata patch program due to relocation like LoadLibrary() on Windows 79

80 dlopen() Dynamic Linking Interface Load the dynamic library into memory space resolve symbols based on binary metadata patch program due to relocation like LoadLibrary() on Windows Dynamic loader can do arbitrary computation * exec() RTLD start() sysexec ld.so bin START() bin ld.so libc.so file access before run * R. Shapiro, S. Bratus, and S. W. Smith, Weird Machines in ELF: A Spotlight on the Underappreciated Metadata, in WOOT

81 dlopen() Dynamic Linking Interface Load the dynamic library into memory space resolve symbols based on binary metadata patch program due to relocation like LoadLibrary() on Windows Dynamic loader can do arbitrary computation * exec() RTLD start() sysexec ld.so bin START() bin ld.so libc.so file access before run The same to dlopen() * R. Shapiro, S. Bratus, and S. W. Smith, Weird Machines in ELF: A Spotlight on the Underappreciated Metadata, in WOOT

82 Case Study: Simulating A Network Bot Attacks with dlopen dlopen() { head } dynamic library list link_map 82

83 Case Study: Simulating A Network Bot Attacks with dlopen send malicious payload dlopen() { head } dynamic library list link_map ProFTPD s memory Malicious payload 83

84 Case Study: Simulating A Network Bot Attacks with dlopen send malicious payload corrupt link list & call dlopen dlopen() { head } dynamic library list link_map ProFTPD s memory Malicious payload 84

85 Case Study: Simulating A Network Bot Attacks with dlopen send malicious payload invalid input corrupt link list & call dlopen dlopen() { head } dynamic library list link_map ProFTPD s memory Malicious payload 85

86 Case Study: Simulating A Network Bot Attacks with dlopen send malicious payload invalid input corrupt link list & call dlopen no call to dlopen dlopen() { head } dynamic library list link_map ProFTPD s memory Malicious payload 86

87 Case Study: Simulating A Network Bot dlopen DOP attack allows addresses arbitrary the computation problems send malicious payload invalid input corrupt link list & call dlopen no call to dlopen dlopen() { head } dynamic library list link_map ProFTPD s memory Malicious payload 87

88 Case Study: Simulating A Network Bot dlopen DOP attack allows addresses arbitrary the computation problems send construct malicious payload payload in memory invalid input corrupt link list & call dlopen no call to dlopen dlopen() { head } dynamic library list link_map ProFTPD s memory Malicious payload (1) Payload prepare MOV MOV 88

89 Case Study: Simulating A Network Bot dlopen DOP attack allows addresses arbitrary the computation problems send construct malicious payload payload in memory invalid input corrupt link list & call dlopen no call to dlopen dlopen() { head } dynamic library list link_map ProFTPD s memory Malicious payload (1) Payload prepare MOV MOV 89

90 Case Study: Simulating A Network Bot dlopen DOP attack allows addresses arbitrary the computation problems send construct malicious payload payload in memory invalid input force corrupt call link to dlopen list & call dlopen no call to dlopen if (flag) { dlopen() { head } } dynamic library list link_map ProFTPD s memory Malicious payload (1) Payload prepare MOV MOV 90

91 Case Study: Simulating A Network Bot dlopen DOP attack allows addresses arbitrary the computation problems send construct malicious payload payload in memory invalid input force corrupt call link to dlopen list & call dlopen no call to dlopen if (flag) { dlopen() { head } } ProFTPD s memory Malicious payload dynamic library list link_map (2) Trigger MOV STORE (1) Payload prepare MOV MOV 91

92 Case Study: Simulating A Network Bot dlopen DOP attack allows addresses arbitrary the computation problems send construct malicious payload payload in memory invalid input force corrupt call link to dlopen list & call dlopen no call to dlopen if (flag) { dlopen() { head } } ProFTPD s memory Malicious payload dynamic library list link_map (2) Trigger MOV STORE (1) Payload prepare MOV MOV > 700 requests 92

93 Case Study: Altering Memory Permissions Defenses based on memory permissions DEP: non-writable code CFI: non-writable jump tags 93

94 Case Study: Altering Memory Permissions Defenses based on memory permissions DEP: non-writable code CFI: non-writable jump tags dlopen(): relocation change any page permission to writable update page content change the permission back 94

95 Case Study: Altering Memory Permissions Defenses based on memory permissions DEP: non-writable code CFI: non-writable jump tags dlopen(): relocation change any page permission to writable update page content change the permission back DOP attacks dlopen(code_addr, shellcode) 95

96 Case Study: Altering Memory Permissions Defenses based on memory permissions DEP: non-writable code CFI: non-writable jump tags dlopen(): relocation change any page permission to writable update page content change the permission back DOP attacks dlopen(code_addr, shellcode) Code injection is back! 96

97 Related Work Techniques Non-control Data Attacks (Chen et al. 2005) Turing Complete? Preserve CFI? Independent of specific data / funcs? COOP (Schuster et al. 2015) FlowStitch (Hu et al. 2015) Printf-Oriented Programming (Carlini et al. 2015) Control Jujustu (Evans et al. 2015) Data-Oriented Programming 97

98 Potential Defenses Memory Safety e.g., Cyclone (Jim et al. 2002), CCured (Necula et al. 2002), SoftBounds+CETS (Nagarakatte et al. 2009, 2010) high performance overhead (> 100%) Data-flow Integrity e.g, DFI (Castro et al. 2006), kernel DFI (Song et al. 2016) Fined-grained randomization in data space e.g., DSR (Bhatkar et al. 2008) Hardware & software fault isolation e.g., HDFI (Song et al. 2016), MPX 98

99 Potential Defenses Memory Safety e.g., Cyclone (Jim et al. 2002), CCured (Necula et al. 2002), SoftBounds+CETS (Nagarakatte et al. 2009, 2010) high performance overhead (> 100%) Data-flow Integrity e.g, DFI (Castro et al. 2006), kernel DFI (Song et al. 2016) Fined-grained randomization in data space e.g., DSR (Bhatkar et al. 2008) Hardware & software fault isolation e.g., HDFI (Song et al. 2016), MPX No practical defenses yet! 99

100 Conclusion Non-control data attacks can be Turing-complete 100

101 Conclusion Non-control data attacks can be Turing-complete Data-Oriented Programming (DOP) build expressive non-control data attacks independent of specific data / functions 101

102 Conclusion Non-control data attacks can be Turing-complete Data-Oriented Programming (DOP) build expressive non-control data attacks independent of specific data / functions In real-world programs, DOP can build attacks bypass ASLR w/o address leakage simulate a network bot enable code injection 102

103 Thanks! Hong Hu Non-control data attacks are available