Randomization-based Defenses against Data-Oriented Attacks

For nearly two decades now, the vast majority of critical software vulnerabilities have been memory corruption bugs in C and C++ programs[13, 14]. Attackers often exploit these bugs using control-flow hijacking techniques to seize control over vulnerable programs. This allows them to execute arbitrary code, exfiltrate sensitive data, or escalate the programs' privileges. However, thanks to the successful rollout of mitigations such as control-flow integrity and shadow stacks,[5] it is becoming increasingly harder to mount control-flow attacks. Inevitably, attackers will have to shift towards other attack techniques such as data-oriented programming (DOP). DOP attacks can alter a program's behavior without causing it to diverge from its legal control-flow paths, and were shown to be potent, expressive, and highly automatable [7, 8, 10-12]. Moreover, none of the widely deployed mitigations are effective at stopping DOP attacks, while many proposed mitigations incur prohibitively high overhead. In this talk, we will discuss two promising classes of moving target defenses that are highly effective at thwarting DOP attacks: Data Space Randomization (DSR)[2, 3, 6, 15] and Multi-Variant Execution Environments (MVEEs) [9, 16]. DSR uses compile-time analyses and transformations to partition program data into equivalence classes based on aliasing relationships, and to encrypt all data with the random xor mask assigned to the equivalence class the data belongs to. DSR makes the outcome of DOP attacks unpredictable. MVEEs can provide even stronger protection by running multiple diversified variants of the same program in parallel on the same inputs. If these variants use different data layouts or representations, it becomes highly unlikely that a DOP attack will succeed. Our discussion will cover the design, performance characteristics, effectiveness, and limitations of several implementations of DSR and MVEEs.