The Age of Data: Pinpointing Guilty Bytes in Polymorphic Buffer Overflows on Heap or Stack

Heap and stack buffer overflows are still among the most common attack vectors in intrusion attempts. In this paper, we ask a simple question that is surprisingly difficult to answer: which bytes contributed to the overflow? By careful observation of all scenarios that may occur in overflows, we ide...

Ausführliche Beschreibung

Gespeichert in:
Bibliographische Detailangaben
Veröffentlicht in:Twenty-Third Annual Computer Security Applications Conference (ACSAC 2007) S. 487 - 500
Hauptverfasser: Slowinska, A., Bos, H.
Format: Tagungsbericht
Sprache:Englisch
Veröffentlicht: IEEE 01.12.2007
Schlagworte:
Application software
Asia
Buffer overflow
Computer security
Data security
Fingerprint recognition
Humans
Intrusion detection
Power generation
Protocols
ISBN:0769530605, 9780769530604
ISSN:1063-9527
Online-Zugang:Volltext
Tags: Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
Beschreibung
Zusammenfassung:Heap and stack buffer overflows are still among the most common attack vectors in intrusion attempts. In this paper, we ask a simple question that is surprisingly difficult to answer: which bytes contributed to the overflow? By careful observation of all scenarios that may occur in overflows, we identified the information that needs to be tracked to pinpoint the offending bytes. There are many reasons why this is a hard problem. For instance, by the time an overflow is detected some of the bytes may already have been overwritten, creating gaps. Additionally, it is hard to tell the offending bytes apart from unrelated network data. In our solution, we tag data from the network with an age stamp whenever it is written to a buffer. Doing so allows us to distinguish between different bytes and ignore gaps, and provide precise analysis of the offending bytes. By tracing these bytes to protocol fields, we obtain accurate signatures that cater to polymorphic attacks.
ISBN:0769530605
9780769530604
ISSN:1063-9527
DOI:10.1109/ACSAC.2007.32