On the Effectiveness of NX, SSP, RenewSSP, and ASLR against Stack Buffer Overflows

Stack Smashing Protector (SSP), Address-Space Layout Randomization (ASLR) and Non-executable (NX) are techniques for defending systems against buffer overflow attacks but not limited to them. These mechanism are available in modern operating systems like Android, GNU/Linux and Windows. Unfortunately...

Celý popis

Uložené v:
Podrobná bibliografia
Vydané v:2014 IEEE 13th International Symposium on Network Computing and Applications s. 145 - 152
Hlavní autori: Gisbert, Hector Marco, Ripoll, Ismael
Médium: Konferenčný príspevok..
Jazyk:English
Vydavateľské údaje: IEEE 01.08.2014
Predmet:
Computer crashes
Entropy
Force
Layout
Libraries
Payloads
Servers
On-line prístup:Získať plný text
Tagy: Pridať tag
Žiadne tagy, Buďte prvý, kto otaguje tento záznam!
Popis
Shrnutí:Stack Smashing Protector (SSP), Address-Space Layout Randomization (ASLR) and Non-executable (NX) are techniques for defending systems against buffer overflow attacks but not limited to them. These mechanism are available in modern operating systems like Android, GNU/Linux and Windows. Unfortunately, to keep up with the rapidly evolving landscape of cyber-security it is necessary to reassess the effectiveness of these protection techniques to avoid a false sense of security. This paper assess the effectiveness of these techniques against stack buffer overflow exploitation. Our study indicates that the SSP technique is the most effective against stack buffer overflows. On forking servers, the ASLR technique is almost useless on 32-bit architectures due to the limited entropy provided by the size of the address space. The recently proposed technique Renew SSP, which is an improvement of the well known SSP, outperforms the original SSP in all the cases, it is highly effective against the dangerous byte-for-byte attack and on systems with low secret entropy as x86 and ARM.
DOI:10.1109/NCA.2014.28