Data-Oriented Programming: On the Expressiveness of Non-control Data Attacks

Data-Oriented Programming: On the Expressiveness of Non-control Data Attacks

As control-flow hijacking defenses gain adoption, it is important to understand the remaining capabilities of adversaries via memory exploits. Non-control data exploits are used to mount information leakage attacks or privilege escalation attacks program memory. Compared to control-flow hijacking at...

Full description

Saved in:
Bibliographic Details
Published in:2016 IEEE Symposium on Security and Privacy (SP) pp. 969 - 986
Main Authors: Hong Hu, Shinde, Shweta, Adrian, Sendroiu, Zheng Leong Chua, Saxena, Prateek, Zhenkai Liang
Format: Conference Proceeding Journal Article
Language:English
Published: IEEE 01-05-2016
Subjects:
Browsers
Computer information security
Computer simulation
Construction
Dopants
Gain
Linux
Payloads
Privacy
Programming
Randomization
Security
Servers
Systematics
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:As control-flow hijacking defenses gain adoption, it is important to understand the remaining capabilities of adversaries via memory exploits. Non-control data exploits are used to mount information leakage attacks or privilege escalation attacks program memory. Compared to control-flow hijacking attacks, such non-control data exploits have limited expressiveness, however, the question is: what is the real expressive power of non-control data attacks? In this paper we show that such attacks are Turing-complete. We present a systematic technique called data-oriented programming (DOP) to construct expressive non-control data exploits for arbitrary x86 programs. In the experimental evaluation using 9 programs, we identified 7518 data-oriented x86 gadgets and 5052 gadget dispatchers, which are the building blocks for DOP. 8 out of 9 real-world programs have gadgets to simulate arbitrary computations and 2 of them are confirmed to be able to build Turing-complete attacks. We build 3 end-to-end attacks to bypass randomization defenses without leaking addresses, to run a network bot which takes commands from the attacker, and to alter the memory permissions. All the attacks work in the presence of ASLR and DEP, demonstrating how the expressiveness offered by DOP significantly empowers the attacker.
Bibliography:ObjectType-Article-2
SourceType-Scholarly Journals-1
ObjectType-Conference-1
ObjectType-Feature-3
content type line 23
SourceType-Conference Papers & Proceedings-2
ISSN:2375-1207
DOI:10.1109/SP.2016.62