Quantitative Assessment on the Limitations of Code Randomization for Legacy Binaries

Pei Wang, Jinquan Zhang, Shuai Wang, Dinghao Wu

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Software development and deployment are generally fast-pacing practices, yet to date there is still a significant amount of legacy software running in various critical industries with years or even decades of lifespans. As the source code of some legacy software became unavailable, it is difficult for maintainers to actively patch the vulnerabilities, leaving the outdated binaries appealing targets of advanced security attacks. One of the most powerful attacks today is code reuse, a technique that can circumvent most existing system-level security facilities. While there have been various countermeasures against code reuse, applying them to sourceless software appears to be exceptionally challenging. Fine-grained code randomization is considered to be an effective strategy to impede modern code-reuse attacks. To apply it to legacy software, a technique called binary rewriting is employed to directly reconstruct binaries without symbol or relocation information. However, we found that current rewriting-based randomization techniques, regardless of their designs and implementations, share a common security defect such that the randomized binaries may remain vulnerable in certain cases. Indeed, our finding does not invalidate fine-grained code randomization as a meaningful defense against code reuse attacks, for it significantly raises the bar for exploits to be successful. Nevertheless, it is critical for the maintainers of legacy software systems to be aware of this problem and obtain a quantitative assessment of the risks in adopting a potentially incomprehensive defense. In this paper, we conducted a systematic investigation into the effectiveness of randomization techniques designed for hardening outdated binaries. We studied various state-of-The-Art, fine-grained randomization tools, confirming that all of them can leave a certain part of the retrofitted binary code still reusable. To quantify the risks, we proposed a set of concrete criteria to classify gadgets immune to rewriting-based randomization and investigated their availability and capability.

Original languageEnglish (US)
Title of host publicationProceedings - 5th IEEE European Symposium on Security and Privacy, Euro S and P 2020
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages1-16
Number of pages16
ISBN (Electronic)9781728150871
DOIs
StatePublished - Sep 2020
Event5th IEEE European Symposium on Security and Privacy, Euro S and P 2020 - Virtual, Genoa, Italy
Duration: Sep 7 2020Sep 11 2020

Publication series

NameProceedings - 5th IEEE European Symposium on Security and Privacy, Euro S and P 2020

Conference

Conference5th IEEE European Symposium on Security and Privacy, Euro S and P 2020
CountryItaly
CityVirtual, Genoa
Period9/7/209/11/20

All Science Journal Classification (ASJC) codes

  • Artificial Intelligence
  • Computer Networks and Communications
  • Hardware and Architecture
  • Software
  • Safety, Risk, Reliability and Quality
  • Information Systems and Management

Fingerprint Dive into the research topics of 'Quantitative Assessment on the Limitations of Code Randomization for Legacy Binaries'. Together they form a unique fingerprint.

Cite this