面向缓解机制评估的自动化信息泄露方法

自动生成漏洞利用样本(AEG)已成为评估漏洞的最重要的方式之一,但现有方案在目标系统部署有漏洞缓解机制时受到很大阻碍.当前主流的操作系统默认部署多种漏洞缓解机制,包括数据执行保护(DEP)和地址空间布局随机化(ASLR)等,而现有AEG方案仍无法面对所有漏洞缓解情形.提出了一种自动化方案EoLeak,可以利用堆漏洞实现自动化的信息泄露,进而同时绕过数据执行保护和地址空间布局随机化防御.EoLeak通过动态分析漏洞触发样本(POC)的程序执行迹,对执行迹中的内存布局进行画像并定位敏感数据(如代码指针),进而基于内存画像自动构建泄漏敏感数据的原语,并在条件具备时生成完整的漏洞利用样本.实现了EoLeak原型系统,并在一组夺旗赛(CTF)题目和多个实际应用程序上进行了实验验证.实验结果表明,该系统具有自动化泄露敏感信息和绕过DEP及ASLR缓解机制的能力.     

基于内存的漏洞缓解关键技术研究

随着漏洞挖掘技术日渐成熟,每年新增漏洞数量逐步增加。从操作系统以及编译器层面来说,为了提高内存保护的安全性,对抗漏洞利用的缓解措施也在不断完善。文章介绍了近年来比较成熟的基于内存的漏洞关键缓解技术,包括GS编译选项技术、SEH安全校验机制、堆数据保护机制、DEP技术以及ASLR技术。GS编译选项技术和SEH安全校验机制能够有效遏制针对栈数据的攻击;堆数据保护机制为堆溢出增加了更多限制;DEP技术能够对内存执行额外检查以防止恶意代码在系统中执行;ASLR技术通过对关键地址的随机化使一些堆栈溢出手段失效。文章还指出了这些防护措施所存在的不足,并据此从攻击者的角度介绍了针对这几种缓解措施的攻击思路。针对漏洞缓解技术,文章指出未来必须考虑的是如何弥补在抵御复合向量攻击方面的不足,如何完善旁路保护。     

IE浏览器防攻击关键技术分析

软件漏洞带来的危害性日益增强.为了增加攻击者攻击的难度,Windows操作系统逐渐从操作系统层面上提供对DEP(数据执行保护)和ASLR(地址空间随机化)等安全机制的支持,其他应用软件可方便地应用这些保护机制.IE浏览器也不例外.不过由于各方面的原因,IE浏览器上的保护机制存在着各种各样的绕过方式.文章着重分析了其中的DEP和ASLR保护机制的原理及其绕过方式,并通过实例演示了堆扩散攻击和ROP编程.     

HSP: A solution against heap sprays

Heap sprays are a new buffer overflow attack (BOA) form that can significantly increase the successful chance of a BOA even though the attacked process is protected by a lot of state-of-the-art anti-BOA mechanisms, such as ASLR, non-executable stack/DEP, signature-based IDSes, and type-safe languages. In this paper, we propose a glibc-and-ASLR-based solution to heap sprays—Heap Spray Protector (HSP). HSP controls the number and location of int 80 instructions in a process and hides the whereabouts of the only legal int 80 instruction; hence, HSP makes it difficult for attackers to issue a system call, let alone a heap spray attack. Moreover HSP can help ASLR defend against memory information leaking attacks. Furthermore, because HSP only modifies the glibc library and the kernel, it does not need to modify any source code or executable file. Finally, HSP allows attackers to execute as much code as possible before an attack can really create some damage; therefore, it enables the attacked hosts to collect more information about attackers which may be useful to block future attacks. Experimental results show HSP implemented on a Linux platform can effectively defend a system against heap sprays with less than 4.56% performance overhead.     

Windows内存防护机制及其脆弱性分析

内存溢出漏洞及其利用对计算机和网络安全构成了极大威胁。逐一分析Windows系统对栈、堆防护机制、数据执行保护和地址随机加载机制的设计和实现,测试了Windows Vista环境下绕过这些防护机制方法的可能性,指出无安全编译的软件使用已成为系统安全的短板;最后讨论了更全面提高系统安全性的改进方案。     

Windows下缓冲区溢出保护机制及绕过技术

综述当前Windows平台下主要的缓冲区溢出保护机制,该保护机制的绕过技术可以提高漏洞分析与利用的成功率及操作系统的安全性。介绍当前主要的缓冲区溢出保护机制的绕过技术的发展现状。针对堆栈溢出及数据执行保护(DEP)机制的突破技术,分别给出突破原理和方法。通过实验验证了DEP突破技术的有效性。     

Glibc堆利用的若干方法

内存中的攻击与防御一直是系统安全领域的重要研究课题之一,而堆内存破坏漏洞利用以及防护以其特殊的性质在这场宏大的攻防战中扮演着十分独特的角色。由于堆内存粒度细的缘故,众多系统级的防御难以起到良好的效果。同时,堆内存因受运行时输入影响,行为表现难以预测,也给破坏的侦测增加了难度。本文收集了近年来堆内存攻防领域的优秀博文与论文,回顾了早期的glibc堆利用方法以及之后glibc与系统针对它们的修复方式。之后,本文介绍了近年来流行的针对glibc堆的现代利用方法以及它们绕过系统保护的方式。最后,本文根据所有的利用方法进行了堆利用特点的总结与梳理,针对它们的特性提出相应的减缓措施,并预测了未来堆攻防博弈发展可能的趋势。     

Beyond stack smashing: recent advances in exploiting buffer overruns

Security vulnerabilities related to buffer overruns account for the largest share of CERT advisories, as well as high-profile worms - from the original Internet Worm in 1987 through Blaster's appearance in 2003. When malicious crackers discover a vulnerability, they devise exploits that take advantage of the vulnerability to attack a system. The article describes three powerful general-purpose families of exploits for buffer overruns: arc injection, pointer subterfuge, and heap smashing. These new techniques go beyond the traditional "stack smashing" attack and invalidate traditional assumptions about buffer overruns.     

Windows 7安全启动技术分析

分析Windows 7中的安全启动技术,研究基于可信计算的BitLocker驱动器加密的启动流程。针对实现过程中存在的BitLocker、Bootmgr安全隐患,设计BitLocker、Bootmgr绕过方案以及地址空间格局随机化的应对方案,验证了Windows 7的安全启动保护措施仍可能被Bootkit等恶意软件攻破。     

TaintPoint:使用活跃轨迹高效挖掘污点风格漏洞

覆盖反馈的灰盒Fuzzing已经成为漏洞挖掘最有效的方式之一.广泛使用的边覆盖是一种控制流信息,然而在面向污点风格(taint-style)的漏洞挖掘时,这种反馈信息过于粗糙.大量污点无关的种子被加入队列,污点相关的种子数量又过早收敛,导致Fuzzing失去进化方向,无法高效测试Source和Sink之间的信息流.首先,详细分析了现有反馈机制在检测污点风格漏洞时不够高效的原因;其次,提出了专门用于污点风格漏洞挖掘的模糊器TaintPoint.TaintPoint在控制流轨迹的基础上加入了活跃污点这一数据流信息,形成活跃轨迹(livetrace)作为覆盖反馈,并围绕活跃轨迹分别在插桩、种子过滤、选择和变异阶段改进现有方法.在UAFBench上的实验结果表明:TaintPoint检测污点风格漏洞的效率、产出和速度优于业界领先的通用模糊器AFL++及定向模糊器AFLGO;此外,在两个开源项目上发现了4个漏洞并被确认.     

Protecting Against Address Space Layout Randomisation （ASLR） Compromises and Return-to-Libc Attacks Using Network Intrusion Detection Systems

Writable XOR executable (W⊕X) and address space layout randomisation (ASLR) have elevated the understanding necessary to perpetrate buffer overflow exploits[1]. However, they have not proved to be a panacea[1–3], and so other mechanisms, such as stack guards and prelinking, have been introduced. In this paper, we show that host-based protection still does not offer a complete solution. To demonstrate the protection inadequacies, we perform an over the network brute force return-to-libc attack against a preforking concurrent server to gain remote access to a shell. The attack defeats host protection including W⊕X and ASLR. We then demonstrate that deploying a network intrusion detection systems (NIDS) with appropriate signatures can detect this attack efficiently.     

Vista的抵御缓冲区溢出攻击技术研究*

缓冲区溢出攻击是一种在互联网时代被广泛利用并危害严重的主要攻击方式。分析了缓冲区溢出攻击的基本原理,总结了缓冲区溢出攻击的关键步骤,并研究分析了Windows Vista的抵御缓冲区溢出攻击的四种关键技术,包括地址空间配置随机化(ASLR)、数据执行保护（DEP）、GS栈保护和安全（structured exception handling, SEH）等技术;最后对Windows Vista抵御缓冲区溢出的整体效果进行了分析,指出了Vista仍然不能完全抵御缓冲区溢出攻击。     

SeBROP: blind ROP attacks without returns

Currently, security-critical server programs are well protected by various defense techniques, such as Address Space Layout Randomization(ASLR), eXecute Only Memory(XOM), and Data Execution Prevention(DEP), against modern code-reuse attacks like Return-oriented Programming(ROP) attacks. Moreover, in these victim programs, most syscall instructions lack the following ret instructions, which prevents attacks to stitch multiple system calls to implement advanced behaviors like launching a remote shell. Lacking this kind of gadget greatly constrains the capability of code-reuse attacks. This paper proposes a novel code-reuse attack method called Signal Enhanced Blind Return Oriented Programming(SeBROP) to address these challenges. Our SeBROP can initiate a successful exploit to server-side programs using only a stack overflow vulnerability. By leveraging a side-channel that exists in the victim program, we show how to find a variety of gadgets blindly without any pre-knowledges or reading/disassembling the code segment. Then, we propose a technique that exploits the current vulnerable signal checking mechanism to realize the execution flow control even when ret instructions are absent. Our technique can stitch a number of system calls without returns, which is more superior to conventional ROP attacks. Finally, the SeBROP attack precisely identifies many useful gadgets to constitute a Turing-complete set. SeBROP attack can defeat almost all state-of-the-art defense techniques. The SeBROP attack is compatible with both modern 64-bit and 32-bit systems. To validate its effectiveness, We craft three exploits of the SeBROP attack for three real-world applications, i.e., 32-bit Apache 1.3.49, 32-bit ProFTPD 1.3.0, and 64-bit Nginx 1.4.0. Experimental results demonstrate that the SeBROP attack can successfully spawn a remote shell on Nginx, ProFTPD, and Apache with less than 8500/4300/2100 requests, respectively.     

基于动态行为分析的网页木马检测方法

网页木马是一种在网页中插入攻击脚本,利用浏览器及其插件中的漏洞,使受害者的系统静默地下载并安装恶意程序的攻击形式.本文结合动态程序分析和机器学习方法,提出了基于动态行为分析的网页木马检测方法.首先,针对网页木马攻击中的着陆页上的攻击脚本获取行为,监控动态执行函数执行,包括动态生成函数执行、脚本插入、页面插入和URL跳转,并根据一套规则提取这些行为,此外提取与其相关的字符串操作记录作为特征.其次,针对利用堆恶意操作注入shellcode的行为,提出堆危险指标作为特征.最后从Alexa和VirusShare收集了500个网页样本作为数据集,用机器学习方法训练分类模型.实验结果表明：与现有方法相比,文中方法具有准确率高（96.94%）、能有效对抗代码混淆的干扰（较低的误报率6.1%和漏报率1.3%）等优点.     

面向漏洞类型的Crash分类研究

Crash（程序崩溃）分析是漏洞挖掘与利用的关键阶段，判定Crash是由何种类型漏洞产生的是进行Crash分析和漏洞利用的前提。针对现有漏洞检测平台无法有效识别Crash类型的问题，提出一种二进制可执行程序漏洞检测和Crash类型判定的方法。该方法通过对二进制可执行程序Fuzz出的Crash进行污点标记，在污点传播阶段兼顾污点清除、间接污染等污点传播规则，在污点检查阶段通过收集崩溃点上下文信息，匹配多种漏洞触发规则。基于上述方法开发出对二进制程序漏洞检测和判定Crash所属漏洞类型的原型系统，实验结果表明，该方法适用于栈溢出、格式化字符串、堆溢出等漏洞导致的覆盖返回地址、函数指针等模式，具有较高准确率。     

Threat-driven modeling and verification of secure software using aspect-oriented Petri nets

Design-level vulnerabilities are a major source of security risks in software. To improve trustworthiness of software design, this paper presents a formal threat-driven approach, which explores explicit behaviors of security threats as the mediator between security goals and applications of security features. Security threats are potential attacks, i.e., misuses and anomalies that violate the security goals of systems' intended functions. Security threats suggest what, where, and how security features for threat mitigation should be applied. To specify the intended functions, security threats, and threat mitigations of a security design as a whole, we exploit aspect-oriented Petri nets as a unified formalism. Intended functions and security threats are modeled by Petri nets, whereas threat mitigations are modeled by Petri net-based aspects due to the incremental and crosscutting nature of security features. The unified formalism facilitates verifying correctness of security threats against intended functions and verifying absence of security threats from integrated functions and threat mitigations. As a result, our approach can make software design provably secured from anticipated security threats and, thus, reduce significant design-level vulnerabilities. We demonstrate our approach through a systematic case study on the threat-driven modeling and verification of a real-world shopping cart application.     

Windows7操作系统关键内存防攻击研究

GS Stack Protection、SafeSEH、Heap Protection、DEP、ASLR技术是Windows 7操作系统内存保护机制的关键技术,这五种技术对缓解缓冲区溢出攻击起到显著作用.文章以对Windows 7的内存保护机制的原理分析为基础,测试了Windows 7环境下绕过这些保护机制的可能性;最后对Windows 7内存保护机制抵御缓冲区溢出攻击的整体效果进行了分析,指出Windows7仍然不能完全抵御缓冲区溢出攻击,并讨论了更全面提高系统安全性的改进方案.     

结合容错攻击和内存区域统计的ASLR绕过方法

ASLR是防御漏洞攻击的重要保护机制，而容错攻击是绕过ASLR的主要方法之一，即利用容错机制重复尝试搜索内存中的敏感信息。针对目前容错攻击的搜索算法耗时长导致实用性不强的问题，提出了一种结合容错攻击和内存区域统计的ASLR绕过方法。通过软件逆向深入分析容错攻击的原理，包括操作系统和浏览器等软件的容错机制内部实现和容错攻击实现方法；分析进程内存空间分布，统计不同区域的系统DLL分布的平均比例，选定最大概率内存区域搜索DLL并定位关键基址，从而绕过ASLR保护，实验结果证明该方法相对现有方法极大缩短了平均耗时和最大耗时，提高了容错攻击的实用性；探讨了容错攻击更多的应用前景。     

基于约束分析与模型检测的代码安全漏洞检测方法研究

与传统的程序分析相比,模型检测具有较高的检测精度,但无法将其直接应用于缓冲区溢出、代码注入等安全漏洞的检测.为解决此问题,提出了基于约束分析与模型检测相结合的安全漏洞自动检测方法.首先,通过约束分析跟踪代码中缓冲区的信息,在涉及缓冲区操作的危险点生成相应的属性传递和属性约束语句,并将安全漏洞检测问题转化为模型检测方法可接受的可达性检测问题.然后,采用模型检测方法对安全漏洞的可达性进行判断.同时采用程序切片技术,以减少状态空间.对6个开源软件的检测结果表明,基于该方法实现的CodeAuditor原型系统发现了18个新漏洞,误报率为23％.对minicom的切片实验显示,检测性能有较大提高.