Advanced

eavesROP: Listening for ROP Payloads in Data Streams

Jämthagen, Christopher LU ; Karlsson, Linus LU ; Stankovski, Paul LU and Hell, Martin LU (2014) ISC 2014 In Lecture Notes in Computer Science 8783. p.413-424
Abstract
We consider the problem of detecting exploits based on

return-oriented programming. In contrast to previous works we investigate

to which extent we can detect ROP payloads by only analysing

streaming data, i.e., we do not assume any modifications to the target

machine, its kernel or its libraries. Neither do we attempt to execute any

potentially malicious code in order to determine if it is an attack. While

such a scenario has its limitations, we show that using a layered approach

with a filtering mechanism together with the Fast Fourier Transform, it

is possible to detect ROP payloads even in the presence of noise and

assuming that the target system employs... (More)
We consider the problem of detecting exploits based on

return-oriented programming. In contrast to previous works we investigate

to which extent we can detect ROP payloads by only analysing

streaming data, i.e., we do not assume any modifications to the target

machine, its kernel or its libraries. Neither do we attempt to execute any

potentially malicious code in order to determine if it is an attack. While

such a scenario has its limitations, we show that using a layered approach

with a filtering mechanism together with the Fast Fourier Transform, it

is possible to detect ROP payloads even in the presence of noise and

assuming that the target system employs ASLR. Our approach, denoted

eavesROP, thus provides a very lightweight and easily deployable mitigation

against certain ROP attacks. It also provides the added merit

of detecting the presence of a brute-force attack on ASLR since library

base addresses are not assumed to be known by eavesROP. (Less)
Please use this url to cite or link to this publication:
author
organization
publishing date
type
Chapter in Book/Report/Conference proceeding
publication status
published
subject
keywords
Return-Oriented Programming, ROP, Pattern Matching, ASLR
in
Lecture Notes in Computer Science
editor
Chow, Sherman S. M.; Camenisch, Jan; Hui, Lucas C. K.; Yiu, Siu Ming; ; ; and
volume
8783
pages
413 - 424
publisher
Springer
conference name
ISC 2014
external identifiers
  • scopus:84921341193
ISSN
0302-9743
ISBN
978-3-319-13256-3
DOI
10.1007/978-3-319-13257-0_25
language
English
LU publication?
yes
id
0fde4dfb-021b-4f03-8019-e239b9a19c02 (old id 4861887)
date added to LUP
2014-12-12 12:22:44
date last changed
2017-02-19 04:31:28
@inproceedings{0fde4dfb-021b-4f03-8019-e239b9a19c02,
  abstract     = {We consider the problem of detecting exploits based on<br/><br>
return-oriented programming. In contrast to previous works we investigate<br/><br>
to which extent we can detect ROP payloads by only analysing<br/><br>
streaming data, i.e., we do not assume any modifications to the target<br/><br>
machine, its kernel or its libraries. Neither do we attempt to execute any<br/><br>
potentially malicious code in order to determine if it is an attack. While<br/><br>
such a scenario has its limitations, we show that using a layered approach<br/><br>
with a filtering mechanism together with the Fast Fourier Transform, it<br/><br>
is possible to detect ROP payloads even in the presence of noise and<br/><br>
assuming that the target system employs ASLR. Our approach, denoted<br/><br>
eavesROP, thus provides a very lightweight and easily deployable mitigation<br/><br>
against certain ROP attacks. It also provides the added merit<br/><br>
of detecting the presence of a brute-force attack on ASLR since library<br/><br>
base addresses are not assumed to be known by eavesROP.},
  author       = {Jämthagen, Christopher and Karlsson, Linus and Stankovski, Paul and Hell, Martin},
  booktitle    = {Lecture Notes in Computer Science},
  editor       = {Chow, Sherman S. M. and Camenisch, Jan and Hui, Lucas C. K. and Yiu, Siu Ming},
  isbn         = {978-3-319-13256-3},
  issn         = {0302-9743},
  keyword      = {Return-Oriented Programming,ROP,Pattern Matching,ASLR},
  language     = {eng},
  pages        = {413--424},
  publisher    = {Springer},
  title        = {eavesROP: Listening for ROP Payloads in Data Streams},
  url          = {http://dx.doi.org/10.1007/978-3-319-13257-0_25},
  volume       = {8783},
  year         = {2014},
}