Mitigating ROP attacks

Patent metadata

Field	Value
Publication number	US-9576138-B1
Application number	US-201514870050-A
Country	US
Kind code	B1
Filing date	Sep 30, 2015
Priority date	Sep 30, 2015
Publication date	Feb 21, 2017
Grant date	Feb 21, 2017

Abstract

Mitigating return-oriented programming attacks. From program code and associated components needed by the program code for execution, machine language instruction sequences that may be combined and executed as malicious code are selected. A predetermined number of additional copies of each of the selected machine language instruction sequences are made, and the additional copies are marked as non-executable. The machine language instruction sequences and the non-executable copies are distributed in memory. If a process attempts to execute a machine language instruction sequence that has been marked non-executable, the computer may initiate protective action.

First claim

What is claimed is:

1. A computer-implemented method for mitigating return-oriented programming (ROP) attacks, the method comprising:
receiving, by a computer, program code for execution and associated components needed by the program code for execution;
loading, by the computer, the program code and associated components into memory;
selecting, by the computer, a predetermined number of executable machine language instruction sequences from the loaded program code and the associated components, wherein each sequence terminates in a return instruction;
making, by the computer, multiple non-executable copies of each of the selected machine language instruction sequences; and
distributing, by the computer, the selected executable machine language instruction sequences and the multiple non-executable copies in memory;
whereby, if the computer sustains an ROP attack and the ROP attack selects a machine language instruction sequence terminating in a return instruction to include in an ROP payload, the likelihood of the ROP attack selecting an executable machine language instruction sequence terminating in a return instruction is diminished.

2. A method in accordance with claim 1 , wherein the predetermined number of executable machine language instruction sequences includes:
machine language instruction sequences that are equivalent to a conditional statement “if-then-else . . . return”.

3. A method in accordance with claim 1 , wherein the predetermined number of executable machine language instruction sequences includes:
sequences of machine language instructions corresponding to machine language instructions in at least one of: known malicious code sequences and known toolkits for assembling malicious code sequences.

4. A method in accordance with claim 1 , wherein
distributing, by the computer, the selected executable machine language instruction sequences and the multiple non-executable copies in memory comprises storing the selected executable machine language instruction sequences and the multiple non-executable copies in memory and randomly permuting memory blocks containing the selected executable machine language instruction sequences and the multiple non-executable copies, respectively.

5. A method in accordance with claim 1 , wherein distributing further comprises:
periodically distributing, by the computer, the selected executable machine language instruction sequences and the multiple non-executable copies in memory.

6. A method in accordance with claim 1 , further comprising:
in response to a process attempting to execute a non-executable copy of a machine language instruction sequence, initiating, by the computer, protective action.

7. A method in accordance with claim 6 , wherein initiating, by the computer, protective action comprises one or more of:
terminating one or more active processes; and
reporting a possible exploit.

8. A computer program product for mitigating return-oriented programming (ROP) mitigation attacks, the computer program product comprising:
one or more non-transitory computer-readable storage media and program instructions stored on the one or more non-transitory computer-readable storage media, the program instructions comprising:
program instructions to receive program code for execution and associated components needed by the program code for execution;
program instructions to load the program code and associated components into memory;
program instructions to a select a predetermined number of executable machine language instruction sequences from the loaded program code and the associated components, wherein each sequence terminates in a return instruction;
program instructions to make multiple non-executable copies of each of the selected machine language instruction sequences; and
program instructions to distribute the selected executable machine language instruction sequences and the multiple non-executable copies in memory;
whereby, if the computer sustains an ROP attack and the ROP attack selects a machine language instruction sequence terminating in a return instruction to include in an ROP payload, the likelihood of the ROP attack selecting an executable machine language instruction sequence terminating in a return instruction is diminished.

9. A computer program product in accordance with claim 8 , wherein the predetermined number of executable machine language instruction sequences includes:
machine language instruction sequences that are equivalent to a conditional statement “if-then-else . . . return”.

10. A computer program product in accordance with claim 8 , wherein the predetermined number of executable machine language instruction sequences includes:
sequences of machine language instructions corresponding to machine language instructions in at least one of: known malicious code sequences and known toolkits for assembling malicious code sequences.

11. A computer program product in accordance with claim 8 , wherein
program instructions to distribute the selected executable machine language instruction sequences and the multiple non-executable copies in memory comprise program instructions to store the selected executable machine language instruction sequences and the multiple non-executable copies in memory and randomly permute memory blocks containing the selected executable machine language instruction sequences and the multiple non-executable copies, respectively.

12. A computer program product in accordance with claim 8 , wherein program instructions to distribute further comprise:
program instructions to periodically distribute the selected executable machine language instruction sequences and the multiple non-executable copies in memory.

13. A computer program product in accordance with claim 8 , further comprising:
program instructions, in response to a process attempting to execute a non-executable copy of a machine language instruction sequence, to initiate protective action.

14. A computer program product in accordance with claim 13 , wherein program instructions to initiate protective action comprise one or more of:
program instructions to terminate one or more active processes; and
program instructions to report a possible exploit.

15. A computer system for return-oriented programming (ROP) mitigation, the computer system comprising:
one or more hardware computer processors, one or more computer-readable storage media, and program instructions stored on one or more of the computer-readable storage media for execution by at least one of the one or more processors, the program instructions comprising:
program instructions to receive program code for execution and associated components needed by the program code for execution;
program instructions to load the program code and associated components into memory;
program instructions to a select a predetermined number of executable machine language instruction sequences from the loaded program code and the associated components, wherein each sequence terminates in a return instruction;
program instructions to make multiple non-executable copies of each of the selected machine language instruction sequences; and
program instructions to distribute the selected executable machine language instruction sequences and the multiple non-executable copies in memory;
whereby, if the computer sustains an ROP attack and the ROP attack selects a machine language instruction sequence terminating in a return instruction to include in an ROP payload, the likelihood of the ROP attack selecting an executable machine language instruction sequence terminating in a return instructi

Assignees

• IBM

Inventors

• Boehm Omer Y
• Farchi Eitan D
• Margalit Oded
• Shajrawi Yousef
• Vinov Michael

Classifications

• G06F21/60 Primary

  Protecting data · CPC title

• G06F21/55 Primary

  Detecting local intrusion or implementing counter-measures · CPC title

• G06F21/52 Primary

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• G06F3/0673

  Single storage device · CPC title

• G06F21/54

  by adding security routines or objects to programs · CPC title