Authors
Mathias Payer, Antonio Barresi, Thomas R Gross
Publication date
2015
Conference
DIMVA '15: Conference on Detection of Intrusions and Malware & Vulnerability Assessment
Description
Applications written in low-level languages without type or memory safety are prone to memory corruption. Attackers gain code execution capabilities through memory corruption despite all currently deployed defenses. Control-Flow Integrity (CFI) is a promising security property that restricts indirect control-flow transfers to a static set of well-known locations.
We present Lockdown, a modular, fine-grained CFI policy that protects binary-only applications and libraries without requiring source-code. Lockdown adaptively discovers the control-flow graph of a running process based on the executed code. The sandbox component of Lockdown restricts interactions between different shared objects to imported and exported functions by enforcing fine-grained CFI checks using information from a trusted dynamic loader. A shadow stack enforces precise integrity for function returns. Our prototype …
Scholar articles
M Payer, A Barresi, TR Gross - Detection of Intrusions and Malware, and Vulnerability …, 2015
M Payer, A Barresi, TR Gross - arXiv preprint arXiv:1407.0549, 2014