Instantly Obsoleting the Address-code Associations: A New Principle for Defending Advanced Code Reuse Attack
Ping Chen, Jun Xu, Jun Wang, Peng Liu

TL;DR
This paper introduces CHAMELEON, a system that dynamically re-randomizes code locations to defend against advanced code reuse attacks like JIT-ROP, significantly increasing attack difficulty with manageable performance overhead.
Contribution
It proposes the novel principle of instantly obsoleting address-code associations through on-the-fly re-randomization, and implements it in the CHAMELEON system with effective techniques.
Findings
CHAMELEON defeats all tested code reuse exploits.
Re-randomization intervals as short as 1ms are feasible.
Performance overhead remains around 12% for frequent re-randomization.
Abstract
Fine-grained Address Space Randomization has been considered as an effective protection against code reuse attacks such as ROP/JOP. However, it only employs a one-time randomization, and such a limitation has been exploited by recent just-in-time ROP and side channel ROP, which collect gadgets on-the-fly and dynamically compile them for malicious purposes. To defeat these advanced code reuse attacks, we propose a new defense principle: instantly obsoleting the address-code associations. We have initialized this principle with a novel technique called virtual space page table remapping and implemented the technique in a system CHAMELEON. CHAMELEON periodically re-randomizes the locations of code pages on-the-fly. A set of techniques are proposed to achieve our goal, including iterative instrumentation that instruments a to-be-protected binary program to generate a re-randomization…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsSecurity and Verification in Computing · Advanced Malware Detection Techniques · Network Security and Intrusion Detection
