The never ending war in the stack and the reincarnation of ROP attacks

TL;DR

This paper analyzes existing anti-ROP solutions, identifies their weaknesses, and proposes new runtime Indicators Of Compromise to enhance detection of ROP attacks, which remain a significant security threat.

Contribution

It provides an in-depth review of current anti-ROP defenses and introduces novel runtime IOCs to improve detection accuracy and reduce false negatives.

Findings

Current anti-ROP solutions have significant weaknesses.

Proposed IOCs can detect ROP attacks at runtime.

Analysis highlights the need for improved detection mechanisms.

Abstract

Return Oriented Programming (ROP) is a technique by which an attacker can induce arbitrary behavior inside a vulnerable program without injecting a malicious code. The continues failure of the currently deployed defenses against ROP has made it again one of the most powerful memory corruption attacks. ROP is also considered as one of the most flexible attacks, its level of flexibility, unlike other code reuse attacks, can reach the Turing completeness. Several efforts have been undertaken to study this threat and to propose better defense mechanisms (mitigation or prevention), yet the majority of them are not deeply reviewed nor officially implemented.Furthermore, similar studies show that the techniques proposed to prevent ROP-based exploits usually yield a high false-negative rate and a higher false-positive rate, not to mention the overhead that they introduce into the protected program. The first part of this research work aims at providing an in-depth analysis of the currently available anti-ROP solutions (deployed and proposed), focusing on inspecting their defense logic and summarizing their weaknesses and problems. The second part of this work aims at introducing our proposed Indicators Of Compromise (IOCs) that could be used to improve the detection rate of ROP attacks. The three suggested indicators could detect these attacks at run-time by checking the presence of some artifacts during the execution of the targeted program.