Better security for binary software with runtime generated code

What is it about?

Code reuse attacks (wherein attackers hijack software by sending malicious inputs that alter its execution paths) are one of the most dangerous threats against modern software containing dynamic code (i.e., code generated as the software runs). This paper innovates and tests a new form of control-flow integrity (CFI) to protect against code reuse attacks without changing the algorithms and tools used to generate the dynamic code.

Featured Image

Photo by Markus Spiske on Unsplash

Photo by Markus Spiske on Unsplash

Why is it important?

The pervasiveness of dynamic code has exploded over the past decade with the continual rise of new JIT-compiled languages, dynamic component-wise linking (e.g., in cloud computing), and self-unpacking components. Unfortunately, these new technologies have made inviting targets for criminals, since dynamic code is more difficult to secure than static code. The new defense innovated by this work offers a more scalable "fire and forget" solution to the control-flow integrity problem for this increasingly large class of attack-prone software.