Securing software systems by preventing information leaks

System security;Vulnerability;Control-flow attack;Information leak;ASLR;Re-randomization;Replicated execution;Uninitialized-data use

Lu, Kangjie ; Lee, Wenke Kim, Taesoo Computer Science Backes, Michael Gao, Debin Ahamad, Mustaque Harris, William R. ; Lee, Wenke

University:Georgia Institute of Technology

Department:Computer Science

关键词: System security;    Vulnerability;    Control-flow attack;    Information leak;    ASLR;    Re-randomization;    Replicated execution;    Uninitialized-data use;   

Others  :  https://smartech.gatech.edu/bitstream/1853/58749/1/LU-DISSERTATION-2017.pdf

美国|英语

来源: SMARTech Repository

【 摘 要 】

Foundational software systems such as operating systems and web servers are implemented in unsafe programming languages for efficiency, and system designers often prioritize performance over security. Hence, these systems inherently suffer from a variety ofvulnerabilities and insecure designs that have been exploited by adversaries to launch critical system attacks. Two typical goals of these attacks are to leak sensitive data and to control victim systems. This thesis aims to defeat both data leaks and control attacks. We first identify that, in modern systems, preventing informationleaks can be a general defense that not only stops data leaks but also defeats control attacks. We then investigate three ways to prevent information leaks: eliminating information-leakvulnerabilities, re-designing system mechanisms against information leaks, and protecting certain sensitive data from information leaks. We have developed multiple tools for each way. Whileautomatically and reliably securing complex systems, all these tools impose negligible performance overhead. Our extensiveevaluation results show that preventing information leaks can be a general and practical approach to securing complex software systems.