Abstract
BinArmor is a novel technique to protect existing C binaries from memory corruption attacks on both control data and non-control data. Without access to source code, non-control data attacks cannot be detected with current techniques. Our approach hardens binaries against both kinds of overflow, without requiring the programs' source or symbol tables. We show that BinArmor is able to stop real attacks-including the recent non-control data attack on Exim. Moreover, we did not incur a single false positive in practice. On the downside, the current overhead of BinArmor is high-although no worse than competing technologies like taint analysis that do not catch attacks on non-control data. Specifically, we measured an overhead of 70% for gzip, 16%-180% for lighttpd, and 190% for the nbench suite.
| Original language | English |
|---|---|
| Title of host publication | USENIX ATC'12 |
| Subtitle of host publication | Proceedings of the 2012 USENIX conference on Annual Technical Conference |
| Place of Publication | Boston |
| Publisher | USENIX Association |
| Pages | 1-13 |
| Number of pages | 13 |
| ISBN (Electronic) | 9781931971935 |
| Publication status | Published - Jun 2012 |
| Event | 2012 USENIX Annual Technical Conference, USENIX ATC 2012 - Boston, United States Duration: 13 Jun 2012 → 15 Jun 2012 |
Conference
| Conference | 2012 USENIX Annual Technical Conference, USENIX ATC 2012 |
|---|---|
| Country/Territory | United States |
| City | Boston |
| Period | 13/06/12 → 15/06/12 |
Funding
This work is supported by the European Research Council through project ERC-2010-StG 259108-ROSETTA and the EU FP7 SysSec Network of Excellence. The authors are grateful to David Brumley and his team for pro-
