syssec_red_book

9.5. State of the Artas an attack. To determine the CFG, one could employ either static or dynamicanalysis. However, none is simple in practice—static analysis has an inherentdifficulty in resolving indirect branch targets, while dynamic analysis oftencovers only a part of a program’s execution paths. Several ways of approachingthe problem have been proposed: for example a combination of static and dynamicanalysis by Xu et al. [401], value set analysis presented by Balakrishnanet al. [90], and a framework proposed by Kinder et al. [237], which combinescontrol and data flow analysis by means of abstract interpretation. The CFIpolicy is enforced at runtime, and a possible implementation may compare thetarget address of each control-flow transfer, i.e., each jump, call, or return, to aset of allowed destinations.CFI does not detect non-control-diverting attacks, but it is a useful andcheap-to-enforce policy, which effectively stops the non-control-diverting ones.The mechanism realized by Abadi et al. [76] employs binary rewriting, and requiresneither recompilation nor source-code access. The average performanceoverhead is 15%, with a maximum of 45%.Runtime host solutions take advantage of the wealth of information presentwhen a vulnerable application is running to protect against attacks. DynamicTaint Analysis (DTA), proposed by Denning et al. [149] and later implementedin TaintCheck [299], and a plethora of other systems [110,134,138,209,320,354],is one of the few techniques that protect legacy binaries against memory corruptionattacks on control data. The technique is implemented by transparentlymodifying the runtime environment. In a nutshell, untrusted data from thenetwork is tagged as tainted, and its propagation is tracked throughout aprogram execution. An alert is generated (only) if an exploit takes place, e.g.,when the address of a function to be invoked is tainted (this never happens ina benign situation). The technique proves to be reliable and generate few, ifany, false positives. However, it can slow down the protected application by anorder of magnitude, and in practice, it is limited to non-production machinessuch as honeypots or malware analysis engines. Furthermore, DTA can usuallydetect only control-flow diverting attacks, so it does not defend against thenon-control-diverting ones.The above solutions are good at stopping control-flow diversions, butpowerless against corruption of non-control data. As a response to this problem,BodyArmour [356,357] is a tool chain to bolt a layer of protection onto existingC binaries to shield them from state-of-the-art memory corruption attacks,including the non-control-diverting ones. It employs dynamic informationflow tracking. First, it monitors the execution of a vulnerable applicationto understand the layout of memory, and unearth buffer locations and sizes.Later, it hardens the application so that buffer overflows are no longer possible.However, this technique is based on dynamic analysis, so it protects only those69