Author:
André Zúquete
Affiliation:
IEETA / UA, Portugal
Keyword(s):
Buffer overflows, run-time detection, run-time correctness assessment, damage containment, dependability.
Related
Ontology
Subjects/Areas/Topics:
Data and Application Security and Privacy
;
Data Engineering
;
Data Privacy and Security
;
Databases and Data Security
;
Information and Systems Security
;
Intrusion Detection & Prevention
Abstract:
This paper describes StackFences, a run-time technique for detecting overflows in local variables in C programs. This technique is different from all others developed so far because it tries to detect explicit overflow occurrences, instead of detecting if a particular stack value, namely a return address, was corrupted because of a stack overflow. Thus, StackFences is useful not only for detecting intrusion attempts but also for checking the run-time robustness of applications. We also conceived different policies for deploying StackFences, allowing a proper balancing between detection accuracy and performance. Effectiveness tests confirmed that all overflows in local variables are detected before causing any severe damage. Performance tests ran with several tools and parameters showed an acceptable performance degradation.