![](bg8.png)
We believe that we have been fully successful at a the-
oretical level and that we have also provided a good
starting point for a practical application. We have vi-
olated to some degree our first goal (minimal over-
head), but it should be noted that the bulk of the over-
head introduced by our system happens at the begin-
ning of the execution of the program; the overhead is
minimal once the actual execution has started.
We believe that our work has the potential of sim-
plifying the area of computer security considerably.
We did not produce a production-level system but we
explored a significant IT security issue and we have
effectively shown that guarding against buffer over-
flows at run time is not only possible but also feasible.
Section 5 provides a roadmap for future work on the
matter, toward an actual production system.
Some old worms and other viruses could still run
unaffected by our patch. However, it is unlikely that
programs are not patched against them. Some new
threats may use a completely different approach, that
side-steps our system altogether. Today the kernel
defense against malware is based on several separate
technologies, including ASLR, NX-bit, and stack ca-
naries. We believe that trying to merge all the de-
fenses into one big subsystem would be a mistake.
Indeed, some protections might seem redundant, but
in certain situations they have their own usefulness.
Our patch is not here to replace the old protection
mechanisms, but rather to fill the gap opened by their
weaknesses and add a new degree of protection.
REFERENCES
Anderson, J. P. (1972). Computer security technology
planning study. csrc.nist.gov/publications/history/
ande72.pdf, p. 61.
ASLR (2003). Address space layout randomization.
pax.grsecurity.net/docs/aslr.txt (retrieved Nov. 2012).
Bulba and Kil3r (2000). Bypassing stackguard and stack-
shield. Phrack, 10(56). phrack.org/issues.html?issue
=56&id=5.
c0ntex (2012). Bypassing non-executable-stack during
exploitation using return-to-libc. www.infosecwriters.
com/text
resources/pdf/return-to-libc.pdf (retrieved
Nov. 2012).
CERT/CC (2002). Advisory CA-2001-19 “Code Red”
worm exploiting buffer overflow in IIS indexing ser-
vice DLL. www.cert.org/advisories/CA-2001-19.html
(retrieved Sep. 2013).
Delikon (2004). Changing the per-file entry-point
to avoid anti-virus detection. repo.zenk-
security.com/Reversing%20.%20cracking/EN-
Changing%20the%20entry-point.pdf.
Etoh, H. (2001). GCC stack-smashing protector (for
gcc-2.95.3). “gcc-patches” mailing list. gcc.
gnu.org/ml/gcc-patches/2001-06/msg01753.html (re-
trieved Nov. 2012).
Goodin, D. (2013). Puzzle box: The quest to crack
the world’s most mysterious malware warhead.
Arstechnica. arstechnica.com/security/2013/03/the-
worlds-most-mysterious-potentially-destructive-
malware-is-not-stuxnet.
Intel (2013). Intel 64 and IA-32 architectures soft-
ware developer’s manual combined volumes 2A,
2B, and 2C: Instruction set reference, A-Z. down-
load.intel.com/products/processor/manual/325383.pdf.
Kerouanton, B. (2012). Reinventing old school vulnerabili-
ties. www.youtube.com/watch?v=5KK-FT8JLFw (re-
trieved Nov. 2012).
Knowles, D. (2007). W32.SQLExp.Worm. www.symantec.
com/security
response/writeup.jsp?docid=2003-
012502-3306-99 (retrieved Sep. 2013).
Levy, E. (1996). Smashing the stack for fun and profit.
Phrack, 7(49). www.phrack.com/issues.html?issue
=49&id=14.
Noexec (2003). Non-executable pages design and im-
plementation. pax.grsecurity.net/docs/noexec.txt (re-
trieved Nov. 2012).
Padmanabhuni, B. M. and Tan, H. B. K. (2011). Defend-
ing against buffer overflow vulnerabilities. Computer,
44(11):53–60.
Panchamukhi, P. (2004). Kernel debugging with
kprobes. IBM DevelopersWorks. www.ibm.com/
developerworks/library/l-kprobes/index.html.
Rascagneres, P. (2012). Voyage au centre du SSP–Linux.
www.r00ted.com/doku.php?id=voyage
au centre
du ssp linux (retrieved Nov. 2012).
Seeley, D. (2007). A tour of the worm. web.archive.org/
web/20070520233435/http://world.std.com/˜franl/
worm.html (retrieved Nov. 2012).
Shacham, H., Page, M., B. Pfaff, E.-J., Goh, Modadugu,
N., and Boneh, D. (2004). On the effectiveness of
address-space randomization. In Proceedings of the
11th ACM Conference on Computer and Communica-
tions Security, pages 298–307.
Shao, Z., Cao, J., Chan, K. C. C., Xue, C., and H.-M.Sha, E.
(2006). Hardware/software optimization for array &
pointer boundary checking against buffer overflow at-
tacks. Journal of Parallel and Distributed Computing,
66(9):1129–1136.
Shao, Z., Xue, C., Zhuge, Q., and Sha, E. H.-M. (2004).
Security protection and checking in embedded sys-
tem integration against buffer overflow attacks. In
Proceedings of the International Conference on In-
formation Technology: Coding and Computing (ITCC
2004), volume I, pages 409–413.
Teissier, B. and Bruda, S. D. (2014). An approach to
stack overflow counter-measures using kernel proper-
ties. Technical Report 2014-001, Department of Com-
puter Science, Bishop’s University. cs.ubishops.ca/
media/papers/bucstr-2014-001.pdf.
Vandecappelle, A. (2008). Kernel memory allocation.
Linux Kernel Newbies. kernelnewbies.org/Kernel
MemoryAllocation.
ICSOFT-EA2014-9thInternationalConferenceonSoftwareEngineeringandApplications
376