![](bgc.png)
vides overall solid protection against ret-based ex-
ploitation.
The performance evaluation of RIProtection re-
veals that its usage in the field is highly dependent on
the structure of the program and makes global state-
ments on the expected performance of protected pro-
grams difficult. In any case, RIProtection introduces
a significant performance impact.
In means of compatibility RIProtection provides
excellent support for every x86_64 binary created
from standard C with a compiler that respects con-
ventions. The security module that should be used
can conveniently be chosen by only altering the re-
spective byte in the program ELF header.
ACKNOWLEDGEMENTS
This work was supported by DATEV eG as part of
the research project “Software-based Hardening for
Mobile Applications”.
REFERENCES
Bletsch, T., Jiang, X., and Freeh, V. (2011). Mitigating
code-reuse attacks with control-flow locking. In Pro-
ceedings of the 27th Annual Computer Security Ap-
plications Conference, ACSAC ’11, pages 353–362,
New York, NY, USA. ACM.
Bulba and Kil3r (2000). Bypassing stackguard and stack-
shield.
Carlini, N. and Wagner, D. (2014). Rop is still dangerous:
Breaking modern defenses. In Proceedings of the 23rd
USENIX Conference on Security Symposium, SEC’14,
pages 385–399, Berkeley, CA, USA. USENIX Asso-
ciation.
Checkoway, S., Davi, L., Dmitrienko, A., Sadeghi, A.-
R., Shacham, H., and Winandy, M. (2010). Return-
oriented programming without returns. In Proceed-
ings of the 17th ACM Conference on Computer and
Communications Security, CCS ’10, New York, NY,
USA. ACM.
Chen, P., Xiao, H., Shen, X., Yin, X., Mao, B., and Xie, L.
(2009). Drop: Detecting return-oriented programming
malicious code. In Prakash, A. and Sen Gupta, I., ed-
itors, Information Systems Security, volume 5905 of
Lecture Notes in Computer Science, pages 163–177.
Springer Berlin Heidelberg.
Cheng, Y., Zhou, Z., Yu, M., Ding, X., and Deng, R. H.
(2014). Ropecker: A generic and practical approach
for defending against rop attacks. In Proceedings of
the 21th Annual Network and Distributed System Se-
curity Symposium, NDSS’14. NDSS Association.
Corporation, I. (2014). Intel
R
64 and ia-32 architectures
software developer’s manual, volume 3 (3a, 3b & 3c):
System programming guide.
Cowan, C., Beattie, S., Johansen, J., and Wagle, P. (2003).
Pointguard: Protecting pointers from buffer overflow
vulnerabilities. In Proceedings of the 12th Confer-
ence on USENIX Security Symposium - Volume 12,
SSYM’03, pages 7–7, Berkeley, CA, USA. USENIX
Association.
Cowan, C., Pu, C., Maier, D., Hintony, H., Walpole, J.,
Bakke, P., Beattie, S., Grier, A., Wagle, P., and Zhang,
Q. (1998). Stackguard: Automatic adaptive detection
and prevention of buffer-overflow attacks. In Proceed-
ings of the 7th Conference on USENIX Security Sym-
posium - Volume 7, SSYM’98, pages 5–5, Berkeley,
CA, USA. USENIX Association.
Davi, L., Sadeghi, A.-R., Lehmann, D., and Monrose, F.
(2014). Stitching the gadgets: On the ineffectiveness
of coarse-grained control-flow integrity protection. In
Proceedings of the 23rd USENIX Conference on Se-
curity Symposium, SEC’14, pages 401–416, Berkeley,
CA, USA. USENIX Association.
Davi, L., Sadeghi, A.-R., and Winandy, M. (2011). Ropde-
fender: A detection tool to defend against return-
oriented programming attacks. In Proceedings of the
6th ACM Symposium on Information, Computer and
Communications Security, ASIACCS ’11, pages 40–
51, New York, NY, USA. ACM.
Defense, M. S. R. . (2012). Introducing enhanced mitigation
experience toolkit (emet).
Fratri
´
c, I. (2012). Ropguard: Runtime prevention of return-
oriented programming attacks.
Gökta¸s, E., Athanasopoulos, E., Polychronakis, M., Bos,
H., and Portokalidis, G. (2014). Size does matter:
Why using gadget-chain length to prevent code-reuse
attacks is hard. In Proceedings of the 23rd USENIX
Conference on Security Symposium , SEC’14, pages
417–432, San Diego, CA. USENIX Association.
Hiser, J., Nguyen-Tuong, A., Co, M., Hall, M., and David-
son, J. (2012). Ilr: Where’d my gadgets go? In Se-
curity and Privacy (SP), 2012 IEEE Symposium on,
pages 571–585.
Kaplan, D. (2014). Hardware based return pointer encryp-
tion. US Patent App. 13/717,315.
Luk, C.-K., Cohn, R., Muth, R., Patil, H., Klauser, A.,
Lowney, G., Wallace, S., Reddi, V. J., and Hazelwood,
K. (2005). Pin: Building customized program analysis
tools with dynamic instrumentation. In Proceedings
of the 2005 ACM SIGPLAN Conference on Program-
ming Language Design and Implementation, PLDI
’05, pages 190–200, New York, NY, USA. ACM.
Mayer, U. F. (2011). Linux/unix nbench.
Onarlioglu, K., Bilge, L., Lanzi, A., Balzarotti, D., and
Kirda, E. (2010). G-free: Defeating return-oriented
programming through gadget-less binaries. In Pro-
ceedings of the 26th Annual Computer Security Appli-
cations Conference, ACSAC ’10, pages 49–58, New
York, NY, USA. ACM.
Pappas, V., Polychronakis, M., and Keromytis, A. D.
(2012). Smashing the gadgets: Hindering return-
oriented programming using in-place code random-
ization. In Proceedings of the 2012 IEEE Sympo-
sium on Security and Privacy, SP ’12, pages 601–615,
Washington, DC, USA. IEEE Computer Society.
ICISSP 2017 - 3rd International Conference on Information Systems Security and Privacy
36