Minos: Control Data Attack Prevention Orthogonal to Memory Model

1. Minos: Control Data Attack Prevention Orthogonal to Memory Model Jedidiah R. Crandall and Frederic T. Chong Department of Computer Science University of California at Davis

2. Outline • What is control data? • Motivation • Biba’s low-water-mark integrity policy • The Minos architecture • Security assessment F. Chong - Minos

3. What is control data? • Any data which is loaded into the program counter on control flow transfer, or any data used to calculate such data • Executable code is not control data F. Chong - Minos

4. A Control Data Vulnerability typedef function(); function *f; scanf(“%d”, (int *) &f); f(); • More commonly: buffer overflows, format string attacks F. Chong - Minos

5. Motivation • Control data attacks cost users billions of dollars a year • Remote intrusions • Cleaning up worms • SPAM and DoS from botnets • Without architectural support, every memory corruption vulnerability is an opportunity to hijack control flow F. Chong - Minos

6. Securing commodity software • Minos supports an untyped, linear address space • Allows us to secure commodity software • Supports code as data (dynamic libaries, JITs) • Modification of source code is optional, but helpful • Minos implements a simple, low-level security policy that does not need to be customized to each application. F. Chong - Minos

7. Minos Security Goals • Control data attacks constitute the overwhelming majority of remote intrusions • Minos protects against remote control data attacks • Minos protects against local vulnerabilities but only because the line between these and remote vulnerabilities is not clear F. Chong - Minos

8. Biba’s Low-water-mark Integrity Policy • Security properties • Integrity • Confidentiality • Availability • Tracks the “taintedness” of data • Access controls are based on accesses a subject has made in the past F. Chong - Minos

9. Biba’s Low-water-mark Integrity Policy (Formally) • Any subject may modify any object if… • The integrity of the object is not greater than that of the subject • Any subject may read any object • The subject’s integrity is lowered to the minimum of the object’s integrity and it’s own • Notorious for its monotonic behavior F. Chong - Minos

10. The Minos Architecture • Integrity bit kept with every word of L1 cache • Integrity bits grouped into words in L2 cache • Integrity bits grouped into pages in VM F. Chong - Minos

11. Gratuitous Dante Quote Minos the dreadful snarls at the gate, … and wraps himself in his tail with as many turns as levels down that shade will have to dwell F. Chong - Minos

12. Two Implementations • Linux • Windows Whistler and XP • Full system emulation • SPEC benchmarks are statically compiled binaries that do not use the network • A proof-of-concept was needed because of the low-water-mark policy F. Chong - Minos

13. OS Changes • Read system call forces data low integrity unless… • The ctime and mtime of the inode are before an establishment time …OR… • The inode points to a pipe between lightweight processes that share the same address space • Network sockets, readv()s, and pread()s are forced low integrity unconditionally F. Chong - Minos

14. OS Changes (Continued) • Establishment time requirement applies to mmap()ed files • A static binary may be mounted and executed if it is flushed to the disk first • More user friendly methods of defining trust could be developed F. Chong - Minos

15. Quantitative Measures • Stability • Monotonic loss of system integrity? • Virtual Memory Performance • Hardware investment in cache system • Slightly increased pressure on VM swapping F. Chong - Minos

16. One Month of a Minos Web Server F. Chong - Minos

17. SPEC2000 gcc F. Chong - Minos

18. Virtual Memory Swapping Memory Swap drive 4kb Page w/ tags Tags (128 bytes) 4kb Page (no tags) 4kb Page w/ tags F. Chong - Minos

19. Virtual Memory Swapping Experimental Methodology • Minos-enabled Linux vs. unmodified Linux • 1.6 GHz Pentium 4 with 256 MB RAM • 512 MB Swap Space • Used mlocks() to take away memory • 4 SPEC2000 benchmarks F. Chong - Minos

20. vpr mcf gcc bzip2 F. Chong - Minos

21. Qualitative Measures • Real attacks • Many return pointer protection papers erroneously cite Code Red as motivation • Two attacks (innd and su-dtors) caused changes to our original, simple policy • We designed attacks specifically designed to subvert Minos F. Chong - Minos

22. How to catch worms…

23. Only one false positive…

24. Actually a “non-target pest”

25. Attacks tested on Minos

26. Attacks By Others F. Chong - Minos

27. More info • Minos architecture [Crandall, Chong, Micro 2004] • Minos security assessment [Crandall, Chong, WASSA 2004] http://minos.cs.ucdavis.edu • Minos emulated system • If you break it, please leave a text file in /root  F. Chong - Minos

28. Minos Issues • Bit-width conversions are problematic • Code Red vs. Sun SDK • Load/store addresses are problematic • Procedure Linkage Table (PLT) • Controlled increment F. Chong - Minos

29. Bit-Width Policies • All 8- and 16-bit immediates are low integrity • All 8- and 16-bit loads/stores have the integrity of the addresses used checked (possible because no 8- and 16-bit ptrs) • Misaligned 32-bit loads/stores are assumed low integrity • Code Red exploits ASCII->Unicode bit conversion F. Chong - Minos

30. JIT Compatibility • Sun Java SDK must be run in compatibility mode: • All 8-bit and 16-bit immediates are high integrity • Could allow arbitrary 32-bit high integrity control data • For security reasons, the JIT should be slightly modified F. Chong - Minos

31. A fundamental tradeoff • Can only do one of: • Check addresses for control data 32-bit loads/stores • Check all operands to an operation • Else many false positives • Size argument for heap malloc from user • Entire heap becomes low integrity F. Chong - Minos

32. Breaking Minos • We couldn’t break Minos • So we looked at current best practices • Non-executable pages • StackGuard • Random placement of library routines • But Minos is in theory vulnerable F. Chong - Minos

33. Hannibal • Exploits format string vulnerability in wu-ftpd • Upload a binary called jailbreak via anonymous FTP • Switch rename() with execv() in PLT using a format string attack • Request to rename jailbreak becomes execv() • (Not really this simple…) F. Chong - Minos

34. Information Flow Problems if (LowIntegrityData == 5) HighIntegrityData = 5; HighIntegrityData = HighIntegrityLookupTable[LowIntegrityData]; HighIntegrityData = 0; while (LowIntegrityData--) HighIntegrityData++; F. Chong - Minos

35. Minos is “securable” • Modifications of the library code and the linking mechanisms could secure a Minos system with a high degree of assurance by • Taking away the power of arbitrary copy primitives with an Secure PLT • Avoiding code that gives attackers abilities like a controlled increment F. Chong - Minos

36. Related Work • Capability systems – AS/400, iAPX 432 • M Machine, Mondriaan • Dynamic Information Flow (MIT) • Buffer Overflow Protection (UCSD) Minos is distinguished by its simple policy F. Chong - Minos

37. Future Work • Nearly the same HW as soft-error detection [Weaver,Emer,Mukherjee ISCA04] • Similar to NAT bit for speculation on Itanium • Leverage tag bit on PowerPC AS used for microcode F. Chong - Minos

38. Collaborative Network Defense • Minos “honeypot” detect worms • DACODA analysis tool creates filter • Buttercup network hardware protects all hosts F. Chong - Minos

39. DMA and Port I/O • All DMA and Port I/O is assumed high integrity • Any data off the network will be read and forced low integrity • It will stay low integrity because of the establishment time requirement • Consider the alternative F. Chong - Minos

40. Specific Concerns for Minos • Arbitrary copy primitives • Sandboxed PLT • Format string attacks using long strings rather than size specifiers • Minos does stop the longstr attack • Dangling pointers • Need arbitrary copy primitive F. Chong - Minos

41. Security Comparison • Minos • G. Edward Suh, Jae W. Lee, and Srinivas Devadas. “Secure Program Execution via Dynamic Information Flow Tracking”, ASPLOS XI • Two different policies • Current best practices F. Chong - Minos

42. Three Classes of Control Data Attacks • Overwrite control data with untrusted data • Cause control data to be loaded/stored to/from the wrong place • Cause control data to be loaded from the right place but at the wrong time F. Chong - Minos

43. Minos • Protection against (a) is explicit • Protection against (b) only for 8- and 16-bit data • Arbitrary copy primitive needed for (c) F. Chong - Minos

44. Information Flow Tracking • Policy 1 does not fully protect against (a) • Both policies protect against (b) by checking the integrity of addresses used for all loads and stores • Policy 1 does not fully protect against (c) F. Chong - Minos

45. A Fundamental Tradeoff chunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | prev_size of previous chunk (if p=1) | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | size of chunk, in bytes |p| mem-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | User data starts here... . . . . (malloc_usable_space() bytes) . . | nextchunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | size of chunk | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ F. Chong - Minos