Where's the FEEB? The Effectiveness of Instruction Set Randomization

Get BibTex-formatted data

Author

Sovarel, Evans, Paul

Entry type

misc

Abstract

Instruction Set Randomization (ISR) has been proposed as a promising defense against code injection attacks. It defuses all standard code injection attacks since the attacker does not know the instruction set of the target machine. A motivated attacker, however, may be able to circumvent ISR by determining the randomization key. In this paper, we investigate the possibility of a remote attacker successfully ascertaining an ISR key using an incremental attack. We introduce a strategy for attacking ISR-protected servers, develop and analyze two attack variations, and present a technique for packaging a worm with a miniature virtual machine that reduces the number of key bytes an attacker must acquire to 100. Our attacks can break enough key bytes to infect and ISR-protected server in about six minutess. Our results provide insights into properties necessary for ISR implementations to be sure

Key alpha

FEEB

School

University of Virginia

Publication Date

1900-01-01

Location

A hard-copy of this is in the Papers Cabinet

BibTex-formatted data

To refer to this entry, you may select and copy the text below and paste it into your BibTex document. Note that the text may not contain all macros that BibTex supports.

@Misc{ FEEB,
	title = "Where's the FEEB? The Effectiveness of Instruction Set Randomization",
	author = "Sovarel, Evans, Paul",
	school = "University of Virginia",
	abstract = "Instruction Set Randomization (ISR) has been proposed as a promising defense against code injection attacks. It defuses all standard code injection attacks since the attacker does not know the instruction set of the target machine. A motivated attacker, however, may be able to circumvent ISR by determining the randomization key. In this paper, we investigate the possibility of a remote attacker successfully ascertaining an ISR key using an incremental attack. We introduce a strategy for attacking ISR-protected servers, develop and analyze two attack variations, and present a technique for packaging a worm with a miniature virtual machine that reduces the number of key bytes an attacker must acquire to 100. Our attacks can break enough key bytes to infect and ISR-protected server in about six minutess. Our results provide insights  into properties necessary for ISR implementations to be sure",
}