Visible to the public BlackBox: Lightweight Security Monitoring for COTS Binaries

TitleBlackBox: Lightweight Security Monitoring for COTS Binaries
Publication TypeConference Paper
Year of Publication2016
AuthorsHawkins, Byron, Demsky, Brian, Taylor, Michael B.
Conference NameProceedings of the 2016 International Symposium on Code Generation and Optimization
PublisherACM
Conference LocationNew York, NY, USA
ISBN Number978-1-4503-3778-6
KeywordsBinary Rewriting, composability, Control Flow Integrity, Dynamic Code Generation, Dynamical Systems, Metrics, network coding, Program Monitoring, pubcrawl, Resiliency, software security
Abstract

After a software system is compromised, it can be difficult to understand what vulnerabilities attackers exploited. Any information residing on that machine cannot be trusted as attackers may have tampered with it to cover their tracks. Moreover, even after an exploit is known, it can be difficult to determine whether it has been used to compromise a given machine. Aviation has long-used black boxes to better understand the causes of accidents, enabling improvements that reduce the likelihood of future accidents. Many attacks introduce abnormal control flows to compromise systems. In this paper, we present BlackBox, a monitoring system for COTS software. Our techniques enable BlackBox to efficiently monitor unexpected and potentially harmful control flow in COTS binaries. BlackBox constructs dynamic profiles of an application's typical control flows to filter the vast majority of expected control flow behavior, leaving us with a manageable amount of data that can be logged across the network to remote devices. Modern applications make extensive use of dynamically generated code, some of which varies greatly between executions. We introduce support for code generators that can detect security-sensitive behaviors while allowing BlackBox to avoid logging the majority of ordinary behaviors. We have implemented BlackBox in DynamoRIO. We evaluate the runtime overhead of BlackBox, and show that it can effectively monitor recent versions of Microsoft Office and Google Chrome. We show that in ROP, COOP, and state- of-the-art JIT injection attacks, BlackBox logs the pivotal actions by which the attacker takes control, and can also blacklist those actions to prevent repeated exploits.

URLhttp://doi.acm.org/10.1145/2854038.2854062
DOI10.1145/2854038.2854062
Citation Keyhawkins_blackbox:_2016