RandSys: Thwarting Code Injection Attacks with System Service Interface Randomization

Code injection attacks are a top threat to today’s Internet. With zero-day attacks on the rise, randomization techniques have been introduced to diversify software and operation systems of networked hosts so that attacks that succeed on one process or one host cannot succeed on others. Two most notable system-wide randomization techniques are Instruction Set Randomization (ISR) and Address Space Layout Randomization (ASLR). The former randomizes instruction set for each process, while the latter randomizes the memory address space layout. Both suffer from a number of attacks. In this paper, we advocate and demonstrate that by combining ISR and ASLR effectively, we can offer much more robust protection than each of them individually. However, trivial combination of both schemes is not sufficient. To this end, we make the key observation that system call instructions matter the most to attackers for code injection. Our system, RandSys, uses system call instruction randomization and t...

• Type: Conference
• Year: 2007
• Where: SRDS
• Authors: Xuxian Jiang, Helen J. Wang, Dongyan Xu, Yi-Min Wang
• Keywords: Address Space Layout, Code Injection Attacks, Randomization, SRDS 2007