Base Address Recognition with Data Flow Tracking for Injection Attack Detection

Vulnerabilities such as buffer overflows exist in some programs, and such vulnerabilities are susceptible to address injection attacks. The input data tracking method, which was proposed before, prevents I-data, which are the data derived from the input data, being used as addresses. However, the rules to determine address injection attacks are vague, which produces many false-positives and falsenegatives in detection results. Generally, the data used as an address consist of a base address and an address offset. We propose an architectural technique to prevent Idata overwriting B-data, which are the data used as base addresses in this paper. It dynamically recognizes the Idata and the B-data. Address injection is detected if I-data that are not B-data are used as addresses. We implemented the proposed technique on a Pentium-based Bochs emulator and investigated its detection capability. I believe that the technique is the most accurate injection detection technique proposed thus far...

• Type: Conference
• Year: 2006
• Where: PRDC
• Authors: Satoshi Katsunuma, Hiroyuki Kurita, Ryota Shioya, Kazuto Shimizu, Hidetsugu Irie, Masahiro Goshima, Shuichi Sakai
• Keywords: Address Injection, Address Injection Attacks, Dependable Computing, Input Data, PRDC 2006