Fast and practical instruction-set randomization for commodity systems

Instruction-set randomization (ISR) is a technique based on randomizing the "language" understood by a system to protect it from code-injection attacks. Such attacks were used by many computer worms in the past, but still pose a threat as it was confirmed by the recent Conficker worm outbreak, and the latest exploits targeting some of Adobe's most popular products. This paper presents a fast and practical implementation of ISR that can be applied on currently deployed software. Our solution builds on a binary instrumentation tool to provide an ISR-enabled execution environment entirely in software. Applications are randomized using a simple XOR function and a 16-bit key that is randomly generated every time an application is launched. Shared libraries can be also randomized using separate keys, and their randomized versions can be used by all applications running under ISR. Moreover, we introduce a key management system to keep track of the keys used in the system. To t...

• Type: Journal
• Year: 2010
• Where: ACSAC
• Authors: Georgios Portokalidis, Angelos D. Keromytis
• Keywords: ACSAC 2010, Conficker Worm Outbreak, Randomized, Security Privacy, Shared Libraries