A4 Refereed article in a conference publication

A Survey on Internal Interfaces Used by Exploits and Implications on Interface Diversification




AuthorsRauti S, Lauren S, Uitto J, Hosseinzadeh S, Ruohonen J, Hyrynsalmi S, Leppänen V

EditorsBrumley BB, Röning J

Conference nameNordic Conference on Secure IT Systems

PublisherSpringer International Publishing

Publication year2016

Book title Secure IT Systems: 21st Nordic Conference, NordSec 2016, Oulu, Finland, November 2-4, 2016. Proceedings

Series titleLecture Notes in Computer Science (LNCS)

Volume10014

First page 152

Last page168

Number of pages17

ISBN978-3-319-47559-2

eISBN978-3-319-47560-8

ISSN0302-9743

DOIhttps://doi.org/10.1007/978-3-319-47560-8_10

Web address http://dx.doi.org/10.1007/978-3-319-47560-8_10


Abstract

The idea of interface diversification is that internal interfaces in the system are transformed into unique secret instances. On one hand, the trusted programs in the system are accordingly modified so that they can use the diversified interfaces. On the other hand, the malicious code injected into a system does not know the diversification secret, that is the language of the diversified system, and thus it is rendered useless. Based on our study of 500 exploits, this paper surveys the different interfaces that are targeted in malware attacks and can potentially be diversified in order to prevent the malware from reaching its goals. In this study, we also explore which of the identified interfaces have already been covered in existing diversification research and which interfaces should be considered in future research. Moreover, we discuss the benefits and drawbacks of diversifying these interfaces. We conclude that diversification of various internal interfaces could prevent or mitigate roughly 80 % of the analyzed exploits. Most interfaces we found have already been diversified as proof-of-concept implementations but diversification is not widely used in practical systems.



Last updated on 2024-26-11 at 15:31