#HITBGSEC
Over the years numerous exploit mitigations have been developed and many are shipped with common operating systems or third party security software. Yet, we still see weaponized exploits used effectively to infiltrate systems and bypass all existing mitigations. In this presentation a novel hardware-assisted approach will be presented for detecting and stopping exploits using Hardware-Based CPU tracing and a practical fine-grained CFI approach.
Some recent work has shown hardware-assisted methods to be very promising as a new anti-exploit technology, most research focusing on PMU (Performance events) based methods. The novel approach presented in this talk includes the use of tracing rather than PMU events. The method consists of tracing every instruction the CPU executes and following the exact control flow of a program. This is achieved using a new feature in modern CPUs which is intended for software tracing and is called “Processor Trace”. The result of using this approach is a practical, working system on Microsoft Windows environments that is able to detect code reuse (ROP) attacks with good accuracy and performance, in a way that was not possible with older CPU generations. This approach is unique in the sense that it allows checking for fine-grained CFI in a practical and un-intrusive manner with relatively fast analysis. In the talk, the research process leading to the working prototype will be explained and the results will be presented including a detailed drill-down of the different parts of the developed system.
The talk will include a demo of the system, which is able to scan popular file formats such as Microsoft Word, PowerPoint, PDF etc. and detect if the file contains an exploit. I will talk about obstacles encountered during the research and how they were overcome. For example: how the analysis process was heavily optimized to reduce the time it takes to analyze a trace from several hours per file to a matter of seconds, or how to deal with exception-handling and windows user-mode callbacks that cause irregularities from a control-flow perspective.
Some more details on the technique
The new features used are called “Processor Trace” on Intel Architecture, and “Coresight” for ARM-based processors and enable fast tracing of every branch taken during the execution of a program with little performance impact on the traced application. This trace allows reconstruction of every line of assembly code that is executed at the processor level. This way we can write systems that see everything an application does in near real-time.
The ability to see every branch and application takes has immediate implications on many aspects of security the most dramatic being – a new promising anti-exploitation approach. It allows for transparent “Fine grained” Control flow integrity and thus detection of many kinds of malicious behavior including Code reuse attacks (ROP/JOP etc.) as well as exploits attempting to write to dynamically generated code pages (JIT), Use-after-free exploits , flow hardening and much more.
===
Shlomi Oberman is an independent security researcher with over a decade of experience in security research. Shlomi spent many years in the attacker’s shoes for different companies and knows too well how hard it is to stop a determined attacker. In the past years his interest has shifted from breaking things to helping stop exploits – while software is written and after it has shipped. Shlomi is a veteran of the IDF Intelligence Corps and used to head the security research efforts at NSO Group and other companies.
---
Ron has been staring at binary code for over the past decade, occasionally running it. Having spent a lot of his time doing mathematics, he enjoys searching for algorithmic opportunities in security research and reverse engineering. He is a graduate of the Israel Defense Forces’ Talpiot program. In his spare time he works on his jump shot.