1. Program semantics-Aware Intrusion Detection Prof. Tzi-cker Chiueh Computer Science Department Stony Brook University [email_address]

4. Stack Overflow Attack main() { input(); } input() { int i = 0;; int userID[5]; while ((scanf(“%d”, &(userID[I]))) != EOF) i ++; } STACK LAYOUT 128 Return address of input() 100 FP  124 Previous FP 120 Local variable i 116 userID[4] 112 userID[3] 108 userID[2] INT 80 104 userID[1] SP  100 userID[0]

9. Performance Overhead CASH BCC 83.77% 2.23% Edge Detection 143.77% 1.47% Matrix Multiply 92.40% 1.61% Gaussian Elimination 72.19% 3.95% 2D FFT 126.38% 3.26% Volume Rendering 120.00% 1.82% SVDPACK

12. Performance Overhead 1.29% Outlook Express 3.44% PowerPoint 1.23% DHCP Server 1.05% BIND Overhead Program

14. RFS Architecture Transparent to protected network file server NFS Client NFS Client NFS Client RFS Protected NFS Server Mirroring NFS Server

20. PAID Architecture Application Application Compiler System Call Policy System Call Pattern Legitimacy Check User Kernel Compile Time Extraction Run Time Checking

24. Example main() { foo(); foo(); exit (); } foo() { for(….){ sys_foo (); sys_foo (); } } Entry(main) call(foo) return(foo) call(foo) return(foo) Exit() Exit(main) Entry(foo) sys_foo sys_foo Exit(foo)

29. PAID Example main() { foo(); foo(); exit (); } foo() { for(….){ sys_foo (); sys_foo (); } } foo() { for(….){ { int ret; __asm__ (“movl sys_foo_n, %eax” “ int $0x80” “ sys_foo_call_site_1 :” “ movl %eax, ret” … .); } { int ret; __asm__ (“movl sys_foo_n, %eax” “ int $0x80” “ sys_foo_call_site_2 :” “ movl %eax, ret” … .); } } } Entry(main) sys_foo_call_site_1 sys_foo_call_site_2 sys_foo_call_site_1 sys_foo_call_site_2 exit_call_site_1 Exit(main)

31. Ordering Check Only main Buffer Overflow setreuid read open stat write setreuid read open stat write Compromised Call chain Call sequence

32. Ordering and Site Check main Buffer Overflow setreuid read open stat write Compromised Call chain Call sequence int 0x80

33. Ordering, Site and Stack Check (1) main Buffer Overflow setreuid read open stat write Call chain Call sequence int 0x80

34. Ordering, Site and Stack Check (2) main Buffer Overflow exec Call chain Call sequence int 0x80 Stack check passes

35. Random Insertion of Notify Calls Call sequence int 0x80 main Buffer Overflow exec Call chain notify notify Attack failed

39. Vulnerabilities Buffer Overflow Buffer Overflow exec exec notify notify Call chain Call sequence int 0x80 Desired system call follows Immediately Argument replacement

41. Throughput Overhead Apache Qpopper Sendmail Wuftpd PAID PAID/stack PAID/random PAID/stack random 4.89% 5.39% 6.48% 7.09% 5.38% 5.52% 6.03% 6.22% 6.81% 7.73% 9.36% 10.44% 2.23% 2.69% 3.60% 4.38%

44. For more information Project Page: http://www.ecsl.cs.sunysb.edu/PAID Thank You!