Control Hijacking - Defenses Flashcards
Describe
Canaries
Placed in stack frames to prevent and detect overwritten return addresses since the value had to be verified against stored value after function execuation
List all control hijacking defenses
- Canaries
- Non-executable memory
- Address Space Layout Randomization
- Control Flow Integrity
Where are the canaries located?
After the return address
List the types of canaries
- Terminator
- Random
- XOR
Describe
Terminator Canary
Contains characters that prevents string functions to overwrite return address (i.e. NULL, CR, LF, EOF)
Describe
Random Canary
A random value chosen at the start and stored in an unmapped location to validate the code
Describe
XOR Canary
Random Value ^ Return Address; one bit must equal 1, not both
When are canaries recompiled?
At runtime
Limitations of Canaries
- Can be learned
- Doesn’t protect against stack smashing
- Bypassable if other pointers are overwritten
Describe
Non-Executable Memory
Memory that isn’t both writable and executable to prevent launchable code injections
Limitations of Non-Executable Memory
- Bypassable if the function is returning into a libc
- Hijacking existing code or gluing fragments still possible
Describe
Address Space Layout Randomization
Maps the stack, heap, and code to random locations in memory
Limitations of Address Space Layout Randomization
- Incurs overhead costs
- Susceptible to address leack and other control hijack attacks
Describe
Control Flow Integrity
Ensures outlined paths in CFG are followed and prevents jumping to invalid locations through indirect calls by reinforcing validity checks during run time
When are CGF built?
At compile time
