Blender: Self-randomizing Address Space Layout for Android Apps

摘要: In this paper, we first demonstrate that the newly introduced Android RunTime (ART) in latest versions (Android 5.0 or above) exposes a new attack surface, namely, “return-to-art” (ret2art) attack. Unlike traditional return-to-library attacks, ret2art abuses framework APIs (e.g., API to send SMS) as payloads conveniently perform malicious operations. This along with weakened ASLR implementation system, makes successful exploiting of vulnerable apps much easier. To mitigate threat and provide self-protection for apps, propose user-level solution called Blender, which is able self-randomize address space layout apps. Specifically, an app using our Blender randomly rearranges loaded libraries runtime executable code app’s process, achieving higher memory entropy compared vanilla app. requires no changes nor underlying Linux kernel, thus non-invasive easy-to-deploy solution. Our evaluation shows only incurs around 6 MB footprint increase does not affect other without system. It increases 0.3 s starting delay, imposes negligible CPU battery overheads.