Countering code-injection attacks with instruction-set randomization

摘要: We describe a new, general approach for safeguarding systems against any type of code-injection attack. apply Kerckhoff's principle, by creating process-specific randomized instruction sets (e.g., machine instructions) the system executing potentially vulnerable software. An attacker who does not know key to randomization algorithm will inject code that is invalid processor, causing runtime exception. To determine difficulty integrating support proposed mechanism in operating system, we modified Linux kernel, GNU binutils tools, and bochs-x86 emulator. Although performance penalty significant, our prototype demonstrates feasibility approach, should be directly usable on suitable-modified processor Transmeta Crusoe).Our equally applicable code-injecting attacks scripting interpreted languages, e.g., web-based SQL injection. demonstrate this modifying Perl interpreter permit script execution. The case minimal. Where feasible (i.e., an emulated environment, presence programmable or specialized hardware, languages), it can serve as low-overhead protection mechanism, easily complement other mechanisms.