On the effectiveness of NX, SSP, RenewSSP, and ASLR against stack buffer overflows

Hector Marco Gisbert, Ismael Ripoll

Research output: Research - peer-reviewChapter

Abstract

Stack Smashing Protector (SSP), Address-Space Layout Randomization (ASLR) and Non-executable (NX) are techniques for defending systems against buffer overflow attacks but not limited to them. These mechanism are available in modern operating systems like Android, GNU/Linux and Windows. Unfortunately, to keep up with the rapidly evolving landscape of cyber-security it is necessary to reassess the effectiveness of these protection techniques to avoid a false sense of security. This paper assess the effectiveness of these techniques against stack buffer overflow exploitation. Our study indicates that the SSP technique is the most effective against stack buffer overflows. On forking servers, the ASLR technique is almost useless on 32-bit architectures due to the limited entropy provided by the size of the address space. The recently proposed technique Renew SSP, which is an improvement of the well known SSP, outperforms the original SSP in all the cases, it is highly effective against the dangerous byte-for-byte attack and on systems with low secret entropy as x86 and ARM.
LanguageEnglish
Title of host publication2014 IEEE 13th International Symposium on Network Computing and Applications
Subtitle of host publicationNCA 2014
PublisherIEEE
Pages145-152
Number of pages8
ISBN (Electronic)9781479953929
ISBN (Print)9781479953936
DOIs
StatePublished - 16 Oct 2014
Externally publishedYes
Event2014 IEEE 13th International Symposium on Network Computing and Applications - Cambridge, United States
Duration: 21 Aug 201423 Aug 2014

Conference

Conference2014 IEEE 13th International Symposium on Network Computing and Applications
Abbreviated titleNCA 2014
CountryUnited States
CityCambridge
Period21/08/1423/08/14

Fingerprint

Entropy
Computer operating systems
Servers
Linux

Keywords

  • servers
  • computer crashes
  • entropy
  • libraries
  • payloads
  • force
  • layout

Cite this

Marco Gisbert, H., & Ripoll, I. (2014). On the effectiveness of NX, SSP, RenewSSP, and ASLR against stack buffer overflows. In 2014 IEEE 13th International Symposium on Network Computing and Applications: NCA 2014 (pp. 145-152). IEEE. DOI: 10.1109/NCA.2014.28
Marco Gisbert, Hector ; Ripoll, Ismael. / On the effectiveness of NX, SSP, RenewSSP, and ASLR against stack buffer overflows. 2014 IEEE 13th International Symposium on Network Computing and Applications: NCA 2014. IEEE, 2014. pp. 145-152
@inbook{1cd3a8c68b674d04b3416ace9655a22c,
title = "On the effectiveness of NX, SSP, RenewSSP, and ASLR against stack buffer overflows",
abstract = "Stack Smashing Protector (SSP), Address-Space Layout Randomization (ASLR) and Non-executable (NX) are techniques for defending systems against buffer overflow attacks but not limited to them. These mechanism are available in modern operating systems like Android, GNU/Linux and Windows. Unfortunately, to keep up with the rapidly evolving landscape of cyber-security it is necessary to reassess the effectiveness of these protection techniques to avoid a false sense of security. This paper assess the effectiveness of these techniques against stack buffer overflow exploitation. Our study indicates that the SSP technique is the most effective against stack buffer overflows. On forking servers, the ASLR technique is almost useless on 32-bit architectures due to the limited entropy provided by the size of the address space. The recently proposed technique Renew SSP, which is an improvement of the well known SSP, outperforms the original SSP in all the cases, it is highly effective against the dangerous byte-for-byte attack and on systems with low secret entropy as x86 and ARM.",
keywords = "servers, computer crashes, entropy, libraries, payloads, force, layout",
author = "{Marco Gisbert}, Hector and Ismael Ripoll",
year = "2014",
month = "10",
doi = "10.1109/NCA.2014.28",
isbn = "9781479953936",
pages = "145--152",
booktitle = "2014 IEEE 13th International Symposium on Network Computing and Applications",
publisher = "IEEE",
address = "United States",

}

Marco Gisbert, H & Ripoll, I 2014, On the effectiveness of NX, SSP, RenewSSP, and ASLR against stack buffer overflows. in 2014 IEEE 13th International Symposium on Network Computing and Applications: NCA 2014. IEEE, pp. 145-152, 2014 IEEE 13th International Symposium on Network Computing and Applications, Cambridge, United States, 21/08/14. DOI: 10.1109/NCA.2014.28

On the effectiveness of NX, SSP, RenewSSP, and ASLR against stack buffer overflows. / Marco Gisbert, Hector; Ripoll, Ismael.

2014 IEEE 13th International Symposium on Network Computing and Applications: NCA 2014. IEEE, 2014. p. 145-152.

Research output: Research - peer-reviewChapter

TY - CHAP

T1 - On the effectiveness of NX, SSP, RenewSSP, and ASLR against stack buffer overflows

AU - Marco Gisbert,Hector

AU - Ripoll,Ismael

PY - 2014/10/16

Y1 - 2014/10/16

N2 - Stack Smashing Protector (SSP), Address-Space Layout Randomization (ASLR) and Non-executable (NX) are techniques for defending systems against buffer overflow attacks but not limited to them. These mechanism are available in modern operating systems like Android, GNU/Linux and Windows. Unfortunately, to keep up with the rapidly evolving landscape of cyber-security it is necessary to reassess the effectiveness of these protection techniques to avoid a false sense of security. This paper assess the effectiveness of these techniques against stack buffer overflow exploitation. Our study indicates that the SSP technique is the most effective against stack buffer overflows. On forking servers, the ASLR technique is almost useless on 32-bit architectures due to the limited entropy provided by the size of the address space. The recently proposed technique Renew SSP, which is an improvement of the well known SSP, outperforms the original SSP in all the cases, it is highly effective against the dangerous byte-for-byte attack and on systems with low secret entropy as x86 and ARM.

AB - Stack Smashing Protector (SSP), Address-Space Layout Randomization (ASLR) and Non-executable (NX) are techniques for defending systems against buffer overflow attacks but not limited to them. These mechanism are available in modern operating systems like Android, GNU/Linux and Windows. Unfortunately, to keep up with the rapidly evolving landscape of cyber-security it is necessary to reassess the effectiveness of these protection techniques to avoid a false sense of security. This paper assess the effectiveness of these techniques against stack buffer overflow exploitation. Our study indicates that the SSP technique is the most effective against stack buffer overflows. On forking servers, the ASLR technique is almost useless on 32-bit architectures due to the limited entropy provided by the size of the address space. The recently proposed technique Renew SSP, which is an improvement of the well known SSP, outperforms the original SSP in all the cases, it is highly effective against the dangerous byte-for-byte attack and on systems with low secret entropy as x86 and ARM.

KW - servers

KW - computer crashes

KW - entropy

KW - libraries

KW - payloads

KW - force

KW - layout

U2 - 10.1109/NCA.2014.28

DO - 10.1109/NCA.2014.28

M3 - Chapter

SN - 9781479953936

SP - 145

EP - 152

BT - 2014 IEEE 13th International Symposium on Network Computing and Applications

PB - IEEE

ER -

Marco Gisbert H, Ripoll I. On the effectiveness of NX, SSP, RenewSSP, and ASLR against stack buffer overflows. In 2014 IEEE 13th International Symposium on Network Computing and Applications: NCA 2014. IEEE. 2014. p. 145-152. Available from, DOI: 10.1109/NCA.2014.28