{"id":996,"date":"2016-07-06T02:18:18","date_gmt":"2016-07-06T02:18:18","guid":{"rendered":"http:\/\/www.inforsec.org\/wp\/?p=996"},"modified":"2024-07-31T17:57:16","modified_gmt":"2024-07-31T09:12:16","slug":"xede-practical-exploit-early-detection","status":"publish","type":"post","link":"http:\/\/202.112.238.40\/wp\/?p=996","title":{"rendered":"Xede: Practical Exploit Early Detection"},"content":{"rendered":"

Xede: Practical Exploit<\/b><\/strong>\u00a0<\/b><\/strong>Early Detection<\/b><\/strong>\u00a0<\/b><\/strong>[1]<\/b><\/strong><\/p>\n

\u4f5c\u8005\uff1aMeining Nie (Institute of Software, CAS)<\/p>\n

As all walks of life rely heavily on IT systems, Advanced Persistent Threat (APT) has become one of the most serious information security issues, posting a great threat on the government departments, research institutions, military organizations and industry enterprises.\u00a0APT often employs zero-day (or recently-disclosed) vulnerabilities in popular programs, such as Microsoft Office\u00a0[2], to penetrate the defenses of its target, and\u00a0usually combines code reuse and code injection techniques to bypass exploit-mitigation mechanisms deployed in modern operating systems.<\/p>\n

<\/p>\n

Traditional signature-based malware detection systems have increasingly become ineffective against APT. Instead, an effective defense mechanism should focus on the early detection of exploits. Exploits often violate some code or control-flow integrity. For example, code injection<\/i><\/em>\u00a0attacks introduce new (malicious) code into the system, while code reuse<\/i><\/em>\u00a0attacks manipulate the control flow to execute its gadgets. An exploit detection system checking these integrities could detect a wide spectrum of exploits.<\/p>\n

However, the practical exploit detection is still a challenging problem\u00a0in several\u00a0ways, including:<\/p>\n

    \n
  1. Almost all thepopular applicationsgenerate dynamic code to improve performance or extend the functionality. For example, as shown in table 1, to\u00a0load a normal doc<\/i><\/em>\u00a0file, word.exe<\/i><\/em>\u00a0may generate about 76 KB codes which are very similar to the alien codes injected by the attacker. That\u00a0may cause high false positives.<\/li>\n
  2. Manyapplications replace or adjust the return addresses on the stack for obscure reasons. These irregular behaviors disrupt security mechanisms expecting\u00a0the call<\/i><\/em>\u00a0and ret<\/i><\/em>\u00a0instructions to be matched. Table 1 shows that opening a normal\u00a0pdf<\/i><\/em>\u00a0file could lead to about 85,000 false positives.<\/li>\n
  3. Benign windows applications have many short code sequences that resemble gadgetsused in code reuse attacks,\u00a0and are wrongfully detected as such by existing schemes\u00a0[3]. For instance, as shown in table 1, we observe around 5,000 false positives when simple existing detection schemes are employed to analyze one PDF file.<\/li>\n
  4. Many exploitdetectors launch samples in a sandbox<\/i><\/em>to analyze their runtime behaviors. But exploits are always tied to specific run-time environments. If the exploits fail to compromise the system, they also fail to conduct malicious behaviors, so that they may bypass the detection. Our experiments reveal that around 70% of the malware samples are unstable.\u00a0Table 1 shows that\u00a0the success rate of pdf<\/i><\/em>\u00a0exploits in our dataset is less than 10%.<\/li>\n<\/ol>\n\n\n\n\n\n
    Sample type<\/strong><\/td>\nSize of benign DGC<\/strong><\/td>\nNumber of benign\u00a0mismatched call-ret<\/strong><\/td>\nNumber of benign gadgets<\/strong><\/td>\nExploit success rate<\/strong><\/td>\n<\/tr>\n
    doc<\/td>\n78,216<\/td>\n4,561<\/td>\n4,221<\/td>\n74.14%<\/td>\n<\/tr>\n
    pdf<\/td>\n24,308<\/td>\n84,798<\/td>\n4,997<\/td>\n9.52%<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    Table 1. Possible false-positives in doc<\/i><\/em>\u00a0and pdf<\/i><\/em><\/p>\n

    Facing the problems above, by analyzing\u00a0the control flow transfers caused by exploits, we\u00a0present a practical exploit early detection system called Xede, to comprehensively detect code reuse and code injection attacks. Figure 1 shows the architecture of Xede.\u00a0It has three major detection engines:<\/p>\n

    \"123\"<\/a><\/p>\n

    Figure 1. The Architecture of Xede<\/p>\n

      \n
    1. Exploit exception detector<\/i><\/em>analyzes the program exceptions to discover the attack attemptswhich fail to compromise the systems.\u00a0We intercept the page fault handler to detect the memory access violations caused by exploits. We also analyze the handling process of page faults to filter out those caused by paging mechanism\u00a0or lazy-allocation algorithm\u00a0to eliminate\u00a0false positives.<\/li>\n
    2. Code injection detector<\/i><\/em>detects (malicious) injected code by comparing the addresses of executed instructions against a list of benign code regions.We hook a kernel routine to intercept the executable module loading events. Then we parse the PE structure of the module which is being loaded to locate the address and size of its benign code regions (that is, its executable-sections). To reduce false positives, we also hook the APIs about page allocation, page protection modification and heap allocation, so that this list\u00a0of benign code regions\u00a0can be\u00a0timely updated with the legitimate dynamically generated code\u00a0(DGC)\u00a0as well.<\/li>\n
    3. Code injection attacks are often combined with code reuse attacks to bypass the DEP protection.<\/i>Code reuse detector<\/i><\/em>focuses on the detection of code reuse techniques.\u00a0For ROP detection, we maintain\u00a0a shadow stack<\/i><\/em>\u00a0for return addresses to discover the mismatched call<\/i><\/em>–ret<\/i><\/em>\u00a0instructions, like ROPdefender<\/i><\/em>\u00a0[4]\u00a0does. For JOP detection, we measure\u00a0the length of consecutively executed\u00a0instruction sequences to discover the gadget-chains, like kBouncer<\/i><\/em>\u00a0[5]\u00a0does. But we have improved\u00a0the shadow stack in many ways, including the judgement strategy, the matching algorithm\u00a0and the search pattern. We have also improved the gadget counting method. So that we can accommodate all the previously-mentioned exploit-like code patterns which widely exist in today’s benign programs.<\/li>\n<\/ol>\n

      We build\u00a0a prototype of Xede\u00a0and download\u00a012501 exploits from some\u00a0public databases to evaluate its\u00a0effectiveness. Table 2\u00a0shows that\u00a0Xede accurately detects all of these exploits. In particular, among these exploits, 51.47% exploits adopt the ROP techniques.<\/p>\n\n\n\n\n\n\n\n
      Exploit techniques<\/strong><\/td>\nSample proportion<\/strong><\/td>\n<\/tr>\n
      code injection<\/td>\n75%<\/td>\n<\/tr>\n
      ret-based gadgets<\/td>\n51.47%<\/td>\n<\/tr>\n
      jmp-based gadgets<\/td>\n19.85%<\/td>\n<\/tr>\n
      exploit exception<\/td>\n25%<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      Table 2. Exploit sample proportion with different exploitation techniques<\/p>\n

      We also\u00a0integrate Xede into the mail server of a university in China to detect exploits in emails, and deploy Xede on the Internet as a public service\u00a0[6]\u00a0to scan user-provided files.\u00a0Xede detects 136 exploits\u00a0out of 11,385 collected samples. Among which only 44.12% of exploits successfully succeed, which means that real-world exploits heavily rely on special system environments.\u00a0We use some commercial\u00a0anti-virus software to conform that many exploits can easily evade the detection of signature matching nowadays. As shown in table 3, Kaspersky achieves the lowest false negative that is still higher than 15%.<\/p>\n\n\n\n\n\n\n\n
      AV software<\/strong><\/td>\nVersion<\/strong><\/td>\nDate of DB update<\/strong><\/td>\nFalse negative<\/strong><\/td>\n<\/tr>\n
      Kaspersky<\/td>\n15.0.2.361<\/td>\n24\/05\/2015<\/td>\n21<\/td>\n<\/tr>\n
      McAfee<\/td>\n18.0.204<\/td>\n24\/05\/2015<\/td>\n49<\/td>\n<\/tr>\n
      Avira<\/td>\n15.0.10.434<\/td>\n24\/05\/2015<\/td>\n22<\/td>\n<\/tr>\n
      Norton<\/td>\n22.2.0.31<\/td>\n24\/05\/2015<\/td>\n32<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      Table 3. False negatives of commercial anti-virus software<\/p>\n

      We\u00a0evaluate the overheads of Xede in an Ubuntu 12.04 server\u00a0with 3.07GHz Intel Xeon X5675 CPU and 32GB memory.\u00a0Figure 2\u00a0illustrates\u00a0that the rate of memory consumption\u00a0and CPU usage are only 1.1% and 0.12%, respectively.<\/p>\n

      \"22\"<\/a><\/p>\n

      Figure 2. Resource consumption of Xede<\/p>\n

      Our evaluation demonstrates that Xede is highly effective and practical in detecting exploits.<\/p>\n

      \u53c2\u8003\u6587\u732e\uff1a<\/b><\/strong><\/p>\n

      [1].Meining Nie, Purui Su, et al. Xede: Practical Exploit Early Detection. RAID,<\/p>\n

      [2].Secunia: Secunia vulnerability review 2015. Tech. rep., Secunia (2014), http:\/\/secunia.com\/vulnerability-review\/<\/a>.<\/p>\n

      [3].Schuster, Felix, et al. Evaluating the effectiveness of current anti-ROP defenses.RAID,<\/p>\n

      [4].Davi, Lucas, et al. ROPdefender: A detection tool to defend against return-oriented programming attacks. ACM, 2011.<\/p>\n

      [5].Pappas, Vasilis, et al. Transparent ROP exploit mitigation using indirect branch tracing. USENIX Security,<\/p>\n

      [6].TCA Malware Analysis platform.<\/p>\n

      [7].This research has been presented at the 18th International Symposium on Research in Attacks, Intrusions and Defenses(RAID 2015), published by Springer International, can be downloaded at http:\/\/link.springer.com\/chapter\/10.1007\/978-3-319-26362-5_10<\/u><\/a>.<\/p>\n

      [8].\u539f\u6587PDF\u4e0b\u8f7d\uff1aXede: Practical Exploit<\/b><\/strong>\u00a0<\/b><\/strong>Early Detection<\/b><\/strong><\/a><\/p>\n

      \u4f5c\u8005\u7b80\u4ecb\uff1a<\/b><\/strong><\/p>\n

      Meining Nie is a Research Assistant in the Institute of Software, Chinese Academy of Sciences\u00a0(ISCAS). His research focuses on\u00a0systems security\u00a0and malware analysis.\u00a0He earned his Ph.D. in Computer Science from ISCAS\u00a0(2016) in the area of malware analysis based on virtualization technology, studying under Prof.\u00a0Purui Su. He received\u00a0his B.E.\u00a0degree\u00a0in Computer Science from University of Electronic Science and Technology of China in 2010, and won the Second Prize\u00a0of National College Student Information Security Contest in 2008.<\/p>\n","protected":false},"excerpt":{"rendered":"

      Xede: Practical Exploit\u00a0Early Detection\u00a0[1] \u4f5c\u8005\uff1aMei… Continue reading → <\/span><\/a><\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-996","post","type-post","status-publish","format-standard","hentry","category-research"],"_links":{"self":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/996","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=996"}],"version-history":[{"count":2,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/996\/revisions"}],"predecessor-version":[{"id":6488,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/996\/revisions\/6488"}],"wp:attachment":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=996"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=996"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=996"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}