This Article 
 Bibliographic References 
 Add to: 
Utilizing Binary Rewriting for Improving End-Host Security
December 2007 (vol. 18 no. 12)
pp. 1687-1699
Conventional methods supporting Java binary security mainly rely on the security of the hosts Java Virtual Machine (JVM). However, malicious Java binaries keep exploiting the vulnerabilities of JVMs, escaping their sandbox restrictions and allowing attacks on end user systems. Administrators must confront the difficulties and dilemmas brought on by security upgrades. On the other hand, binary rewriting techniques have been advanced to allow users to enforce security policies directly on mobile code. They have the advantage of supporting a richer set of security policies and self-constrained written code. However, the high administrative and performance overhead caused by security configuration and code rewriting have prevented rewriters from becoming a practical security tool.In this paper, we address these problems by integrating binary code rewriters with web caching proxies and build the security system called PB-JARS, a Proxy-based JAva Rewriting System. PB-JARS works as a complimentary system to existing JVM security mechanisms by placing another line of defense between users and their end user systems. It gives system administrators centralized security control and management for mobile code and security policies. We evaluated PB-JARS using a real Java binary traffic model derived from analyzing real web trace records. Our results show that adding binary rewriting to web caching system can be very efficient in improving end host security at low cost.

[1] E.G. Sirer et al., “Design and Implementation of a Distributed Virtual Machine for Networked Computers,” Proc. 17th Symp. Operating Systems Principles, pp. 202-216, Dec. 1999.
[2] M. Prasad and T. Chiueh, “A Binary Rewriting Defense against Stack-Based Buffer Overflow Attacks,” Proc. Usenix Ann. Technical Conf., June 2003.
[3] G. Andrews, Link-Time Optimization of Parallel Scientific Programs, seminar abstract, Univ. of Arizona, Nov. 2002.
[4] R. Hastings and B. Joyce, “Purify: A Tool for Detecting Memory Leaks and Access Errors in C and C++ Programs,” Proc. Winter Usenix Conf., pp. 125-138, Jan. 1992.
[5] F.B. Schneider et al., “A Language-Based Approach to Security,” Informatics, pp. 86-101, 2001.
[6] U. Erlingsson and F.B. Schneider, “IRM Enforcement of Java Stack Inspection,” Proc. IEEE Symp. Security and Privacy, May 2000.
[7] L. Gong, Inside Java 2 Platform Security Architecture, API Design, and Implementation. Addison-Wesley Longman, 1999.
[8] D. Evans and A. Twyman, “Flexible Policy-Directed Code Safety,” Proc. IEEE Symp. Security and Privacy, May 1999.
[9] Ú. Erlingsson and F.B. Schneider, “SASI Enforcement of Security Policies: A Retrospective,” Proc. New Security Paradigms Workshop, pp. 87-95, Sept. 1999.
[10] Y. Song and B.D. Fleisch, “Rico: A Security Proxy for Mobile Code,” Computers & Security, vol. 23, no. 4, pp. 338-351, 2004.
[11] Y. Song and B.D. Fleisch, “Sandboxing Mobile Code from Outside the OS,” Proc. 19th ACM Symp. Operating Systems Principles, 2003.
[12] A. Baratloo, N. Singh, and T. Tsai, “Libsafe: Protecting Critical Elements of Stacks,” White Paper 3-21-01, Avaya Labs, Avaya Inc., Feb. 2001.
[13] R. Wahbe et al., “Efficient Software-Based Fault Isolation,” Proc. Symp. Operation System Principles, 1993.
[14] D.C. DuVarney, V.N. Venkatakrishnan, and S. Bhatkar, “SELF: A Transparent Security Extension for ELF Binaries,” Proc. New Security Paradigms Workshop, Aug. 2003.
[15] T. Chiueh and F. Hsu, “RAD: A Compile-Time Solution to Buffer Overflow Attacks,” Proc. 21st Int'l Conf. Distributed Computing, p.409, Apr. 2001.
[16] C. Cowan et al., “Stackguard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks,” Proc. Seventh Usenix Security Symp., pp. 63-78, Jan. 1998.
[17] S. Debray, W. Evans, R. Muth, and B.D. Sutter, “Compiler Techniques for Code Compaction,” ACM Trans. Programming Languages and Systems, vol. 22, no. 2, pp. 378-415, 2000.
[18] C. Cifuentes and M. Emmerik, “UQBT: Adaptable Binary Translation at Low Cost,” Computer, vol. 33, no. 3, pp. 60-66, Mar. 2000.
[19] T. Romer et al., “Instrumentation and Optimization of Win32/Intel Executables Using Etch,” Proc. First Usenix Windows NT Workshop, Aug. 1997.
[20] Byte Code Eng. Library (BCEL), , 2006.
[21] A. Srivastava and A. Eustace, “ATOM: A System for Building Customized Program Analysis Tools,” Proc. ACM Conf. Programming Language Design and Implementation (SIGPLAN '94), May 1994.
[22] L.R. James and E. Schnarr, “EEL: Machine Independent Executable Editing,” Proc. ACM Conf. Programming Language Design and Implementation (SIGPLAN '95), June 1995.
[23] B. Buck and J.K. Hllingsworth, “An API for Runtime Code Patching,” Int'l J. High Performance Computing Applications, vol. 14, no. 4, pp. 317-329, 2000.
[24] J. Almeida and P. Cao, “Measuring Proxy Performance with the Wisconsin Proxy Benchmark,” Technical Report 1373, Computer Sciences Dept, Univ. of Wisconsin, Madison, Apr. 1998.
[25] CERT Security Report #237777,, 2002.
[26] CERT Security Report #447569,, 2005.
[27] Sun Java Documentation, http:/, 2007.
[28] The Measurement Factory Document about Server Workload File Size, FAQpmix4-reply-size-distr/, 2006.
[29] Web Polygraph, http:/, 2006.
[30] Apache Document, http:/, 2006.
[31] The Fourth TMF Cache-Off, http:/cacheoff.measurement-, 2001.
[32] IRCache Project, http:/, 2006.
[33] IntraScan AppletTrap,, 2006.
[34] Finjan Software Documentation, http:/, 2006.
[35] Access Control Documentation, http://groups.northwestern. edu/exec/htmldocs NT_Security.html, 2006.

Index Terms:
Security and Protection, Binary Rewriting, Web Servers, Traffic Analysis, Performance Evaluation
Yougang Song, Brett D. Fleisch, "Utilizing Binary Rewriting for Improving End-Host Security," IEEE Transactions on Parallel and Distributed Systems, vol. 18, no. 12, pp. 1687-1699, Dec. 2007, doi:10.1109/TPDS.2007.1083
Usage of this product signifies your acceptance of the Terms of Use.