12th Pacific Rim International Symposium on Dependable Computing (PRDC'06)
Base Address Recognition with Data Flow Tracking for Injection Attack Detection
Riverside, California
December 18-December 20
ISBN: 0-7695-2724-8
Vulnerabilities such as buffer overflows exist in some programs, and such vulnerabilities are susceptible to address injection attacks. The input data tracking method, which was proposed before, prevents I-data, which are the data derived from the input data, being used as addresses. However, the rules to determine address injection attacks are vague, which produces many false-positives and falsenegatives in detection results. Generally, the data used as an address consist of a base address and an address offset. We propose an architectural technique to prevent Idata overwriting B-data, which are the data used as base addresses in this paper. It dynamically recognizes the Idata and the B-data. Address injection is detected if I-data that are not B-data are used as addresses. We implemented the proposed technique on a Pentium-based Bochs emulator and investigated its detection capability. I believe that the technique is the most accurate injection detection technique proposed thus far.
Index Terms:
security, vulnerability, injection attack, base address, data flow tracking
Citation:
Satoshi Katsunuma, Hiroyuki Kurita, Ryota Shioya, Kazuto Shimizu, Hidetsugu Irie, Masahiro Goshima, Shuichi Sakai, "Base Address Recognition with Data Flow Tracking for Injection Attack Detection," prdc, pp.165-172, 12th Pacific Rim International Symposium on Dependable Computing (PRDC'06), 2006