The Community for Technology Leaders
Computer Security Applications Conference, Annual (2007)
Miami Beach, Florida, USA
Dec. 10, 2007 to Dec. 14, 2007
ISSN: 1063-9527
ISBN: 0-7695-3060-5
pp: 487-500
Heap and stack buffer overflows are still among the most common attack vectors in intrusion attempts. In this paper, we ask a simple question that is surpris- ingly difficult to answer: which bytes contributed to the overflow? By careful observation of all scenarios that may occur in overflows, we identified the information that needs to be tracked to pinpoint the offending bytes. There are many reasons why this is a hard problem. For instance, by the time an overflow is detected some of the bytes may already have been overwritten, creat- ing gaps. Additionally, it is hard to tell the offending bytes apart from unrelated network data. In our solu- tion, we tag data from the network with an age stamp whenever it is written to a buffer. Doing so allows us to distinguish between different bytes and ignore gaps, and provide precise analysis of the offending bytes. By tracing these bytes to protocol fields, we obtain accurate signatures that cater to polymorphic attacks. Keywords: attack analysis, intrusion detection and prevention, honeypots
Herbert Bos, Asia Slowinska, "The Age of Data: Pinpointing Guilty Bytes in Polymorphic Buffer Overflows on Heap or Stack", Computer Security Applications Conference, Annual, vol. 00, no. , pp. 487-500, 2007, doi:10.1109/ACSAC.2007.32
84 ms
(Ver )