" https://drive.google.com/open?id=1Bv8HUuXR792FJ0vX6Oi-ztLarGWtojoJ

PROLEPSIS: Binary analysis and instrumentation of IoT software for control-flow integrity


Gianluca Roascio, Nicolò Maunero

Presentation title

PROLEPSIS: Binary analysis and instrumentation of IoT software for control-flow integrity

Authors

Gianluca Roascio, Nicolò Maunero

Institution(s)

Polytechnic of Turin

Presentation type

Technical presentation

Abstract

Nowadays, the growing pervasiveness of digital components and their interconnection in the so-called Internet of Things, raises serious questions regarding security and integrity not only of the data exchanged, but also of the devices themselves and the software they run. Code-Reuse Attacks (CRA) are one of the most powerful binary attack paradigms, aiming to exploit memory vulnerabilities such as buffer overflows to force the application to execute an unintended sequence of instructions present in memory. To counter such a kind of attacks, ensuring the program’s control- flow integrity (CFI) appears to be the most promising solution presented so far. A plethora of CFI implementations have been offered in the literature and by vendors, based on control-flow monitors located at the software level or even into hardware extensions. However, many proposed solutions opt for coarse-grained checks, or insert enforcement before all flow transfers. For software running on IoT platforms, where resources are usually limited, protections can increase the footprint in an unsustainable way.

This talk presents PROLEPSIS, an automated binary code analysis tool for IoT applications written for ARM platforms. With an optimized search, the tool is able to identify only those executable point (control-flow instructions) that are really at risk of control-flow hijacking. Each recognized insecure point is instrumented according to a custom technique of choice, either based on a software or a hardware monitor, depending on the specific application needs.


Additional material

  • Presentation slides: [pdf]