Protecting Bare-Metal Systems from Remote Exploitation
Abstract
The Internet of Things is deploying large numbers of bare-metal systems that have no protection against memory corruption and control-flow hijacking attacks. These attacks have enabled unauthorized entry to hotel rooms, malicious control of unmanned aerial vehicles, and invasions of privacy. Using static and dynamic analysis these systems can utilize state-of-the-art testing techniques to identify and prevent memory-corruption errors and employ defenses against memory corruption and control-flow hijacking attacks in bare-metal systems that match or exceed those currently employed on desktop systems. This is shown using three case studies.(1) EPOXY which, automatically applies data execution prevention, diversity, stack defenses, and separating privileged code from unprivileged code using a novel technique called privileged overlaying. These protections prevent code injection attacks, and reduce the number of privileged instruction to 0.06% verses an unprotected application.(2) Automatic Compartments for Embedded Systems (ACES), which automatically creates compartments that enforce data integrity and code isolation within bare-metal applications. ACES enables exploring policies to best meet security and performance requirements for individual applications. Results show ACESs can form 10s of compartments within a single thread and has a 15% runtime overhead on average.(3) HALucinator breaks the requirement for specialized hardware to perform baremetal system testing. This enables state-of-the-art testing techniques –e.g., coverage based fuzzing – to scale with the availability of commodity computers, leading to the discovery of exploitable vulnerabilities in bare-metal systems.Combined, these case studies advance the security of embedded system several decades and provide essential protections for today’s connected devices.
Degree
Ph.D.
Advisors
Payer, Purdue University.
Subject Area
Computer science|Electrical engineering|Information Technology|Web Studies
Off-Campus Purdue Users:
To access this dissertation, please log in to our
proxy server.