TU Darmstadt / ULB / TUbiblio

POSTER: Control-Flow Integrity for Smartphones

Davi, Lucas and Dmitrienko, Alexandra and Egele, Manuel and Fischer, Thomas and Holz, Thorsten and Hund, Ralf and Nürnberger, Stefan and Sadeghi, Ahmad-Reza (2011):
POSTER: Control-Flow Integrity for Smartphones.
In: 18th ACM Conference on Computer and Communications Security (CCS'11), ACM, [Conference or Workshop Item]

Abstract

Despite extensive research over the last two decades, runtime attacks on software are still prevalent. Recently, smartphones, of which millions are in use today, have become an attractive target for adversaries. However, existing solutions are either ad-hoc or limited in their effectiveness.

In this poster, we present a general countermeasure against runtime attacks on smartphone platforms. Our approach makes use of control-flow integrity (CFI), and tackles unique challenges of the ARM architecture and smartphone platforms. Our framework and implementation is efficient, since it requires no access to source code, performs CFI enforcement on-the-fly during runtime, and is compatible to memory randomization and code signing/encryption. We chose Apple iPhone for our reference implementation, because it has become an attractive target for runtime attacks. Our performance evaluation on a real iOS device demonstrates that our implementation does not induce any notable overhead when applied to popular iOS applications.

Item Type: Conference or Workshop Item
Erschienen: 2011
Creators: Davi, Lucas and Dmitrienko, Alexandra and Egele, Manuel and Fischer, Thomas and Holz, Thorsten and Hund, Ralf and Nürnberger, Stefan and Sadeghi, Ahmad-Reza
Title: POSTER: Control-Flow Integrity for Smartphones
Language: German
Abstract:

Despite extensive research over the last two decades, runtime attacks on software are still prevalent. Recently, smartphones, of which millions are in use today, have become an attractive target for adversaries. However, existing solutions are either ad-hoc or limited in their effectiveness.

In this poster, we present a general countermeasure against runtime attacks on smartphone platforms. Our approach makes use of control-flow integrity (CFI), and tackles unique challenges of the ARM architecture and smartphone platforms. Our framework and implementation is efficient, since it requires no access to source code, performs CFI enforcement on-the-fly during runtime, and is compatible to memory randomization and code signing/encryption. We chose Apple iPhone for our reference implementation, because it has become an attractive target for runtime attacks. Our performance evaluation on a real iOS device demonstrates that our implementation does not induce any notable overhead when applied to popular iOS applications.

Title of Book: 18th ACM Conference on Computer and Communications Security (CCS'11)
Publisher: ACM
Uncontrolled Keywords: Security
Divisions: 20 Department of Computer Science
20 Department of Computer Science > System Security Lab
LOEWE
LOEWE > LOEWE-Zentren
LOEWE > LOEWE-Zentren > CASED – Center for Advanced Security Research Darmstadt
Date Deposited: 04 Aug 2016 10:13
Identification Number: TUD-CS-2011-0210
Related URLs:
Export:

Optionen (nur für Redakteure)

View Item View Item