e-NeXSh: Achieving an Effectively Non-Executable Stack and Heap via System-Call Policing

We present e-NeXSh, a novel security approach that utilises kernel and LIBC support for efficiently defending systems against process-subversion attacks. Such attacks exploit vulnerabilities in software to override its program control-flow and consequently invoke system calls, causing out-of-process damage. Our technique defeats such attacks by monitoring all LIBC function and system-call invocations, and validating them against process-specific information that strictly prescribes the permissible behaviour for the program (unlike general sandboxing techniques that require manually maintained, explicit policies, we use the program code itself as a guideline for an implicit policy). Any deviation from this behaviour is considered malicious, and we halt the attack, limiting its damage to within the subverted process. We implemented e-NeXSh as a set of modifications to the linux-2.4.18-3 kernel and a new user-space shared library (e-NeXSh.so). The technique is transparent, requiring ...

• Type: Conference
• Year: 2005
• Where: ACSAC
• Authors: Gaurav S. Kc, Angelos D. Keromytis
• Keywords: ACSAC 2005, Attacks Exploit Vulnerabilities, General Sandboxing Techniques, Process-subversion Attacks, Security Privacy