Install-time Vaccination of Windows Executables to Defend Against Stack Smashing Attacks

Abstract--Stack smashing is still one of the most popular techniques for computer system attack. In this work, we present an antistack-smashing defense technique for Microsoft Windows systems. Our approach works at install-time, and does not rely on having access to the source-code: The user decides when and which executables to vaccinate. Our technique consists of instrumenting a given executable with a mechanism to detect stack smashing attacks. We developed a prototype implementing our technique and verified that it successfully defends against actual exploit code. We then extended our prototype to vaccinate DLLs, multithreaded applications, and DLLs used by multithreaded applications, which present significant additional complications. We present promising performance results measured on SPEC2000 benchmarks: Vaccinated executables were no more than 8 percent slower than their unvaccinated originals.

• Type: Conference
• Year: 2004
• Where: SEC
• Authors: Danny Nebenzahl, Avishai Wool
• Keywords: Antistack-smashing Defense Technique, Multithreaded Applications, SEC 2004, SEC 2007, Stack Smashing Attacks