软件漏洞利用缓解及其对抗技术演化  

Evolution of exploitation and exploit mitigation

作　　者：魏强[1] 韦韬[2] 王嘉捷[3] 

机构地区：[1]解放军信息工程大学信息工程学院,郑州450002 [2]北京大学计算机科学技术研究所,北京100871 [3]中国信息安全测评中心,北京100085

出　　处：《清华大学学报（自然科学版）》2011年第10期1274-1280,共7页Journal of Tsinghua University(Science and Technology)

摘　　要：漏洞利用及其缓解技术一直以来都是漏洞攻防研究的热点之一,主流操作系统及重要编译器均提供了对漏洞利用缓解技术的支持。该文总结了近十几年来,堆保护、地址随机化、沙箱保护等相关技术及研究的进展情况。重点探讨了栈保护技术攻防两端,针对GS、SafeSEH等前后历经的三轮对抗过程。围绕ROP、DeActive、Spray等3个方面的突破与反制,详细阐述数据执行保护技术的演化进程。从截断攻击向量的思路出发,从监测数据完整性、破坏可靠利用、防止控制流重定向、隔离故障隐患等角度出发,将目前的利用缓解技术归纳为:数据完整性检测保护、基于内存特征的保护、基于执行控制的保护和基于故障隔离保护等4个方面。由于存在旁路保护不足、综合防护能力较差等问题,现有的漏洞缓解技术在防护数据流劫持,抵御复合攻击向量方面的存在着不足。Vulnerability exploitation and its mitigation technologies have always been important in vulnerability offense and defense research.Major operating systems and compilers provide support for exploit mitigation.This paper summarizes research on heap protection,address randomization,sandbox protection and other related technologies which have been developed.Among them,the three rounds of combat for GS and SafeSEH for stack protection focus on both offensive and defensive strategies.ROP,DeActive,Spray breakthroughs and counterattacking are analyzed to illustrate the evolution of data execution prevention.The truncation attack vector is used to monitor data integration destruction,undermine reliable exploitation,prevent control flow redirection,and isolate failure risk.Current exploit mitigation methods use data integrity testing protection,memory features removal based protection,execution control based protection,and fault isolation protection.The lack of bypass protection and other protection measure make existing mitigation methods less effective for protecting data flow hijacking and compound attack vectors.

关 键 词：漏洞利用缓解 栈保护 堆保护 地址随机化 沙箱 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]