| Abstract |
|
Heap and stack buffer overflows are still among the most common attack vectors in intrusion attempts. In this paper, we ask a simple question that is surpris- ingly difficult to answer: which bytes contributed to the overflow? By careful observation of all scenarios that may occur in overflows, we identified the information that needs to be tracked to pinpoint the offending bytes. There are many reasons why this is a hard problem. For instance, by the time an overflow is detected some of the bytes may already have been overwritten, creat- ing gaps. Additionally, it is hard to tell the offending bytes apart from unrelated network data. In our solu- tion, we tag data from the network with an age stamp whenever it is written to a buffer. Doing so allows us to distinguish between different bytes and ignore gaps, and provide precise analysis of the offending bytes. By tracing these bytes to protocol fields, we obtain accurate signatures that cater to polymorphic attacks. Keywords: attack analysis, intrusion detection and prevention, honeypots
|
 Additional Information
|
Citation:
Asia Slowinska, Herbert Bos,
"The Age of Data: Pinpointing Guilty Bytes in Polymorphic Buffer Overflows on Heap or Stack,"
acsac,
pp. 487-500,
Twenty-Third Annual Computer Security Applications Conference (ACSAC 2007),
2007
|
