DAY, David, ZHAO, Zhengxu and MA, Minhua (2010). Detecting Return-to-libc Buffer Overflow Attacks Using Network Intrusion Detection Systems. In: Digital Society , 2010 . ICDS '10 . Fourth International Conference on. IEEE Computer Society.
Abstract
There has been a significant amount of research
recently into methods of protecting systems from buffer
overflow attacks by detecting stack injected shell code. The
majority of the research focuses on developing algorithms or
signatures for detecting polymorphic and metamorphic
payloads. However much of this problem has already been
solved through the mainstream use of host based protection
mechanisms e.g. Data Execution Prevention (DEP) and
Address Space Randomization (ASLR). Many hackers are
now using the more inventive attack methods e.g., return-tolibc,
which do not inject shell code onto the stack and thus
evade DEP and common shell code detection mechanisms.
The purpose of this work is to propose a series of generic
signatures that could be used to detect network born returnto-
libc attacks. To this end we outline how we performed a
return-to-libc network based attack, which bypasses DEP
and common IDS signatures, before suggesting an efficient
signature for detection of similar return-to-libc attacks.
More Information
Metrics
Altmetric Badge
Dimensions Badge
Share
Actions (login required)
![]() |
View Item |