Data-Oriented Programming

Overview Demo

As control-flow hijacking defenses gain adoption, it is important to understand the remaining capabilities of adversaries via memory exploits. Non-control data exploits are used to mount information leakage attacks or corrupt a few bytes of program memory. The common understanding is that such ex- ploits have limited expressiveness; however, the question is: what is the real expressive power of non-control data attacks? In this paper we show that such attacks are Turing-complete. We present a systematic technique called data-oriented programming (DOP) to to construct expressive non-control data exploits for arbitrary x86 programs. In the experimental evaluation using 9 programs, we identified 7518 data-oriented x86 gadgets and 5052 gadget dispatchers which are the building blocks for DOP. 8 out of 9 real-world programs have gadgets to simulate arbitrary computations and 2 of them are confirmed to be able to build Turing-complete attacks. We build 3 end-to-end attacks to bypass randomization defenses without leaking addresses, to run a network bot which takes commands from the attacker, and to alter the memory permissions. All the attacks work in the presence of ASLR and DEP, demonstrating how the expressiveness offered by DOP significantly empowers the attacker.

The work will be presented at the 37th IEEE Symposium on Security and Privacy in May 2016 (IEEE S&P 2016).

Resources

[1] LLVM tool for automatic gadget identfication
[2] Virtual machine to try DOP attacks

Publication

Data-Oriented Programming: On the Expressiveness of Non-Control Data Attacks [PDF]
Hong Hu, Shweta Shinde, Sendroiu Adrian, Zheng Leong Chua, Prateek Saxena, Zhenkai Liang
In the 37th IEEE Symposium on Security and Privacy, San Jose, CA, US, May 2016

Contributions

DOP. We propose data-oriented programming (DOP), a general method to build Turing-complete non-control data attacks against vulnerable programs. We propose concrete methods to identify data-oriented gadgets, gadget dispatchers and a search strategy to stitch these gadgets.

Prevalence. Our evaluation of 9 real world applications shows that programs do have a large number (1273) of data-oriented gadgets reachable from real-world vulnerabilities, which are required by data-oriented programming operations.

Practicality. We show that Turing-complete non-control data exploits for common memory errors are practical. 8 out of 9 applications provide data-oriented gadgets to build Turing-complete attacks. We build 3 end-to-end non-control data exploits which work even in the presence of DEP and ASLR, demonstrating the effectiveness of data-oriented programming.

People

Hong Hu
Shweta Shinde
Sendriou Adrian
Zheng Leong Chua
Prateek Saxena
Zhenkai Liang

Contact

huhong789 AT gmail DOT com

Acknowledgements

This research is supported in part by the National Research Foundation, Prime Minister's Office, Singapore under its National Cybersecurity R&D Program (Award No. NRF2014NCR-NCR001-21) and administered by the National Cybersecurity R&D Directorate, and in part by a research grant from Symantec.