Efficient and Effective Buffer Overflow Protection on ARM Processors

Trusted Platform Module (TPM) has gained its popularity in computing systems as a hardware security approach. TPM provides the boot time security by verifying the platform integrity including hardware and software. However, once the software is loaded, TPM can no longer protect the software execution. In this work, we propose a dynamic TPM design, which performs control flow checking to protect the program from runtime attacks. The control flow checker is integrated at the commit stage of the processor pipeline. The control flow of program is verified to defend the attacks such as stack smashing using buffer overflow and code reuse. We implement the proposed dynamic TPM design in FPGA to achieve high performance, low cost and flexibility for easy functionality upgrade based on FPGA. In our design, neither the source code nor the Instruction Set Architecture (ISA) needs to be changed. The benchmark simulations demonstrate less than 1% of performance penalty on the processor, and an effective software protection from the attacks.

The buffer overflow attack is the single most dominant and lethal form of security exploits as evidenced by recent worm outbreaks such as Code Red and SQL Slammer. In this paper, we propose a new architectural solution to detect and deter the buffer overflow exploit. The idea is that the buffer overflow attacks usually exhibit abnormal symptoms in the system. This kind of unusual behavior can be simply detected by checking the integrity of instruction and data references at runtime, avoiding the potential data or control corruptions made by such attacks. Both the hardware cost and the performance penalty of enforcing the integrity rules are negligible. By performing detailed execution-driven simulations on the programs selected from SPEC CPU2000 benchmark, we evaluate the effectiveness of the proposed safety guards. By randomly corrupting stack and other data sections of a process’s address space during simulation, we create various buffer overflow scenarios, including both stack and heap smashing. Experimental data shows that enforcing two safety guards not only reduces the number of system failures substantially but it also circumvents virtually all forms of malicious code execution made by stack smashing or function pointer corruptions.KeywordsReturn AddressMalicious CodeBuffer OverflowData CorruptionBranch TargetThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Stack buffer overflow is a serious security threat to program execution. A malicious attacker may overwrite the return address of a procedure to alter its control flow and hence change its functionality. While a number of hardware and/or software based protection schemes have been developed, these countermeasures introduce sizable overhead in performance and energy, thus limiting their applicability to embedded systems. To reduce such overhead, our goal is to develop a low-cost scheme to filter out potential stack buffer overflow attacks. Our observation is that attacks to control flow will trigger certain microarchitectural events, such as mis-predictions in the return address stack or misses in the instruction cache. We therefore propose a hardware-based scheme to monitor these events. Only upon detecting any suspicious behavior, a more precise but costly diagnosis scheme will be invoked to thoroughly check control flow integrity. Meanwhile, to further reduce the rate of false positives of the security filter, we propose three enhancements to the return address stack, instruction prefetch engine and instruction cache, respectively. The results show that these enhancements effectively reduce more than 95% of false positives with almost no false negatives introduced.

Buffer overflow is possibly the most well-known memory issue. It can cause erratic program behavior, such as incorrect outputs and crashes, and can be exploited to issue security attacks. Detecting buffer overflows has drawn significant research attention for almost three decades. However, the prevalence of security attacks due to buffer overflows indicates that existing tools are still not widely utilized in production environments, possibly due to their high performance overhead or limited effectiveness. This paper proposes CSOD, a buffer overflow detection tool designed for the production environment. CSOD proposes a novel context-sensitive overflow detection technique that can dynamically adjust its detection strategy based on the behavior of different allocation calling contexts, enabling it to effectively detect overflows in millions of objects via four hardware watchpoints. It can correctly report root causes of buffer over-writes and over-reads, without any additional manual effort. Furthermore, CSOD only introduces 6.7% performance overhead on average, which makes it appealing as an always-on approach for production software.

ABSTRACTBuffer overflow attacks are caused due to exploitation of stack or heap in computer memory. One of the targets behind buffer overflow attacks is the return address of a function. Another potential actor in buffer overflow attacks is Global Offset Table (GOT); exploiting it can also lead to disastrous results, such as a call to printf(), which can be transformed to a system() call. This paper focuses on mitigation of stack-based buffer overflow attacks and securing GOT. The proposed approach is a compiler-level protection aimed at preventing such exploits using shadow stacks, a linked list behaving as a stack, that stores the return addresses and frame pointers. The return address and frame pointer are pushed into these stacks during the prologue of every function, and in the epilogue it is compared with the one residing inside actual stack. If they match, the program continues; otherwise, it is terminated and this event is recorded into the system log. To make these shadow stacks invisible from the attacker, the address of the top of shadow stack is stored inside Thread Local Storage (TLS) for the process to refer it later. In order to forestall GOT manipulation, the proposed approach uses a global array which contains the backup of GOT; when a call to GOT entry is made, the value inside that entry and the respective value inside the backup table are compared. If they match, the program continues; otherwise, it terminates the process instantaneously. The proposed approach, Secure Patrol, is efficient, secure against stack-based buffer overflow and resistant to GOT manipulation.

Transactional Coherence and Consistency (TCC) provides a new parallel programming model that uses transactions as the basic unit of parallel work and communication. TCC simplifies the development of correct parallel code because hardware provides transaction atomicity and ordering. Nevertheless, the programmer or a dynamic compiler must still optimize the parallel code for performance.This paper presents TAPE, a hardware and software infrastructure for profiling in TCC systems. TAPE extends the hardware for transactional execution to identify performance impediments such as dependence violations, buffer overflows, and work imbalance. It filters infrequent events to reduce resource requirements and allows the programmer to focus on the most important bottlenecks. We demonstrate that TAPE introduces minimal die area and performance overhead and can be used continuously, even for production runs. Moreover, we demonstrate how to leverage the profiling information to guide optimization for a set of parallel applications. TAPE accurately identifies the source code location and type of the most important bottlenecks, allowing a programmer to achieve maximum parallel speedup with a few profiling steps.

Funding Information: This work was supported in part by the U.S. National Science Foundation under Grant CNS-1828363, and in part by the Sejong University Research Faculty Program under Grant 20212023.

Due to the rapid advancement of mobile communication technology, mobile devices nowadays can support a variety of data services that are not traditionally available. With the growing popularity of mobile devices in the last few years, attacks targeting them are also surging. Existing mobile malware detection techniques, which are often borrowed from solutions to Internet malware detection, do not perform as effectively due to the limited computing resources on mobile devices. In this paper, we propose VirusMeter, a novel and general malware detection method, to detect anomalous behaviors on mobile devices. The rationale underlying VirusMeter is the fact that mobile devices are usually battery powered and any malicious activity would inevitably consume some battery power. By monitoring power consumption on a mobile device, VirusMeter catches misbehaviors that lead to abnormal power consumption. For this purpose, VirusMeter relies on a concise user-centric power model that characterizes power consumption of common user behaviors. In a real-time mode, VirusMeter can perform fast malware detection with trivial runtime overhead. When the battery is charging (referred to as a battery-charging mode), VirusMeter applies more sophisticated machine learning techniques to further improve the detection accuracy. To demonstrate its feasibility and effectiveness, we have implemented a VirusMeter prototype on Nokia 5500 Sport and used it to evaluate some real cellphone malware, including FlexiSPY and Cabir. Our experimental results show that VirusMeter can effectively detect these malware activities with less than 1.5% additional power consumption in real time.

Currently, mobile devices must meet high performance requirements and provide extended battery life, which implies low power consumption. These parameters directly depend on the processor frequency: at higher frequencies, the processor can execute more instructions per unit of time but consumes more energy, and vice versa. This paper investigates modern process scheduling methods in the Linux operating system kernel with the aim of enhancing performance and reducing power consumption in mobile devices. The process scheduling method used in Linux is modified so that it specifically focuses on the selection of the CPU core queue for a process and on the selection of the processor core frequencies. The modification is based on solving a discrete bi-criteria optimization problem. The optimization criteria consider two interrelated characteristics: performance and power consumption. The core idea of the modification is to analyze the instructions of executing tasks to identify situations where increasing the processor frequency becomes inefficient due to frequent memory accesses. The problem is solved under certain constraints: heterogeneous architectures are not considered, and hardware multithreading is not taken into account, i.e., each logical core is treated as a physical one. Based on the proposed method, software was developed and tested using ten benchmarks from the Rodinia Benchmark Suite. This suite is used to evaluate the performance of computers on various tasks, such as general-purpose computing, image processing, and signal processing. The results of the study showed that the application of the proposed approach reduces the average power consumption by 13% in mobile devices and increases the performance by 4% compared to the existing Linux kernel scheduler.

Modern CMOS processors face a significant challenge in power consumption, primarily due to switching and leakage power. With rising demands for energy-efficient systems, especially in mobile and IoT devices, managing dynamic and static power has become essential. Conventional clock gating techniques lack adaptability to workload variability, leading to inefficient power savings. Fixed gating schemes either over-constrain performance or underperform in power savings. This work proposes a Low-Power Reconfigurable Match Table (RMT)- based Clock Controller that dynamically adjusts clock gating granularity based on real-time workload profiling. The system leverages a match table reconfiguration mechanism, enabling fine- grained control of clock signals to idle submodules. Implemented in a 45nm CMOS processor simulation environment, this approach combines workload prediction and table-driven reconfiguration for minimal leakage and switching overhead. Simulation results show a 38.6% reduction in switching power and a 29.3% reduction in leakage power compared to traditional fixed clock gating, with only 1.2% performance overhead. Power savings remain consistent across varied computational loads.

Nowadays, mobile devices, such as smartphones, tablets or smartwatches, are essential items in our daily life. Further, more and more people use smart mobile devices in their everyday work for remote controlling, observing diagrams, performing web analytics, etc. However, the full potential of mobile devices is not tapped yet; built-in sensors such as accelerometers or gyroscopes offer a wide range of interaction capabilities, which are still often not fully used in nowadays mobile applications. On the other hand, desktops are still the dominating working device, but with significantly differing interaction means. With additional hand tracking devices capturing the user's gestures additional input possibilities are available but still often unused. In this paper, we investigate on a concept for orientation-based touch-less interaction. Depending on the type of device - traditional desktop or a mobile device - we use an interaction metaphor called "Waggle"; utilizing of tilting and turning of either the user's hand or the mobile device itself for additional input possibilities. Based on the results of two pilot studies for both environments, basic parameters for future design decisions are derived: on the one hand, the maximum angle for basic rotation axes are evaluated. On the other hand, different discretizations of tilt and turn angles are investigated. Based on the outcome of both studies the optimal configuration for the use of the Waggle interaction metaphor in future applications on both mobile and desktop environments are defined.

Mobile devices, particularly smartphones, have become integral to daily life. The personal and sensitive information stored on these devices has become hot targets for cybercriminals. Crimes such as mobile banking fraud, online scams and payment fraud are taking new forms daily. Mobile phones are also being used for money laundering operations to transfer or exchange illicit funds through mobile payment platforms. Either way, the involvement of mobile phones in committing crimes or mobile devices being targets of attacks has made them a critical source of digital evidence in forensic investigations. To extract evidence from these devices, mobile forensic tools have become essential for law enforcement agencies to preserve, extract and acceptably analyze data from mobile devices in law courts. An in-depth examination of the current state-of-the-art mobile forensic tools is essential to help the investigators make an informed choice while selecting the tools. This paper explores four mobile forensic tools: Cellebrite UFED, XRY, Oxygen Forensics Detective, and Magnet AXIOM. A comprehensive overview of the tools is presented, focusing on their capabilities, technicalities and shortcomings in the ever evolving mobile ecosystem. Key functionalities such as accessing locked devices, deleted data recovery, app data parsing, cloud storage access, decryption of encrypted data, and timeline generation are discussed to assess the effectiveness of the tools. Even though these tools have become sophisticated over time, they face several technical challenges. No single tool provides a complete solution for mobile forensic investigation. It is recommended that a combination of tools, based on the case-specific requirements, device types and the nature of data extraction, be used. This paper underscores the importance of constant updates, a wide range of device support, and legal compliance to perform mobile forensic tools effectively.

There is tremendous growth in the amount of digital video creation and communication with the proliferation of mobile consumer electronic devices such as cellular phones with video capture and display capabilities. This trend will continue with the demand for higher spatial and temporal video resolutions accompanied by 3D and multiview video. Since it is not practical to store or transmit the raw digital video data, it is essential to reduce it with digital video compression. To cope with the vast amount of raw digital video data, digital video compression standards use increasingly more complex algorithms. These algorithms achieve higher compression at the same quality at the expense of significant computational complexity. Therefore, it is essential to design low power digital video compression hardware especially for mobile devices. In this talk, I will present two sets of power reduction techniques for digital video compression hardware. The ones in the first set reduce the power consumption with no impact on the video quality. The ones in the second set trade off video quality for power consumption which also enables adjusting video quality based on available energy in the battery of a mobile device for graceful degradation. I will show the impact of these techniques on the power consumption of digital video compression hardware implementing H.264/AVC and H.265/HEVC standards.

The system buffer overflow (SBO) is a universal problem in information security. In the traditional defence mechanisms, the SBO prevents shell code execution and neglect unsuccessful attack that makes system procedures terminate abnormally. In this loophole, attackers can modify the data structure of the control programme procedure such as the return address or the function pointer and then the system programme procedure will be turned to the code-injection attacks (CIA) or the return-into-libc attacks. In this paper, we propose the memory protector (MP) which is a novel solution to prevent the SBO attack. The MP uses Linux operating system to implement the defence mechanism that will prevent the stack-based buffer overflow attack from the malicious CIA, defect and prevent the zero-day-attack, and keeping memory integrity. In this experiment, we choose Linux operating system (Linux 2.4.21) to implement the defence mechanism that will prevent the stack-based buffer overflow attack from the malicious CIA, defect and prevent the zero-day-attack, and keeping memory integrity.

Mobile cloud computing has introduced offloading to save the battery life of mobile devices. In mobile cloud computing optimization of power and delay for offloading has become a vital research scope. However, migration of the storage and computation from the mobile device to the remote cloud server enhances the delay and power consumption. To overcome this difficulty, cloudlet comes which is located nearby the mobile device. Since the cloudlet may not be able to fulfill all the offloading requests, sometimes remote public cloud server is used for the same. As a result the power and delay consumptions are increased. For solving this difficulty, private cloud server is used in our scheme along with the cloudlet and public cloud server. In this paper multilevel full and partial offloading strategies are proposed based on cloudlet, private and public cloud servers. The power and delay consumption in the proposed methods are determined and compared with the existing offloading methods. The theoretical and experimental analyses demonstrate that the proposed multilevel offloading methods are power and delay efficient. The simulation results show that the proposed multilevel full and partial offloading strategies reduce the power consumption by approximately 8–9% and 20% respectively than the existing methods.