Malicious Instructions Research Articles

JiuJITsu: Removing Gadgets with Safe Register Allocation for JIT Code Generation

Code-reuse attacks have the capability to craft malicious instructions from small code fragments, commonly referred to as “gadgets.” These gadgets are generated by JIT (Just-In-Time) engines as integral components of native instructions, with the flexibility to be embedded in various fields, including Displacement . In this article, we introduce a novel approach for potential gadget insertion, achieved through the manipulation of ModR/M and SIB bytes via JavaScript code. This manipulation influences a JIT engine’s register allocation and code generation algorithms. These newly generated gadgets do not rely on constants and thus evade existing constant blinding schemes. Furthermore, they can be combined with 1-byte constants, a combination that proves to be challenging to defend against using conventional constant blinding techniques. To showcase the feasibility of our approach, we provide proof-of-concept (POC) code for three distinct types of gadgets. Our research underscores the potential for attackers to exploit ModR/M and SIB bytes within JIT-generated native instructions. In response, we propose a practical defense mechanism to mitigate such attacks. We introduce JiuJITsu , a security-enhanced register allocation scheme designed to prevent harmful register assignments during the JIT code generation phase, thereby thwarting the generation of these malicious gadgets. We conduct a comprehensive analysis of JiuJITsu ’s effectiveness in defending against code-reuse attacks. Our findings demonstrate that it incurs a runtime overhead of under 1% when evaluated using JetStream2 benchmarks and real-world websites.

A Short Criteria-Based Review of High-Performance Proactive Ransomware Analysis Models

The Software that contains destructive commands intended to damage user data and systems is known as malware. The malware's objective is to take over the system without authorization, access private information, or even corrupt it. Over the past few years, several malware threats have been reintroduced. To demand a ransom, malicious software known as ransomware locks the victim's system or encrypts important data. Numerous studies have been conducted to stop and quickly recognize ransomware attacks. Therefore, detecting ransomware attacks as early as possible avoids the execution of malicious instructions that would otherwise damage user data and the system. In this study, we examine eight criteria across several aspects of the suggested solution to evaluate six state-of-the-art high-performance proactive ransomware detection models. Depending on how well each requirement is met, points are given to it. The evaluation results are compared with the claimed accuracy results. The ranking outcomes and potential areas for future improvement outlined by each model will then be presented. To the best of our knowledge, researchers in the field of proactive ransomware detection are more interested in increasing classification accuracy than they are in reducing latency. One crucial factor in defining a model as high-performance is latency. Model 5 (M5, Zhang et al. model) thus receives the highest score of 14 points. With only 2.44 seconds, the model minimized the classification latency. After comparison, it is strongly advised to look beyond the capabilities of machine learning algorithms to quickly identify and stop ransomware attacks.  

Secure and Lightweight User Authentication Scheme for Cloud-Assisted Internet of Things

Cloud-assisted Internet of Things (IoT) overcomes the resource-constrained nature of the traditional IoT and is developing rapidly in such fields as smart grids and intelligent transportation. In a cloud-assisted IoT system, users can remotely control the IoT devices and send specific instructions to them. If the users’ identities are not verified, adversaries can pretend as legitimate users to send fake and malicious instructions to IoT devices, thereby compromising the security of the entire system. Thus, a sound authentication mechanism is indispensable to ensure security. At the same time, it should be noted that a gateway may connect to massive IoT devices with the exponential growth of interconnected devices in a cloud-assisted IoT system. The efficiency of authentication schemes is easily impacted by the computation capability of the gateway. Recently, several schemes have been designed for cloud-assisted IoT systems, but they have problems of one kind or another, making them not very suitable for cloud-assisted IoT systems. In this paper, we take a typical scheme (proposed at IEEE TDSC 2020) as an example to identify the common weaknesses and challenges of designing a user authentication scheme for cloud-assisted IoT systems. In addition, we propose a new secure user authentication scheme with lightweight computation on gateways. The proposed scheme provides secure access between remote users and IoT devices with many ideal attributions, such as forward secrecy and multi-factor security. Meanwhile, the security of this scheme is proved under the random-oracle model, heuristic analysis, the ProVerif tool and BAN logic. Compared with ten state-of-the-art schemes in security and performance, the proposed scheme achieves all the listed twelve security requirements with minimum computation and storage costs on gateways.

Cryptojacking Malware Detection in Docker Images Using Supervised Machine Learning

Nowadays, Docker Containers are currently being adopted as industry standards for software delivery, because they provide quick and responsive delivery and handle performance and scalability challenges. However, attackers are exploiting them to introduce malicious instructions in publicly available images to perform unauthorized use of third-party’s computer resources for Cryptojacking. We developed a machine learning based model to detect Docker images that lead to cryptojacking. The dataset used is composed of 800 Docker images collected from Docker hub, half of which contains instructions for cryptomining, and the other half does not contain such instructions. We trained 10 classification algorithms and evaluated them using the K-Fold Cross Validation approach. The results showed accuracy scores ranging from 89% to 97%. Stochastic Gradient Descent for Logistic Regression outperformed the other algorithms reaching an accuracy score of 97%. With these results, we conclude that machine learning algorithms can detect Docker images carrying cryptojacking malware with a good performance.

MELTWEB: A Transient Execution Attack to Capture Data in Fill Line Buffer

The out-of-order execution mechanism is widely used in modern processors. However, meltdown attacks exploit this mechanism to allow malicious instructions to capture sensitive data from kernel domains. This work aims to present a new meltdown attack, called Meltweb. It is a new approach in the category of privileged speculative execution attacks to leak arbitrary data into address spaces and privilege limits. Meltweb can be implemented from linear execution without the need for page faults, eliminating the need for an exception suppression mechanism, thus allowing the attack to be executed throughout the system of arbitrary code without privileges as in search engines interpretation of Javascript. To exemplify the performance of the attack, two proof-of-concept variants were developed that demonstrate the ability to perform the attack natively, as well as remotely using Javascript. The attack developed showed satisfactory results in its two variants, with 98% accuracy in capturing confidential data in the native variant. For the remote variant, the attack proved to be capable of capturing navigation data as a URL recovery with an error rate of 2.3%.

Prevention of Runtime Malware Injection Attack in Cloud Using Unsupervised Learning

Cloud computing utilizes various Internet-based technologies to enhance the Internet user experience. Cloud systems are on the rise, as this technology has completely revolutionized the digital industry. Currently, many users rely on cloud-based solutions to acquire business information and knowledge. As a result, cloud computing services such as SaaS and PaaS store a warehouse of sensitive and valuable information, which has turned the cloud systems into the obvious target for many malware creators and hackers. These malicious attackers attempt to gain illegal access to a myriad of valuable information such as user personal information, password, credit/debit card numbers, etc., from systems as the unsecured e-learning ones. As an important part of cloud services, security is needed to protect business customers and users from unauthorized threats. This paper aims to identify malware that attacks cloud-based software solutions using an unsupervised learning model with fixed-weight Hamming and Mexiannet. Different types of attack methodologies and various ways of malicious instructions targeting unknown files in cloud services are investigated. The result and analysis in this study provide an evolution of the unsupervised learning detection algorithm with an accuracy of 94.05%.

A Novel Immune-Inspired Shellcode Detection Algorithm Based on Hyperellipsoid Detectors

Shellcodes are machine language codes injected into target programs in the form of network packets or malformed files. Shellcodes can trigger buffer overflow vulnerability and execute malicious instructions. Signature matching technology used by antivirus software or intrusion detection system has low detection rate for unknown or polymorphic shellcodes; to solve such problem, an immune-inspired shellcode detection algorithm was proposed, named ISDA. Static analysis and dynamic analysis were both applied. The shellcodes were disassembled to assembly instructions during static analysis and, for dynamic analysis, the API function sequences of shellcodes were obtained by simulation execution to get the behavioral features of polymorphic shellcodes. The extracted features of shellcodes were encoded to antigens based on n-gram model. Immature detectors become mature after immune tolerance based on negative selection algorithm. To improve nonself space coverage rate, the immune detectors were encoded to hyperellipsoids. To generate better antibody offspring, the detectors were optimized through clonal selection algorithm with genetic mutation. Finally, shellcode samples were collected and tested, and result shows that the proposed method has higher detection accuracy for both nonencoded and polymorphic shellcodes.

Texture Based Malware Pattern Identification and Classification

Malware texture pattern plays an essential role in defense against malicious instructions which were analyzed by malware analyst. It is identified as a security threat. Classifying malware samples based on static analysis which is a challenging task. This paper introduces an approach to classify malware variants as a gray scale image based on texture features such as different patterns of malware samples. Malicious samples are classified through the machine learning techniques. The proposed method experimented on malware dataset which is consisting of large number of malware samples. The similarities are calculated by texture analysis methods with Euclidian distance for various variants of malware families. The available samples are named by the Antivirus companies which can analyze through supervised learning techniques. The experimental results show that the effective identification of malware texture pattern through the image processing which gives better accuracy results compared to existing work.

Security in MPSoCs: A NoC Firewall and an Evaluation Framework

In multiprocessor system-on-chip (MPSoC), a CPU can access physical resources, such as on-chip memory or I/O devices. Along with normal requests, malevolent ones, generated by malicious processes running in one or more CPUs, could occur. A protection mechanism is therefore required to prevent injection of malicious instructions or data across the system. We propose a self-contained Network-on-Chip (NoC) firewall at the network interface (NI) layer which, by checking the physical address against a set of rules, rejects untrusted CPU requests to the on-chip memory, thus protecting all legitimate processes running in a multicore SoC. To sustain high performance, we implement the firewall in hardware, with rule-checking performed at segment-level based on deny rules. Furthermore, to evaluate its impact, we develop a novel framework on top of gem5 simulation environment, coupling ARM technology and an instance of a commercial point-to-point interconnect from STMicroelectronics (STNoC). Simulation tests include scenarios in which legitimate and malicious processes, running in different CPUs, request access to shared memory. Our results indicate that a firewall implementation at the NI can have a positive effect on network performance by reducing both end-to-end network delay and power consumption. We also show that our coarse-grain firewall can prevent saturation of the on-chip network and performs better than fine-grain alternatives that perform rule checking at page-level. Simulation results are accompanied with field measurements performed on a Zedboard platform running Linux, whereas the NoC Firewall is implemented as a reconfigurable, memory-mapped device on top of AMBA AXI4 interconnect fabric.

Buffer Overflow Attack Vulnerability in Stack

Most of the vulnerability based on buffer overflows aim at forcing the execution of malicious code, mainly in order to give a root shell to the user. The malicious instructions are stored in a buffer, which is overflowed to allow an unexpected use of the process, by changing various memory sections. Buffer overflow attacks exploit a need of bounds checking on the size of input being stored in a buffer array. By writing the data into the memory assigned to array, the attacker can make arbitrary changes to program state stored an adjacent to the array. A buffer overflow is an inconsistent, where a process attempts to store data beyond the boundaries of a fixed length buffer. So that the additional data overwrites next memory the techniques to exploit buffer overflow vulnerability vary per architecture, operating system and memory region locations. The overwritten data may include other buffers, variables and program flow data a technically inclined and malicious user may exploit stack-based buffer overflows to manipulate the program[9,10].