String Attacks Research Articles

An experimental approach for comparing the influence of cello string type on bowed attack response.

This study investigates the influence of string properties on bowed string attack playability. To assess the attack playability of different string types, a variety of bow forces and bow accelerations were chosen to excite the strings and measure the transient response under different bowing control parameters. The experimentally obtained playability maps of transient duration as function of bow force and acceleration (Guettler diagram) were obtained with a robotic bowing machine, from four different types of cello G2 strings. Results indicate variations in playability across string types, suggesting that string properties impact attack duration.

StackGuard+$\text{StackGuard}^+$: Interoperable alternative to canary‐based protection of stack smashing

AbstractThis paper introduces a novel software‐based approach to enhancing stack smashing protection in C/C++ applications, specifically targeting return‐oriented programming attacks, which remain a significant threat to firmware and software security. Traditional canary‐based protections are vulnerable to brute‐force and format string attacks. Additionally, many stack protection mechanisms require access to the source code or recompilation, complicating the security of existing binaries. This paper proposes a new method, aptly named , that modifies the canary‐based protection mechanism by altering the code responsible for canary insertion and verification. This change ensures the integrity of the return address while maintaining the original code size, allowing for seamless interoperability without the need for recompilation or additional hardware. The approach can be automated using a Python script, which modifies existing canary‐based binaries with only 26 bytes of machine code on the 86‐64 platform. Moreover, this approach can be easily adapted to other platforms, including 86 and ARM64.

Experimental assessment of playability limits during bowed string attacks

The playability limits in the bow force and bow acceleration parameter space (usually visualized as a Guettler diagram) define the conditions for establishing Helmholtz motion during bowed attacks in bowed-string instruments. Despite few theoretical and numerical studies, there is little empirical validation of these limits. The experimental scanning of a Guettler diagram is a tedious process, as it requires the use of a bowing machine to control the bowing parameters. This study proposes a method for collecting and analyzing data to produce measured Guettler diagrams. Experiments were conducted using a cello string in a monochord arrangement with fixed terminations. The string was excited using a robotic arm that allows control of the playing conditions by changing the bow force and bow acceleration. Each set of measurements contains more than 900 data points to obtain high-resolution Guettler diagrams. In addition, the measurements are repeated in reverse order and after dismounting and remounting the string. The results are compared with existing literature, with particular attention to theoretical limits. The experimental results suggest that the static and dynamic friction coefficients vary with bow force and acceleration, modifying the playability limits. [Work supported by the Austrian Science Fund (FWF) (P34852-N).]

On Security of TrustZone-M-Based IoT Systems

Internet of Things (IoT) devices have been increasingly integrated into our daily life. However, such smart devices suffer a broad attack surface. Particularly, attacks targeting the device software at runtime are challenging to defend against if IoT devices use resource-constrained microcontrollers (MCUs). TrustZone-M, a TrustZone extension designed specifically for MCUs, is an emerging hardware security technique fortifying software security of MCU-based IoT devices. This article introduces a comprehensive security framework for IoT devices using TrustZone-M-enabled MCUs, in which device security is protected in five dimensions, i.e., hardware, boot-time software, runtime software, network, and over-the-air (OTA) update. Along developing the framework, we also present the first security analysis of potential runtime software security issues in TrustZone-M-enabled MCUs. In particular, we explore the feasibility of launching stack-based buffer overflow (BOF) attack for code injection, return-oriented programming (ROP) attack, heap-based BOF attack, format string attack, and attacks against nonsecure callable (NSC) functions in the context of TrustZone-M. We validate these attacks using SAM L11, a microchip MCU with TrustZone-M and provide defense mechanisms in the runtime software dimension of the proposed framework. The security framework is implemented with a full-fledged secure and trustworthy air quality monitoring device using SAM L11 as its MCU.

실행시간 침입 방지 평가 프로그램(RIPE)의 개선

Runtime Intrusion Prevention Evaluator (RIPE), published in 2011, is a benchmark suite for evaluating mitigation techniques against 850 attack patterns using only buffer overflow. Since RIPE is built as a single process, defense and attack routines cannot help sharing process states and address space layouts when RIPE is tested. As a result, attack routines can access the memory space for defense routines without restriction. We separate RIPE into two independent processes of defense and attacks so that mitigations based on confidentiality such as address space layout randomization are properly evaluated. In addition, we add an execution mode to test robustness against brute force attacks. Finally, we extend RIPE by adding 38 attack forms to perform format string attacks and virtual table (vtable) hijacking attacks. The revised RIPE contributes to the diversification of attack patterns and precise evaluation of the effectiveness of mitigations.

SIFT: Low-Complexity Energy-Efficient Information Flow Tracking on SMT Processors

Dynamic information flow tracking (DIFT) is a powerful technique that can protect unmodified binaries from a broad range of vulnerabilities including buffer overflow and format string attacks. Software DIFT implementations suffer from very high performance overheads, while comprehensive hardware implementations add substantial complexity to the microarchitecture, making it unlikely for chip manufacturers to adopt them. In this paper, we propose SIFT (SMT-based DIFT), where a separate thread performing taint propagation and policy checking is executed in a spare context of an SMT processor. The instructions for the checking thread are generated in hardware using self-contained off-the-critical path logic at the commit stage of the pipeline. We investigate several performance optimizations to the base design including: 1) Prefetching of the taint data from shadow memory when the corresponding data is accessed by the primary thread; 2) Optimizing the generation of the taint code to remove unneeded security instructions; and 3) The use of aggregated instructions for collapsing the frequently used groups of security instructions into a single new instruction. Together, these optimizations reduce the performance penalty of SIFT to under 20 percent on SPEC CPU 2006 benchmarks-much lower than the overhead of previously proposed software-based DIFT schemes. We also analyze the energy overhead of SIFT and show it to be very high - 113 percent for SPEC 2006 benchmarks. We then propose several techniques that reduce this overhead to only 23 percent, making SIFT design practical from the energy standpoint. To demonstrate the feasibility of SIFT, we design and synthesize a core with SIFT logic and show that the area overhead of SIFT is only 4.5 percent and that instruction generation can be performed in one additional cycle at commit time.

Finite state machine based approach to prevent format string attacks

In the computer field there are many types of input validation attacks that occur, in which "Format String Overflow Attacks" is one of the most important. Format String Overflow Attacks remain the leading reason of software vulnerability or exploits. Format string bugs result in error such as wrong result type, memory access error and crash and security breach. In this paper , we proposed a Finite state machine which prevents Format String Overflow Attacks in a secure way with the help of several states of FSM. Proper checking against format string overflow bugs can avoid consequences due to exploits of format string overflow bugs. The result of our proposed finite state machine is improving the security problem and provides protection to memory access from any unauthorized user.

시간 기반의 비정상 행위 침입탐지 모델 설계

In the method to analyze the relationship in the system call orders, the normal system call orders are divided into a certain size of system call orders to generates gene and use them as the detectors. In the method to consider the system call parameters, the mean and standard deviation of the parameter lengths are used as the detectors. The attack of which system call order is normal but the parameter values are changed, such as the format string attack, cannot be detected by the method that considers only the system call orders, whereas the model that considers only the system call parameters has the drawback of high positive defect rate because of the information obtained from the interval where the attack has not been initiated, since the parameters are considered individually. To solve these problems, it is necessary to develop a more efficient learning and detecting method that groups the continuous system call orders and parameters as the approach that considers various characteristics of system call related to attacking simultaneously. In this article, we detected the anomaly of the system call orders and parameters by applying the temporal concept to the system call orders and parameters in order to improve the rate of positive defect, that is, the misjudgment of anomaly as normality. The result of the experiment where the DARPA data set was employed showed that the proposed method improved the positive defect rate by 13% in the system call order model where time was considered in comparison with that of the model where time was not considered.

An XML-based testing strategy for probing security vulnerabilities in the diameter protocol

Buffer overflows and format string attacks are always at the fingertips of hackers. This poses a threat to every application running over an Internet Protocol (IP) network—from Web servers in the Internet to the session managers in charge of the call session control function (CSCF) in the IP Multimedia Subsystem (IMS) network. As bugs persist in most software development practices, it is critical to perform thorough security testing before the product is finally deployed. This paper proposes an extensible markup language–(XML)-based testing strategy to detect vulnerabilities and verify robustness to buffer overflow and format string attacks in the implementation of the Diameter protocol, which plays a vital role in IMS billing and subscriber database interfaces. The paper introduces a test generation strategy built upon the XML Schema language's flexibility in data description. It differs from the traditional finite state machine–(FSM)-based syntax testing strategy in the test description, organization, and automation aspects. The proposed strategy is then applied to Alcatel-Lucent Control Platform (A-LCP) Diameter stack security verification by integrating two open source tools—Seagull and xmlgen. The result supports our continuous effort to identify software security vulnerabilities. © 2007 Alcatel-Lucent.

An XML-based testing strategy for probing security vulnerabilities in the diameter protocol

Buffer overflows and format string attacks are always at the fingertips of hackers. This poses a threat to every application running over an Internet Protocol (IP) networkfrom Web servers in the In...

A new family of stringed musical instruments

A new family of stringed musical instruments will be introduced. The TritareTM is the first member of this new family and has evolved from the mathematical analysis of the vibrations of networks of strings [Gaudet et al., J. Sound & Vib. 281, 219–234 (2005)]. It is a guitarlike instrument that uses six networks of three string sections (Y‐shaped networks) instead of the classical single strings. The sounds that it produces can be more or less harmonic depending on the string attack conditions and the physical configurations of the string networks. A method of customizing the frequency spectrum to contain desired harmonic components will be demonstrated. A numerical model, which uses finite differences, used to simulate the 3D nonlinear vibrations of more complex string networks involving several string sections and junction points will also be described. The harmonic analysis of the frequency spectra resulting from the numerical simulations and experimental measurements will be presented, as well as network configurations which produce very unique and interesting tone colors. Some of these configurations form the basis for a new family of stringed musical instruments. The presentation will include a demonstration of the TritareTM.

Acceptance limits for the duration of pre-Helmholtz transients in bowed string attacks

The attack of most bowed notes shows an initial part before Helmholtz triggering occurs (the pre-Helmholtz transient), during which the stick-slip interaction promotes frequencies other than that of the string’s fundamental. Depending on the particular combination of bowing parameters, this state is characterized either by periods that are prolonged, or by a division of the period into two or more parts, multiple flyback. An onset with perfectly periodic motion (Helmholtz triggering) directly from the very start is also possible. A sample of violin tones representing these three classes of attacks, and with different duration of the pre-Helmholtz transient, has been collected by the use of a computer-controlled bowing machine. The tones were evaluated by 20 advanced string students and professionals in a listening test, judging the acceptance and quality of the attacks. The maximum acceptable duration of the pre-Helmholtz transient was estimated to 50 ms (⩽10 nominal periods, open G string, violin) for attacks with prolonged periods, and 90 ms (⩽18 periods) for multiple-flyback attacks. These values refer to a neutral start in a neutral context, such as when practicing a scale. A playing test, in which the performances of two professional violinists were analyzed, confirmed these results, and showed that the same limits apply to a larger group of bowing styles as well.