loading...
Strengthening Software Self-Checksumming via Self-Modifying Code
Tucson, Arizona December 05-December 09
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/CSAC.2005.5321st Annual Computer Security Applica ...
 This Article 
 
PDF
HTML
 
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
Jonathon T. Giffin, University of Wisconsin
Mihai Christodorescu, University of Wisconsin
Louis Kruger, University of Wisconsin
Recent research has proposed self-checksumming as a method by which a program can detect any possibly malicious modification to its code. Wurster et al. developed an attack against such programs that renders code modifications undetectable to any self-checksumming routine. The attack replicated pages of program text and altered values in hardware data structures so that data reads and instruction fetches retrieved values from differentmemory pages. A cornerstone of their attack was its applicability to a variety of commodity hardware: they could alter memory accesses using only a malicious operating system. In this paper, we show that their page-replication attack can be detected by self-checksumming programs with self-modifying code. Our detection is efficient, adding less than 1 microsecond to each checksum computation in our experiments on three processor families, and is robust up to attacks using either costly interpretive emulation or specialized hardware.
Citation:
Jonathon T. Giffin, Mihai Christodorescu, Louis Kruger, "Strengthening Software Self-Checksumming via Self-Modifying Code," acsac, pp.23-32, 21st Annual Computer Security Applications Conference (ACSAC'05), 2005
Usage of this product signifies your acceptance of the Terms of Use.