Detecting stack pivots using stack artifact verification
Examples of the present disclosure describe systems and methods for detecting and mitigating stack pivoting using stack artifact verification. In aspects, function hooks may be added to one or more functions. When a hooked function executes, artifacts relating to the hooked function may be left on the stack memory (“stack”). The location of the artifacts on the stack may be stored in a local storage area. Each time a hook in a hooked function is subsequently executed, protection may be executed to determine whether an artifact remains in the location stored in the local storage area. If the artifact is no longer in the same location, a stack pivot may be detected and one or more remedial actions may be automatically performed.
1. A system comprising:
at least one processor; and
memory coupled to the at least one processor, the memory comprising computer executable instructions that, when executed by the at least one processor, performs a method comprising:
identifying a first location of an artifact in stack memory, wherein the stack memory comprises a plurality of different locations and the first location is one of the plurality of locations, and wherein the artifact is associated with a thread incorporating hooking functionality, and wherein the first location represents a current location of the artifact in stack memory;
comparing the first location to a second location of that artifact on the stack memory, wherein the second location is one of the plurality of locations comprised by the stack memory and represents a previously identified location of that artifact in the stack memory;
determining whether the first location matches the second location; and
when it is determined that the first location does not match the second location, automatically performing one or more remedial actions.
2. The system of claim 1 , wherein the artifact is added to the stack memory in response to initializing the thread.
3. The system of claim 1 , wherein comparing the first location to the second location comprises accessing a data storage location comprising the second location.
4. The system of claim 1 , wherein identifying the first location comprises evaluating the stack memory for the first location when the hooking functionality is executed.
5. The system of claim 1 , wherein comparing the first location to the second location comprises evaluating the stack memory for the second location when the hooking functionality is executed.
6. The system of claim 1 , wherein the hooking functionality is added to one or more checkpoints in software code, and wherein the hooking functionality enables intercepting messages passed between two or more components of the system.
7. The system of claim 1 , wherein the artifact is associated with a thread creation function for creating the thread, wherein the thread creation function comprises the hooking functionality.
8. The system of claim 1 , wherein the artifact corresponds to a return address of a calling function.
9. The system of claim 1 , wherein comparing the first location to the second location comprises using one or more pattern matching utilities to determine whether the first location matches the second location.
10. The system of claim 1 , wherein, when it is determined that the first location does not match the second location, determining that a stack pivot exploit has occurred.
11. The system of claim 1 , wherein the one or more remedial actions comprise at least one of: displaying a warning, terminating a process, modifying a set of privileges, and quarantining a file associated with the process.
12. A method comprising:
identifying a first location of an artifact in stack memory, wherein the stack memory comprises a plurality of different locations and the first location is one of the plurality of locations, and wherein the artifact is associated with a thread incorporating hooking functionality, and wherein the first location represents a current location of the artifact in stack memory;
comparing the first location to a second location of that artifact on the stack memory, wherein the second location is one of the plurality of locations comprised by the stack memory and represents a previously identified location of that artifact in the stack memory;
determining whether the first location matches the second location; and
when it is determined that the first location does not match the second location, performing one or more remedial actions.
13. The method of claim 12 , wherein comparing the first location to the second location comprises accessing thread-local storage (TLS) comprising the second location.
14. The method of claim 12 , wherein the artifact identifies a return address of a calling function.
15. The method of claim 12 , wherein the first location is a first position in the stack memory and the second location is a second position in the stack memory.
16. The method of claim 15 , wherein the artifact is added to the stack memory in response to creating the thread, wherein creating the thread comprises executing one or more thread creation function having the hooking functionality.
17. The method of claim 12 , wherein the one or more remedial actions comprise indicating a stack pivot exploit has occurred.
18. The method of claim 12 , wherein, the remedial action comprises terminating the thread.
19. A non-transitory computer-readable media storing computer executable instructions that when executed cause a computing system to perform a method comprising:
identifying, at a first time, a first location of an artifact in stack memory, wherein stack memory comprises a plurality of different locations and the first location is one of the plurality of locations, wherein the artifact is associated with a thread incorporating hooking functionality, and wherein the first location represents a previously identified location of the artifact in that stack memory;
evaluating, at a second time, the stack memory, wherein the evaluation comprises determining the first location of the artifact is not currently found in the stack memory; and
based on determining the first location is no longer found in the stack memory, performing one or more remedial actions.
20. The non-transitory computer-readable media of claim 19 , wherein the first location is a first return address of a function.