Automated deployment of relocatable code blocks as an attack countermeasure in software
A computer implemented method is provided. The computer implemented method includes receiving, for execution by a processing element, a relocatable instrumented code block, the relocatable instrumented code block being code that has undergone instrumentation for a monitoring system, duplicating at least one function of the relocatable instrumented code block to produce a plurality of duplicate relocatable code blocks, allocating the instrumented code block and each duplicate relocatable code block of the plurality of duplicate relocatable code blocks to different locations in a memory on a computing device, creating a relocated mapping of the instrumented code block and each duplicate relocatable code block to their corresponding locations in the memory, and transmitting a copy of the mapping of the instrumented code block and each duplicate relocatable code block to their corresponding locations in memory to the monitoring system.
1 . A computer implemented method, comprising:
receiving, for execution by a processing element, a relocatable instrumented code block, the relocatable instrumented code block being code that has undergone instrumentation for a monitoring system;
creating dynamic software tripwires by:
duplicating at least one function of the relocatable instrumented code block to produce a plurality of duplicate relocatable code blocks;
allocating the instrumented code block and each duplicate relocatable code block of the plurality of duplicate relocatable code blocks to different locations in a memory on a computing device; and
creating a relocated mapping of the instrumented code block and each duplicate relocatable code block to their corresponding locations in the memory; and
transmitting a copy of the mapping of the instrumented code block and each duplicate relocatable code block to their corresponding locations in memory to the monitoring system.
2 . The method of claim 1 , wherein receiving the relocatable instrumented code block includes receiving a description of an instrumentation configuration.
3 . The method of claim 2 , wherein the instrumentation includes a path profiling on a code block to generate a particular path identifier for each path within the code block.
4 . The method of claim 3 , wherein the instrumentation includes an embedded sensor configuration within the code block.
5 . The method of claim 4 , wherein the embedded sensor configuration comprises intentionally injected weak code.
6 . The method of claim 5 , wherein the path profiling includes creating the description of the instrumentation configuration, wherein the description of the instrumentation configuration includes an embedded sensor configuration table comprising a listing of the particular path identifier to the path of the corresponding intentionally injected weak code.
7 . The method of claim 2 , wherein the instrumentation includes marking an address of a code block as non-executable and wherein the description of the instrumentation includes an internal table comprising the address of the code marked as non-executable.
8 . The method of claim 1 , wherein allocating the relocatable instrumented code block and each duplicate relocatable code block of the plurality of relocatable code blocks further comprises fine grained address space randomization.
9 . The method of claim 8 , wherein allocating the relocatable instrumented code block includes rotating the relocatable instrumented code block through locations in the memory allocated to the duplicate relocatable code blocks at runtime.
10 . The method of claim 1 , wherein the method is automatically performed by a loader of an operating system of the computing device.
11 . The method of claim 10 , wherein the method is performed by the loader within a secure environment on the computing device.
12 . A computer-readable storage medium, comprising a memory having instructions stored thereon that when executed perform a method, the method comprising:
receiving, at a monitoring system, for an executable code comprising a relocatable instrumented code block, a mapping of the instrumented code block and decoy duplicate relocatable code blocks to respective corresponding locations in memory on a computing device;
during runtime of the executable code, monitoring by the monitoring system the executable code for execution of any of the decoy duplicate relocatable code blocks; and
responsive to determining that any of the decoy duplicate relocatable code blocks has been accessed, generating by the monitoring system, a notification that a decoy duplicate instrumented code block has been accessed.
13 . The computer-readable storage medium of claim 12 , wherein the method is performed within a secure environment.
14 . The computer-readable storage medium of claim 12 , wherein execution of a decoy duplicate relocatable code block is determined by receipt of a trigger indicated by instrumentation of the relocatable instrumented code block occurring upon access of a location in memory corresponding to the decoy duplicate relocatable code block.
15 . The computer-readable storage medium of claim 14 , wherein the instructions perform a further method comprising:
receiving, at the monitoring system, an embedded sensor configuration table for the instrumentation indicating path identifiers of weak code paths injected for an attack countermeasure,
wherein the trigger is execution of a path having a particular path identifier corresponding to weak code path indicated by the embedded sensor configuration table.
16 . The computer-readable storage medium of claim 14 , wherein the instructions perform a further method comprising:
receiving, at the monitoring system, an internal table for the instrumentation indicating memory addresses that should not be executed,
wherein the trigger is execution of a memory address of the memory addresses that should not be executed indicated by the internal table.