Skip to main content

Entry 3: Rerandomizing to beat cyberattacks

WannaCry Ransomware

Terms

ASLR- address space layout randomization: diversifying memory locations for an application
TASR- timely address space randomization: randomization occurring alongside input-output pairs

The Threat

Modern IT specialists are constantly on the defense against hackers and are often at a disadvantage due to the arsenal of tools at the disposal of their rivals. Hackers just need to find a single solution to crack into a network or a device, while the good guys have to anticipate and protect against a plethora of vulnerabilities. (1) It has been estimated that malware attacks cost companies an average of $2.5 million and that in the United States the average cyber crime costs companies $21.22 million. (2) With the prevalence and severity of such crimes on the rise, the job of defending against such attacks has also become a top priority for both public and private industry alike.

IT specialists have traditionally fallen back on a technique called randomization, specifically address space layout randomization (ASLR). ASLR diversifies the memory locations for an application each time the application is loaded into memory so that hackers are not able to create one 'hack-all' solution to defeat security measures. However, in response hackers have created information leakage attacks that will uncover randomization and open up applications to a modified attack.

The Solution

Instead of randomizing at set time intervals, TASR, or timely address space randomization, makes it harder for hackers to succeed by randomization whenever processing input and output. With this technique, hackers are not able to anticipate an exploitation window. Other advantages of TASR include compatibility with C language, backward compatibility with legacy systems, and no need for additional hardware. (1)

Relation to CMSC

As we've learned in CMSC 150, when an application is opened it is loaded into RAM where it takes a memory location, and then is run by the operating system. What randomization techniques do is change memory cells for the application running so that hackers aren't able to extract information leakage. To see different examples of address space, click this link.


References

(1) http://news.mit.edu/2016/foiling-cyber-attackers-rerandomization-1209

(2) https://www.securitymagazine.com/articles/88338-cyber-crime-costs-117-million-per-business-annually

Comments

  1. Sophie BorchartNovember 6, 2017 at 2:20 PM

    It sounds like it's such a simple solution to just randomize the location of the memory to avoid being hacked, it's crazy how places like Target still cannot retain their security and prevent major hacking. I wonder if it's more of an expense thing to protect user information or if it is just a lot harder than it sounds with a lot of cryptography and other encoding methods to protect information.

    ReplyDelete

Post a Comment

Popular posts from this blog

Entry 4 - Location, location, location...

The Anonymity of Location Services The advent of the cell phone and subsequently the smartphone has put a world of knowledge at our fingertips. Recipes, maps, music and much more are just a few clicks away, whenever we want them, wherever we want them. This is great for productivity and connectivity, but herein lies the danger to our privacy. Location services drive much of the functionality and enhance the user's experience on many of today's most popular apps, specifically social media applications. Apps encourage "checking in" and "tagging" people and locations attached to posts, and users often accept the risk of sharing their information because of " hyperbolic discounting" , where people focus on the immediate benefit and discount future risk. (3) Some users chose to disable location services, an option that should t heoretically make a user's location private, but recent studies show that this might be a false sense of security.
2 comments
Read more

Entry 2 - China's Quest for Quantum Computing

NSA Headquarters Quantum- not just a buzz word Traditional computing encodes information with the use of bits, that is a series of ones and zeroes. The quickly emerging field of quantum computing makes use of quantum bits, differing in nature from binary bits in that they can be ones and zeroes simultaneously. Quantum processors are still in development, but because of their massive computing potential both private industry and governments around the world are racing to champion the technology. Applications in computer science Math and science fields would probably be the most obvious benefactors of a breakthrough in quantum computing, by enabling faster computations and more intricate modeling. A lesser known, yet equally exciting application is known as quantum metrology. By measuring small gravitational changes, this technology would enable self contained navigational systems for use in autonomous vehicles of all sorts, without the need for traditional GPS. (1) What
1 comment
Read more