Home
Resource
System memory protection and vulnerability assessment in presence of software attacks
PDF
PDF format is widely accepted and good for printing.
Plug-in required
PDF-1(9.73 MB)
Citation & Export
View Usage Statistics
Staff View

Citation & Export
Hide

Simple citation

Zhang, Mingbo. System memory protection and vulnerability assessment in presence of software attacks. Retrieved from https://doi.org/doi:10.7282/t3-93x2-2f36

Export

Click here for information about Citation Management Tools at Rutgers.

Statistics
Hide

Description

TitleSystem memory protection and vulnerability assessment in presence of software attacks
NameZhang, Mingbo (author); Zonouz, Saman (chair); Rutgers University; School of Graduate Studies
Date Created2021
Other Date2021-05 (degree)
SubjectVulnerability, Electrical and Computer Engineering
Extent1 online resource (xix, 143 pages)
DescriptionSoftware vulnerabilities widely exist among various software from operating system kernel to web browser, from PC to embedded device. The arms race is continuing between new vulnerability exploit techniques and new mitigations. The essential part of protecting software from compromising relies on system memory protection in specific ways. Addressing protection of system critical variables, heap layout, and user variables that are referenced freely from the kernel are the state-of-art challenges. This dissertation aims at protecting the above-mentioned vulnerabilities that exist in the wild and presents systematic mitigation solutions. For each specific vulnerability, our mitigation either leverages a new CPU features such as Intel SGX or an existing CPU feature in a novel way to achieve adequate protection with a modest performance overhead. Additionally, we utilize a software-only method to solve the use-after-free vulnerability in the web browsers — a trade-off between the deterministic heap layout and memory usage. Furthermore, we develop a new software attack that is parasitic on an extra piece of hardware circuit to assess conventional software mitigations’ effectiveness. We evaluated each system with real-world vulnerabilities and their exploits that are publicly available. The results show that these mitigations can effectively protect the system with an acceptable performance overhead. Our parasitic-hardware-based attack reveals the possibility of being deployed in the field devices such critical controllers (e.g., programmable logic controllers PLCs) in cyber-physical platforms such as the power grid infrastructures. This type of attack completely evades conventional software mitigation techniques.
NotePh.D.
NoteIncludes bibliographical references
Genretheses, ETD doctoral
Persistent URLhttps://doi.org/doi:10.7282/t3-93x2-2f36
LanguageEnglish
CollectionSchool of Graduate Studies Electronic Theses and Dissertations
Organization NameRutgers, The State University of New Jersey
RightsThe author owns the copyright to this work.
Version 8.5.5
Rutgers University Libraries - Copyright ©2024