ASIST: Architectural Support for Instruction Set Randomization

Code injection attacks continue to pose a threat to today’s comput-ing systems, as they exploit software vulnerabilities to inject and execute arbitrary, malicious code. Instruction Set Randomization (ISR) is able to protect a system against remote machine code in-jection attacks by randomizing the instruction set of each process. This way, the attacker will inject invalid code that will fail to exe-cute on the randomized processor. However, all the existing imple-mentations of ISR are based on emulators and binary instrumen-tation tools that (i) incur a significant runtime performance over-head, (ii) limit the ease of deployment of ISR, (iii) cannot protect the underlying operating system kernel, and (iv) are vulnerable to evasion attempts trying to bypass ISR protection. To address these issues we propose ASIST: an architecture with hardware and operating system support for ISR. We present the de-sign and implementation of ASIST by modifying and mapping a SPARC processor onto an FPGA board and running our modified Linux kernel to support the new features. The operating system loads the randomization key of each running process into a newly defined register, and the modified processor decodes the process’s instructions with this key before execution. Moreover, ASIST pro-tects the system against attacks that exploit kernel vulnerabilities to run arbitrary code with elevated privileges, by using a separate randomization key for the operating system. We show that ASIST transparently protects all applications and the operating system ker-nel from machine code injection attacks with less than 1.5 % run-time overhead, while only requiring 0.7 % additional hardware