Show simple item record

dc.contributor.authorGiffin, Jonathon T.en_US
dc.contributor.authorChristodorescu, Mihaien_US
dc.contributor.authorKruger, Louisen_US
dc.date.accessioned2012-03-15T17:19:14Z
dc.date.available2012-03-15T17:19:14Z
dc.date.created2005en_US
dc.date.issued2005
dc.identifier.citationTR1531en_US
dc.identifier.urihttp://digital.library.wisc.edu/1793/60446
dc.description.abstractRecent research has proposed self-checksumming as a method by which a program can detect any possibly malicious modification to its code. Wurster et al. developed an attack against such programs that renders code modifications undetectable to any self-checksumming routine. The attack replicated pages of program text and altered values in hardware data structures so that data reads and instruction fetches retrieved values from different memory pages. A cornerstone of their attack was its applicability to a variety of commodity hardware: they could alter memory accesses using only a malicious operating system. In this paper, we show that their page-replication attack can be detected by self-checksumming programs with self-modifying code. Our detection is efficient, adding less than 1 microsecond to each checksum computation in our experiments on three processor families, and is robust up to attacks using either costly interpretive emulation or specialized hardware.en_US
dc.format.mimetypeapplication/pdfen_US
dc.publisherUniversity of Wisconsin-Madison Department of Computer Sciencesen_US
dc.titleStrengthening Software Self-Checksumming via Self-Modifying Codeen_US
dc.typeTechnical Reporten_US


Files in this item

Thumbnail

This item appears in the following Collection(s)

  • CS Technical Reports
    Technical Reports Archive for the Department of Computer Sciences at the University of Wisconsin-Madison

Show simple item record