INSeRT: Protect Dynamic Code Generation against spraying
Tao Wei, Tielei Wang, Lei Duan, Jing Luo · International Conference on Information Science and Technology · 2011
DCG (Dynamic Code Generation) technologies have found widely applications in the Web 2.0 era, and DCG-Spraying attack can easily circumvent DEP and ASLR protection mechanisms built in modern operating systems. We propose a new protection method, INSeRT, which combines randomization of intrinsic elements of machine instructions and randomly planted special trapping snippets. INSeRT practically renders the “sprayed code” ineffective, while alerts the host program of ongoing attacking attempts. We implemented a prototype of INSeRT on the V8 JavaScript engine with a performance overhead of less than 5%, which should be acceptable in practical application.