Compiler-instrumented, dynamic secret-redaction of legacy processes for attacker deception
Frederico Araujo, Kevin W. Hamlen · 2015
An enhanced dynamic taint-tracking semantics is pre-sented and implemented, facilitating fast and precise run-time secret redaction from legacy processes, such as those compiled from C/C++. The enhanced semantics reduce the annotation burden imposed upon developers seeking to add secret-redaction capabilities to legacy code, while curtailing over-tainting and label creep. An implementation for LLVM’s DataFlow Sani-tizer automatically instruments taint-tracking and secret-redaction support into annotated C/C++ programs at compile-time, yielding programs that can self-censor their address spaces in response to emerging cyber-attacks. The technology is applied to produce the first information flow-based honey-patching architecture for the Apache web server. Rather than merely blocking intrusions, the modified server deceptively diverts attacker connections to secret-sanitized process clones that monitor attacker activities and disinform adversaries with honey-data. 1