"Rubiks"-arkitekturen Morpheus vann över 500 DARPA-hackare

Attacks often succeed by abusing the gap between program and machine-level semantics-- for example, by locating a sensitive pointer, exploiting a bug to overwrite this sensitive data, and hijacking the victim program's execution. In this work, we take secure system design on the offensive by continuously obfuscating information that attackers need but normal programs do not use, such as representation of code and pointers or the exact location of code and data. Our secure hardware architecture, Morpheus, combines two powerful protections: ensembles of moving target defenses and churn. Ensembles of moving target defenses randomize key program values (e.g., relocating pointers and encrypting code and pointers) which forces attackers to extensively probe the system prior to an attack. To ensure attack probes fail, the architecture incorporates churn to transparently re-randomize program values underneath the running system. With frequent churn, systems quickly become impractically difficult to penetrate. We demonstrate Morpheus through a RISC-V-based prototype designed to stop control-flow attacks. Each moving target defense in Morpheus uses hardware support to individually offer more randomness at a lower cost than previous techniques. When ensembled with churn, Morpheus defenses offer strong protection against control-flow attacks, with our security testing and performance studies revealing: i) high-coverage protection for a broad array of control-flow attacks, including protections for advanced attacks and an attack disclosed after the design of Morpheus, and ii) negligible performance impacts (1%) with churn periods up to 50 ms, which our study estimates to be at least 5000x faster than the time necessary to possibly penetrate Morpheus.

Skeptisk. Jag förstår inte riktigt vad tekniken gör, och det som står i artikeln låter mest som meningslöst technobabble. Det kanske finns någon bättre artikel som förklarar tekniken bakom?

Det bästa jag kan uttyda är att det här är någon slags "ASLR on steroids". D.v.s. en slags mitigering som går ut på att göra traditionär "binary exploitation" omöjlig genom att det finns så mycket slumpfaktorer i hur processorn fungerar.

Att säga att man har löst den sortens attacker säger ju inget om andra sorters vanliga attacker. Om jag t.ex. glömmer att kolla om en användare är behörig för att få viss data i min kod innan jag faktiskt lämnar ut datorn så kommer ingen processorarkitektur i världen hjälpa dig.

Tänkte samma… Här har du den riktiga artikeln bakom tekniken https://dl.acm.org/doi/pdf/10.1145/3297858.3304037

Tekniken är implementerad i en risk-v krets, och denna sektion är väl en rätt beskrivande summering:

” We assume that the system contains vulnerabilities, and attackers are attempting to penetrate system security via those vulnerabilities. A large number of these attacks exploit execution-level semantics (e.g., code location and pointer values) that are undefined at the language level and to which normal programs remain agnostic. Furthermore, over time, sophisticated attacks require progressively more execution- level information as they attempt to evade successive layers of defenses such as NX-bit, ASLR, and control-flow integrity. Hence, we propose to systematically randomize all unde- fined semantics that are critical to craft successful attacks– using hardware to enable an ensemble of such moving target defenses to be deployed concurrently. Additionally, we intro- duce churn, a mechanism that transparently re-randomizes the moving target program values while the system is in operation. By limiting our defenses to values associated with undefined program semantics, we construct a secure system that is transparent to normal programs but intentionally hos- tile to malicious programs. Crucially, even though concrete exploits and vulnerabilities grow rapidly, security-relevant undefined semantics do not. Thus, EMTDs with churn provide a more durable and proactive layer of defense than patching specific vulnerabilities.”

Tänkte samma… Här har du den riktiga artikeln bakom tekniken https://dl.acm.org/doi/pdf/10.1145/3297858.3304037

Tekniken är implementerad i en risk-v krets, och denna sektion är väl en rätt beskrivande summering:

” We assume that the system contains vulnerabilities, and attackers are attempting to penetrate system security via those vulnerabilities. A large number of these attacks exploit execution-level semantics (e.g., code location and pointer values) that are undefined at the language level and to which normal programs remain agnostic. Furthermore, over time, sophisticated attacks require progressively more execution- level information as they attempt to evade successive layers of defenses such as NX-bit, ASLR, and control-flow integrity. Hence, we propose to systematically randomize all unde- fined semantics that are critical to craft successful attacks– using hardware to enable an ensemble of such moving target defenses to be deployed concurrently. Additionally, we intro- duce churn, a mechanism that transparently re-randomizes the moving target program values while the system is in operation. By limiting our defenses to values associated with undefined program semantics, we construct a secure system that is transparent to normal programs but intentionally hos- tile to malicious programs. Crucially, even though concrete exploits and vulnerabilities grow rapidly, security-relevant undefined semantics do not. Thus, EMTDs with churn provide a more durable and proactive layer of defense than patching specific vulnerabilities.”

OK, med andra ord ett skydd mot t.ex. buffer overflows, minneskorruption, use-after-free, kanske t.o.m. grejer som Spectre etc. Kanske användbart, men bara en liten andel av de säkerhetsbuggar som finns i riktiga datorsystem.

D.v.s. totalt hype att påstå att detta är "ohackbart".

Det är ju ändå lite kul att dom har SSITH, FETT och BUG BOUNTY.

https://fett.darpa.mil/BugBounty