NOP-Oriented Programming: Should we Care?

Pierre-Yves Péneau (1) , Ludovic Claudepierre (2) , Damien Hardy (3) , Erven Rohou (3)

1 SED [Rennes] - Service Expérimentation et Développement
2 CIDRE - Confidentialité, Intégrité, Disponibilité et Répartition
3 PACAP - Pushing Architecture and Compilation for Application Performance

Many fault injection techniques have been proposed in the recent years to attack computing systems, as well as the corresponding countermeasures. Most of published attacks are limited to one or a few faults. We provide a theoretical analysis of instruction skip attacks to show how an attacker can modify an application behavior at run-time when thousands of instruction skips are possible. Our main result is that instruction skip is Turing-complete under our theoretical model while requiring the presence of only common instructions in the binary. As a consequence, we show that current software-based countermeasures are fragile. In addition, we release a modification of gem5 that implements a classical instruction skip fault model that we used for our experiments. We believe this kind of simulation tools are useful to help the community explore attacks and hardware and software countermeasures.

Mots clés: Fault injection; Turing-completeness; ISA-level simulation; Instruction skip

Domaines: Informatique [cs]; Cryptographie et sécurité [cs.CR]

Pierre-Yves Péneau, Ludovic Claudepierre, Damien Hardy, Erven Rohou. NOP-Oriented Programming: Should we Care?. Sécurité des Interfaces Logiciel/Matériel, Sep 2020, Genoa (virtual), Italy. ⟨10.1109/EuroSPW51379.2020.00100⟩. ⟨hal-02912301⟩