RCR for preventing stack smashing attacks bypass stack canaries

With the fast propagation of computer system, the number and variety of security vulnerabilities in those systems are increasing. Stack-smashing has always been one of the most common techniques for hacking application controls. Different techniques have been proposed for protection from this type of attacks such as Stack Smashing Protector (SSP) technique. The idea of SSP is keeping some secret key information (i.e. canary) needed by attackers to build the exploit. Unfortunately, attackers always find ways to bypass this mechanism. In this paper, we propose Random Canaries Repository (RCR) approach that enhances the SSP technique to make bypassing the value of canary more difficult for attackers. The vulnerable applications can get a random value of canary from the repository with the execution start and in case of detecting some possible attack. RCR can work with existing runtime environment without needing special hardware. The overhead was tested and showed that the overhead is only 3%. RCR is able to prevent buffer overflow and to make the estimation of the right value of canary more difficult for attackers with trivial overhead.