Microsoft Technology Licensing, LLC

Wehnus, LLC

Matthew Ryan Miller

Kenneth Dean Johnson

Timothy William Burrell

Jordan Thomas Rabet

Arun Upadhyaya Kishan

Hari R Pulapaka

Richard John Black

Jason Joseph Weber

Manuel Silverio Da Silva Costa

Gregory John Colombo

Miguel Oom Temudo De Castro

Pengxiang Zhao

Brian E Manthos

Tobin R Titus

John Hazen

Garrett Leischner

Evan Lincoln Tice

Colin Pacitti

Daniel Libby

Stephen L Hufnagel

Ken Johnson

Darren Ernest Canavor

Yevgeniy Bak

Landy Wang

John J Lambert

Nitin Kumar Goel

Navin Narayan Pai

Adam M Zabrocki

Shawn Daniel Hoffman

Matthew Bucher

Grzegorz M Wroblewski

Gregory Justice Riggs

Various technologies described herein pertain to enforcing control flow integrity by adding instrumentation when source code is compiled or binary code is rewritten. An indirect call to a control transfer target (e.g., in the source code, in the binary code, etc.) can be identified. Moreover, the instrumentation can be inserted prior to the indirect call. The instrumentation can use a bit from a bitmap maintained by a runtime to verify whether the control transfer target is valid. When an executable image that includes the inserted instrumentation runs, execution can be terminated and/or other appropriate actions can be taken when the control transfer target is determined to be invalid; alternatively, execution can continue when the control transfer target is determined to be valid.

Control flow integrity enforcement at scale

Techniques for mitigating timing attacks via dynamically triggered time dilation are provided. According to one set of embodiments, a computer system can track a count of application programming interface (API) calls or callbacks made by a program within each of a series of time buckets. The computer system can further determine that the count exceeds a threshold count for a predefined consecutive number of time buckets. Upon making this determination, the computer system can trigger time dilation with respect to the program, where the time dilation causes the program to observe a dilated view of time relative to real time.

Mitigating timing attacks via dynamically triggered time dilation

Techniques for mitigating timing attacks via dynamically scaled time dilation are provided. According to one set of embodiments, a computer system can enable time dilation with respect to a program, where the time dilation causes the program to observe a dilated view of time relative to real time. Then, while the time dilation is enabled, the computer system can track a count of application programming interface (API) calls or callbacks made by a program within each of a series of time buckets and, based on counts tracked for a range of recent time buckets, scale up or scale down a degree of the time dilation.

Mitigating timing attacks via dynamically scaled time dilation

Each program thread running on a computing device has an associated data stack and control stack. A stack displacement value is generated, which is the difference between the memory address of the base of the data stack and the memory address of the base of the control stack, and is stored in a register of a processor of the computing device that is restricted to operating system kernel use. For each thread on which return flow guard is enabled, prologue and epilogue code is added to each function of the thread (e.g., by a memory manager of the computing device). The data stack and the control stack each store a return address for the function, and when the function completes the epilogue code allows the function to return only if the return addresses on the data stack and the control stack match.

Return flow guard using control stack identified by processor register

Most machines in an organization's computer network connect to the Internet and create web traffic logs which allow analysis of HTTP traffic in a simple, centralized way. The web traffic logs may contain error reports and error reports contain significant information that can be used to detect network security. By reviewing the error reports, significant information about a network and its security can be found as common sources of network security weakness may be watched for in the error reports.

Identifying security properties of systems from application crash traffic

The subject disclosure is directed towards detecting software vulnerabilities in an isolated computing environment. In order to evaluate each input submission from an external computer, a plurality of tasks are automatically generated for execution on one or more computing units running within the isolated computing environment. Various configurations of the one or more computing units are defined in which each computing unit executes the plurality of tasks. A report is produced comprising results associated with such an execution.

Detecting software vulnerabilities in an isolated computing environment

In response to a memory allocation request received from an application thread, a random number is obtained (e.g., from a random number list previously populated with multiple random numbers). A starting location in at least a portion of a bitmap associated with a region including multiple blocks of the memory is determined based on the random number. A portion of the bitmap is scanned, beginning at the starting location, to identify a location in the bitmap corresponding to an available block of the multiple blocks, and an indication of this available block is returned to the application thread.

Lightweight random memory allocation

The subject disclosure is directed towards preventing the exploitation by malicious code of object state corruption vulnerabilities, such as use-after-free vulnerabilities. An object class is configured with a secret cookie in a virtual function table of the object, e.g., inserted at compile time. An instrumentation check inserted in the program code evaluates the secret cookie to determine whether the object state has been corrupted before object access (e.g., a call to one of the object's methods) is allowed. If corrupted, access to the object is prevented by the instrumentation check. Another instrumentation check may be used to determine whether the object's virtual table pointer points to a location outside of the module that contains the legitimate virtual function table; if so, object access is prevented.

Using virtual table protections to prevent the exploitation of object corruption vulnerabilities

A system and method for address space layout randomization ('ASLR') for a Windows operating system is disclosed. The address space layout includes one or more memory regions that are identified and then a particular implementation of the system randomizes the identified memory region in order to prevent any software vulnerabilities.

Method of address space layout randomization for windows operating systems

Growing community of inventors

Seattle, WA, United States of America

Matthew Ryan Miller