Problem

Control-flow attacks first probe a system to learn where code and pointers are, and only then strike. Static randomization helps only until the attacker finishes probing.

Idea

Morpheus combines an ensemble of moving target defenses (encrypted code and pointers, relocated code and data) with churn: the hardware re-randomizes these values transparently underneath the running program. A probe result is stale by the time it can be used.

Program viewunchanged semanticsMachine viewencrypted code/pointers, relocated datachurnchurnchurnchurnprobe ✓attack ✗ (stale)re-randomize every ~50 ms
Each churn period re-randomizes the machine view; the program view does not change.

Result

~1%performance overhead at a 50 ms churn period
≥5000×faster re-randomization than the estimated time to penetrate

The RISC-V prototype gives high-coverage protection against a broad set of control-flow attacks.

My role

Co-author. I evaluated the robustness of the defense layers, added compiler support to tag memory at compile time, and worked on the FPGA prototype.

Paper: ASPLOS 2019