Upload
polly-wiggins
View
218
Download
0
Embed Size (px)
DESCRIPTION
3
Citation preview
Platform-Independent Programs
Sang Kil Cha, Brian Pak, David BrumleyCarnegie Mellon University
Richard J. LiptonGeorgia Institute of Technology
17th ACM CCS (October, 2010)
A Seminar at Advanced Defense Lab 2
Outline Introduction Problem Statement Approach RG Design Implementation Related Work
A Seminar at Advanced Defense Lab 3
Introduction
x86
A Seminar at Advanced Defense Lab 4
Platform-Independent Program?
A typical and often implicit security assumption is that a program is only semantically meaningful on one platform› Radically different instruction sets› Different program encodings
But, is it true?
A Seminar at Advanced Defense Lab 5
In this paper Automatically generate a single binary
string that› is a valid program on some architectures
› can have completely different desired runtime behaviors
A Seminar at Advanced Defense Lab 6
Security-Critical Implications
Steganography.› m1(b) = normal program› m2(b) = secret information
Rogue Updates› m1(b) = normal program› mupdate(b) = malware› Security measures, such as digitally signing the
code, are insufficient since they only verify the code itself has not been tampered with, not the execution environment
A Seminar at Advanced Defense Lab 7
Security-Critical Implications
Exfiltration Protection› m1(b) = important program› m2(b) = delete itself
Viruses and Shellcode
New Architecture› A company switches from architecture A to
B
A Seminar at Advanced Defense Lab 8
Problem Statement Notation
› ∑ = {0, 1}› Bit string› mj(bi)
The execution of program bi on machine mj
› (bi, mj) bi is compiled for mj
› bi is not a valid string on mj
)( ij bm
*b
A Seminar at Advanced Defense Lab 9
Problem Definition Platform-Independent Program
›
PIP generation challenge› Given (bi, mj) list›
)()( 21 bmbm
)()(:),( pipjijji bmbmmb
A Seminar at Advanced Defense Lab 10
Approach
b1 b2 b3
bpip
A Seminar at Advanced Defense Lab 11
Gadgets
b1 b2 b3
A Gadget
A Seminar at Advanced Defense Lab 12
Gadget Header Example
A Seminar at Advanced Defense Lab 13
Connecting Gadgets
A Seminar at Advanced Defense Lab 14
Generation Algorithm
A Seminar at Advanced Defense Lab 15
RG Design Header-Init: Finding Gadget Headers
› (nop)* (jmp) (.)*
Header generation algorithm› Enumeration all possible string X
several days for 4-byte header› Make header templates› Computing the intersection of templates
A Seminar at Advanced Defense Lab 16
RG Design Disassemble, Gadget-Gen, and Merge
A Seminar at Advanced Defense Lab 17
RG Design – PI Translation
A Seminar at Advanced Defense Lab 18
PI Translation
A Seminar at Advanced Defense Lab 19
Implementation RG is currently implemented in about
5,000 lines of a mixture of C++ and Ruby.
The gadget finder program finds all the possible 4-byte, 8-byte, and 12-byte gadget headers
A Seminar at Advanced Defense Lab 20
Instruction Validity 32-bit long
› 90.12% for ARM› 68.46% for MIPS› 32.69% for x86
12.31%
A Seminar at Advanced Defense Lab 21
Gadget Header Atomic NOPs
› 326 for x86› 241 for ARM› 14,709,948 for MIPS
Three-architecture gadget headers› 4×1014 for 12-byte long› 0.07 sec for 4-byte, 16 secs for 8-byte, 7
hours for 12-byte
A Seminar at Advanced Defense Lab 22
Gadget Header
A Seminar at Advanced Defense Lab 23
Evaluation Hello world
Prime Checker
Shellcode
Vulnerabilities› Snort 2.4› iPhone’s coreaudio library
A Seminar at Advanced Defense Lab 24
Evaluation
Using PI Translation
A Seminar at Advanced Defense Lab 25
Evaluation
A Seminar at Advanced Defense Lab 26
Related Work Muti-Platform Execution
› Fat binary two independent program images are
combined with special meta-data that is used at run-time to select the appropriate image
› Drew Dean in 2003› Nemo in 2005 [link]
A Seminar at Advanced Defense Lab 27
Related Work(cont.) Steganography
› Simmons in 1984 The prisoner’s problem
A Seminar at Advanced Defense Lab 28
Discussion PIP length More Gadget Headers Large Input Programs Indirect Jumps and Self-Modifying Code Generating Platform
› m(b) = normal program› generate m’› m’(b) = malware
A Seminar at Advanced Defense Lab 29
Thank You