Attack Synthesis for Strings using Meta-heuristics

Transcription

1 Attack Synthesis for Strings using Meta-heuristics JPF Workshop 2018 Seemanta Saha*, Ismet Burak Kadron*, William Eiers*, Lucas Bang+, Tevfik Bultan* * University of California Santa Barbara + Harvey Mudd College

2 Software Side-Channel Attack 2

3 Software Side-Channel Attack input program Output 3

4 Software Side-Channel Attack Public input Secret input program Output 4

5 Software Side-Channel Attack Public input Secret input program Output observations 5

6 Software Side-Channel Attack Public input Secret input program Output (main-channel) observations (side-channel) 6

7 Timing Side-Channel Attack Public input Secret input program Output (main-channel) Distinguishable execution times (timing side-channel) 7

8 Timing Side-channel in Password Checking Function public boolean passwordchecker(string h, String l) { Public input (l) for (int i = 0; i < h.length(); i++) { Secret input (h) if (h[i]!= l[i]) return false false/true } return true } distinguishable execution time 8

9 Timing Side-channel in Password Checking Function public boolean passwordchecker(string h, String l) { Public input (l) for (int i = 0; i < h.length(); i++) { Secret input (h) if (h[i]!= l[i]) return false false/true } return true } distinguishable execution time Let s consider one loop iteration takes 1 millisecond 9

10 Timing Side-channel in Password Checking Function public boolean passwordchecker(string h, String l) boolean { public passwordchecker(string h, String l) { for (int = 0;ii << h.length(); h.length(); i++)i++) { for (int i =i 0; if (h[i]!= l[i]) return false if (h[i]!= l[i]) } return true false return } l = XXXXXXXXXX h = PATHFINDER { false } return true } Execution time = 5 milliseconds 10

11 Timing Side-channel in Password Checking Function public boolean passwordchecker(string h, String l) boolean { public passwordchecker(string h, String l) { for (int = 0;ii << h.length(); h.length(); i++)i++) { for (int i =i 0; if (h[i]!= l[i]) return false if (h[i]!= l[i]) } return true false return } l = MATHFINDER h = PATHFINDER { false } return true } Execution time = 5 milliseconds 11

12 Timing Side-channel in Password Checking Function public boolean passwordchecker(string h, String l) boolean { public passwordchecker(string h, String l) { for (int = 0;ii << h.length(); h.length(); i++)i++) { for (int i =i 0; if (h[i]!= l[i]) return false if (h[i]!= l[i]) } return true false return } l = PXXXXXXXXX h = PATHFINDER { false } return true } Execution time = 6 milliseconds 12

13 Timing Side-channel in Password Checking Function public boolean passwordchecker(string h, String l) boolean { public passwordchecker(string h, String l) { for (int = 0;ii << h.length(); h.length(); i++)i++) { for (int i =i 0; if (h[i]!= l[i]) return false if (h[i]!= l[i]) } return true false return } l = PAXXXXXXXX h = PATHFINDER { false } return true } Execution time = 7 milliseconds 13

14 Timing Side-channel in Password Checking Function public boolean passwordchecker(string h, String l) boolean { public passwordchecker(string h, String l) { for (int = 0;ii << h.length(); h.length(); i++)i++) { for (int i =i 0; if (h[i]!= l[i]) return false if (h[i]!= l[i]) } return true false return } l = PATXXXXXXX h = PATHFINDER { false } return true } Execution time = 8 milliseconds 14

15 Timing Side-channel in Password Checking Function public boolean passwordchecker(string h, String l) boolean { public passwordchecker(string h, String l) { for (int = 0;ii << h.length(); h.length(); i++)i++) { for (int i =i 0; if (h[i]!= l[i]) return false if (h[i]!= l[i]) } return true false return } l = PATHXXXXXX h = PATHFINDER { false } return true } Execution time = 9 milliseconds 15

16 Timing Side-channel in Password Checking Function public boolean passwordchecker(string h, String l) boolean { public passwordchecker(string h, String l) { for (int = 0;ii << h.length(); h.length(); i++)i++) { for (int i =i 0; if (h[i]!= l[i]) return false if (h[i]!= l[i]) } return true false return } l = PATHFINDER h = PATHFINDER { true } return true } Execution time = 15 milliseconds 16

17 Timing Side-channel in Password Checking Function known as segment attack vulnerability: attacker reveals the secret input segment (character) by segment (character) 17

18 Timing Side-channel in Password Checking Function known as segment attack vulnerability: attacker reveals the secret input segment (character) by segment (character) this vulnerability was present in Google KeyCzar library 18

19 Timing Side-channel in Password Checking Function known as segment attack vulnerability attacker reveals the secret input segment (character) by segment (character) this vulnerability was present in Google KeyCzar library, OpenID, etc. 19

20 Attack Synthesis Overview Static Analysis Phase Attack Synthesis Phase 20

21 Attack Synthesis Overview String Function F(h, l) Static Analysis Phase Attack Synthesis Phase 21

22 Attack Synthesis Overview String Function F(h, l) Static Analysis Phase Merged Path constraints Ψ Attack Synthesis Phase 22

23 Attack Synthesis Overview String Function F(h, l) Static Analysis Phase Merged Path constraints Ψ Attack Synthesis Phase Sequence of Attack inputs 23

24 Attack Synthesis Overview Model Counting String Function F(h, l) Static Analysis Phase Merged Path constraints Ψ Attack Synthesis Phase Sequence of Attack inputs 24

25 Attack Synthesis Overview Model Counting String Function F(h, l) Static Analysis Phase Merged Path constraints Ψ Entropy Function Attack Synthesis Phase Sequence of Attack inputs 25

26 Attack Synthesis Overview Model Counting String Function F(h, l) Static Analysis Phase Merged Path constraints Ψ Entropy Function Attack Synthesis Phase Sequence of Attack inputs Meta-heuristics 26

27 Static Analysis Phase String Function F(h,l) 27

28 Static Analysis Phase Constraints on h: length and range bound String Function F(h,l) 28

29 Static Analysis Phase Constraints on h: length and range bound String Function F(h,l) Symbolic Execution (SPF) 29

30 Static Analysis Phase Constraints on h: length and range bound String Function F(h,l) Symbolic Execution (SPF) Cost Function: number of instructions executed in byte 30

31 Static Analysis Phase Constraints on h: length and range bound String Function F(h,l) Symbolic Execution (SPF) Path constraints and Cost Cost Function : number of instructions executed in byte 31

32 Static Analysis Phase Constraints on h: length and range bound String Function F(h,l) Symbolic Execution (SPF) Path constraints and Cost Merge path constraints based on indistinguishable cost Cost Function : number of instructions executed in byte 32

33 Path Constraints for Password Checking Function Length of public input (l) = 4 Length of secret input (h) = 4 33

34 Goal: Attack Synthesis 34

35 Generate Sequence of inputs revealing information about the secret value 35

36 Attack Synthesis 36

37 Attack Synthesis Unknown Secret: PATH 37

38 Attack Synthesis Unknown Secret: PATH String range: AAAA ~ ZZZZ Solve Constraint attack input: ABCD Get a Random Model 38

39 Attack Synthesis Unknown Secret: PATH String range: AAAA ~ ZZZZ Solve Constraint attack input: ABCD Get a Random Model Infer constraint based on observation 39

40 Attack Synthesis Unknown Secret: PATH String range: AAAA ~ ZZZZ Solve Constraint attack input: ABCD Get a Random Model Inferred constraint: h[0]!= l[0] Infer constraint based on observation 40

41 Attack Synthesis Unknown Secret: PATH String range: AAAA ~ ZZZZ Solve Constraint attack input: ABCD Get a Random Model Inferred constraint: h[0]!= l[0] Infer constraint based on observation Updated constraint on h: h[0]!= A 41

42 Attack Synthesis Unknown Secret: PATH String range: AAAA ~ ZZZZ Solve Constraint attack input: ABCD Get a Random Model Infer constraint based on observation Inferred constraint: h[0]!= l[0] Solve Updated constraint on h: h[0]!= A attack input: PDEF 42

43 Attack Synthesis Unknown Secret: PATH String range: AAAA ~ ZZZZ Solve Constraint attack input: ABCD Get a Random Model Infer constraint based on observation Inferred constraint: h[0]!= l[0] Solve Updated constraint on h: h[0]!= A attack input: PDEF Inferred constraint: h[0] == l[0] && h[1]!= l[1] Infer constraint based on observation 43

44 Attack Synthesis Unknown Secret: PATH String range: AAAA ~ ZZZZ Solve Constraint attack input: ABCD Get a Random Model Infer constraint based on observation Inferred constraint: h[0]!= l[0] Solve Updated constraint on h: h[0]!= A attack input: PDEF Inferred constraint: h[0] == l[0] && h[1]!= l[1] Infer constraint based on observation Updated constraint on h: h[0]!= A && h[0] == P && h[1]!= D Solve attack input: PAGD 44

45 Attack Synthesis Unknown Secret: PATH String range: AAAA ~ ZZZZ Solve Constraint attack input: ABCD Get a Random Model Infer constraint based on observation Inferred constraint: h[0]!= l[0] Solve Updated constraint on h: h[0]!= A attack input: PDEF Inferred constraint: h[0] == l[0] && h[1]!= l[1] Infer constraint based on observation Updated constraint on h: h[0]!= A && h[0] == P && h[1]!= D Solve attack input: PAGD Update constraints on h 45

46 Attack Synthesis Unknown Secret: PATH String range: AAAA ~ ZZZZ Solve Constraint attack input: ABCD Get a Random Model Infer constraint based on observation Inferred constraint: h[0]!= l[0] Solve Updated constraint on h: h[0]!= A attack input: PDEF Inferred constraint: h[0] == l[0] && h[1]!= l[1] Infer constraint based on observation Get next attack input attack input: PAGD Update constraints on h Updated constraint on h: h[0]!= A && h[0] == P && h[1]!= D Solve 46

47 Attack Synthesis Unknown Secret: PATH String range: AAAA ~ ZZZZ Solve Constraint attack input: ABCD Get a Random Model Infer constraint based on observation Inferred constraint: h[0]!= l[0] Sequence of attack inputs Solve Updated constraint on h: h[0]!= A attack input: PDEF Inferred constraint: h[0] == l[0] && h[1]!= l[1] Infer constraint based on observation Get next attack input attack input: PAGD Update constraints on h Updated constraint on h: h[0]!= A && h[0] == P && h[1]!= D Solve 47

48 Attack Synthesis Phase Input sequence revealing partial or full secret input value Initial Path Constraints Constraint Solver (ABC) Get a model Use as Attack Input Observation Update path constraints 48

49 Attack Synthesis Phase Input sequence revealing partial or full secret input value Initial Path Constraints Constraint Solver (ABC) Get a model Use as Attack Input Observation Update path constraints 49

50 Attack Synthesis Phase Input sequence revealing partial or full secret input value Initial Path Constraints Constraint Solver (ABC) Get a model Use as Attack Input Observation Update path constraints 50

51 We can automatically generate an attack using Program path constraints Observation from program execution Generating constraints from observation Updating constraints on secret value Solving constraints to get attack input We call this Model-Based Attack Synthesis (M) 51

52 We can synthesize attacks using Model-Based (M) Attack Synthesis Why do we need meta-heuristics? 52

53 String inequality Function public String inequality(string i) { if(s <= i) do something simple; // 2 seconds else do something complex; // 5 seconds return 0; } 53

54 String inequality Function public String inequality(string i) { if(s <= i) do something simple; // 2 seconds else do something complex; // 5 seconds observations return 0; } O = 1 s <= i O = 2 s > i 54

55 O = 1 s <= i S AAAA AAAB O = 2 s > i ZZZY ZZZZ 55

56 O = 1 s <= i S AAAA AAAB O = 2 s > i ZZZY ZZZZ i = ZZZX O = 1 s <= ZZZX AAAA AAAB O = 2 s > ZZZX ZZZY ZZZZ Attacker s input and observation partitions domain of S 56

57 O = 1 s <= i S AAAA AAAB O = 2 s > i ZZZY ZZZZ i = ZZZX O = 1 s <= ZZZX AAAA AAAB O = 2 s > ZZZX ZZZY i = MNON O = 1 AAAA AAAB ZZZZ i = ZZZZ O = 2 ZZZY ZZZZ Attacker s input and observation sequences partitions domain of S 57

58 How input and observation affects partitioning? 58

59 O = 1 s <= i AAAA AAAB O = 2 s > i MNOO MNOP ZZZY ZZZZ 59

60 O = 1 s <= i AAAA AAAB O = 2 s > i ZZZY ZZZZ i = ZZZX O = 1 s <= ZZZX AAAA AAAB O = 2 s > ZZZX ZZZY ZZZZ 60

61 O = 1 s <= i AAAA AAAB O = 2 s > i ZZZY ZZZZ i = ZZZX O = 1 s <= ZZZX AAAA AAAB O = 2 s > ZZZX ZZZY i = UVWA O = 2 O = 1 AAAA AAAB ZZZZ UVWB ZZZX 61

62 O = 1 s <= i AAAA AAAB O = 2 s > i ZZZY ZZZZ i = ZZZX O = 1 s <= ZZZX AAAA AAAB O = 2 s > ZZZX ZZZY i = UVWA O = 2 O = 1 AAAA AAAB i = TAOM AAAB UVWB ZZZX O = 2 O = 1 AAAA ZZZZ TAON UVWA 62

63 O = 1 s <= i AAAA AAAB O = 2 s > i ZZZY ZZZZ i = MMMM O = 1 s <= MMMM AAAA AAAB O = 2 s > MMMM ZZZY ZZZZ 63

64 O = 1 s <= i AAAA AAAB O = 2 s > i ZZZY ZZZZ i = MMMM O = 1 s <= MMMM AAAA AAAB O = 2 s > MMMM i = FFFF O = 1 AAAA ZZZY ZZZZ i = TTTT O = 2 AAAB O = 1 O = 2 ZZZY ZZZZ 64

65 O = 1 s <= i AAAA AAAB O = 2 s > i ZZZY ZZZZ i = MMMM O = 1 s <= MMMM AAAA AAAB O = 2 s > MMMM i = FFFF O = 2 AAAB i = CCCC AAAA i = JJJJ ZZZZ i = TTTT O = 1 AAAA ZZZY O = 1 O = 2 i = QQQQ ZZZY ZZZZ i = WWWW. ZZZZ 65

66 Imbalanced partitions Worst case : number of inputs = domain size = 264 = [number of alphabets = 26, length =4] 66

67 Balanced partitions Worst case : number of inputs = log2(456976) = 18.8 [number of alphabets = 26, length =4] 67

68 Objective Function Balanced partitions Maximizes information gain 68

69 Objective Function O = 1 s <= i O = 2 s > i Maximize information gain Binary Search 69

70 Objective Function O = 1 s <= i O = 2 s > i Maximize information gain Binary Search Programs in general Maximize information gain Optimal Search 70

71 Objective Function information gain Shannon Entropy Formula 71

72 Shannon Entropy Formula What is Pj? How to calculate Pj? 72

73 73

74 O1 O2 74

75 75

76 76

77 p1 p2 p3 p4 77

78 s P(s ) 78

79 s P(s ) = 79

80 Number of secret inputs belong to this partition Domain size 80

81 Number of secret inputs consistent with partition s path constraint Domain size 81

82 Count number of models for this constraint Domain size Model Counting Problem 82

83 Automata Based Model Counting (ABC) 83

84 Automata Based Model Counting (ABC) Count the number of strings consistent with PC 84

85 Automata Based Model Counting (ABC) Count the number of strings consistent with PC ABC constructs an automaton recognizing solution to PC 85

86 Automata Based Model Counting (ABC) Count the number of strings consistent with PC ABC constructs an automaton recognizing solution to PC x in [A-Z]+ ^ charat(x,0)='a' 86

87 Automata Based Model Counting (ABC) Count the number of strings consistent with PC ABC constructs an automaton recognizing solution to PC x in [A-Z]* ^ charat(x,0)='a' Model count ( PC ) is the number of accepting paths in automaton 87

88 Constraint-based Model Generation Constraints ABC Model 88

89 Constraint-based Model Generation Constraints ABC Constraints Model ABC Mutated Model 89

90 Constraint-based Model Generation ABC Constraints Constraints Input Model ABC Mutation Mutated Model Candidate input generation 90

91 Constraint-based Model Generation ABC Constraints Model Constraints Input ABC Mutation Mutated Model Candidate input generation non-restricted (NR) String mutation 91

92 Constraint-based Model Generation ABC Constraints Model Constraints Input ABC Mutation Mutated Model Candidate input generation restricted (R) Mutated Model 92

93 Maximize information gain Optimal Search 93

94 Meta-heuristics Techniques Random Search Simulated Annealing Genetic Algorithm 94

95 Meta-heuristics Techniques Random Search Simulated Annealing Genetic Algorithm We implement and experiment these popular meta-heuristics techniques as black box optimization procedures that make repeated calls to ABC to evaluate the information gain objective function 95

96 Random Search information gain Calculate information gain for random candidate inputs input 96

97 Random Search Calculate information gain for random candidate inputs information gain Select candidate input with maximum information gain input 97

98 Random Search Calculate information gain for random candidate inputs Select candidate input with maximum information gain information gain Use the candidate as next attack input attack input input 98

99 Simulated Annealing information gain information gain for first candidate input input 99

100 Simulated Annealing information gain for new candidate input information gain information gain for first candidate input input 100

101 Simulated Annealing information gain for new candidate input better information gain select as attack input information gain information gain for first candidate input input 101

102 Simulated Annealing information gain for new candidate input better information gain select as attack input less information gain select with an acceptance probability information gain information gain for first candidate input input 102

103 Simulated Annealing information gain for new candidate input better information gain select as attack input less information gain select with an acceptance probability information gain information gain for first candidate input input 103

104 Simulated Annealing information gain for new candidate input better information gain select as attack input less information gain select with an acceptance probability reduce acceptance probability as temperature cools down information gain information gain for first candidate input input 104

105 Simulated Annealing information gain for new candidate input better information gain select as attack input less information gain select with an acceptance probability Reduce acceptance probability as temperature cools down information gain information gain for first candidate input input 105

106 Simulated Annealing information gain for new candidate input better information gain select as attack input less information gain select with an acceptance probability Reduce acceptance probability as temperature cools down information gain information gain for first candidate input attack input input 106

107 Population of candidate inputs information gain Genetic Algorithm input 107

108 Population of candidate inputs fitness (information gain) of these candidates information gain Genetic Algorithm input 108

109 Population of candidate inputs fitness (information gain) of these candidates information gain Genetic Algorithm input Select top candidates 109

110 Population of candidate inputs fitness (information gain) of these candidates information gain Genetic Algorithm input Select top candidates Mutate and crossover 110

111 Population of candidate inputs fitness (information gain) of these candidates information gain Genetic Algorithm input Mutate and crossover Update population information gain Select top candidates input 111

112 Population of candidate inputs fitness (information gain) of these candidates information gain Genetic Algorithm input Mutate and crossover Update population Select top candidate from population as attack input (l*) information gain Select top candidates attack input input 112

113 Experimental Results 113

114 Experimental Benchmark 114

115 Experimental Benchmark 115

116 Experimental Benchmark 116

117 Experimental Benchmark Number of path constraints Number of merged path constraints 117

118 Experimental Benchmark Number of path constraints Number of merged path constraints 118

119 Experimental Benchmark Number of path constraints Number of merged path constraints 119

120 Experimental Results Initial uncertainty of secret input (in bits) Number of alphabets = 26 Length of secret = 4 Domain size of h = 264 = Initial uncertainty = log2(456976) =

121 Experimental Results Metrics: Time (in seconds) Number of attack steps Remaining Uncertainty Remaining Uncertainty = Initial uncertainty - information gain 121

122 Experimental Results Techniques: Model Based Random search Simulated Annealing Genetic Algorithm 122

123 Experimental Results Model Based: Shorter execution time per attack step More attack steps 123

124 Experimental Results Simulated Annealing: Longer execution time per attack step Less attack steps 124

125 Experimental Results Password Check Insecure: 1 hour timeout 5 observationally distinguishable path Better information leakage 125

126 Experimental Results Password Check Secure: 1 hour timeout 1 observationally distinguishable path Hardly leaks information Attack becomes exhaustive 126

127 Experimental Results String Char Inequality: 1 hour timeout 80 path constraints 2 observationally distinguishable path Information leakage rate is slower 127

128 Experimental Results String Edit Distance: 1 hour timeout 2170 path constraints 22 observationally distinguishable path Information leakage rate is slower 128

129 Experimental Results Faster execution time per attack step than Simulated Annealing Need more attack steps than Simulated annealing Reason: Random search leads to less optimal input 129

130 Experimental Results Faster than Simulated Annealing but Need more attack steps than Simulated annealing Reason: Mutation and crossover leads to non-restricted model 130

131 Experimental Results Meta-heuristics does not perform better than model based when Every input in a particular attack step leaks same amount of information For example: Password Check Insecure 131

132 Experimental Results Model based attack: simpler and faster execution of attack step needs more attack step Meta-heuristics technique: slower need less attack step Simulated annealing: performs better to leak information per attack step 132

133 Attack Synthesis for Strings using Meta-heuristics String Functions F(h,l) Symbolic Execution Objective Function Entropy: Information Gain Meta-heuristics Path constraints ϕ Merged Path constraints Ψ Probability Distribution of Paths Model Counter Attack input Sequences 133

134 Thank You 134