Taintscope: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection
|
|
|
- Hillary Hudson
- 6 years ago
- Views:
Transcription
1 : A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection Tielei Wang Tao Wei Guofei Gu Wei Zou March 12, 2014
2 is: A Fuzzing tool Checksum-Aware Directed
3 Why a new fuzzing tool? Fuzzing tools already exist. They can be sorted in two categories: Mutation based
4 Why a new fuzzing tool? Fuzzing tools already exist. They can be sorted in two categories: Mutation based Not very efficient
5 Why a new fuzzing tool? Fuzzing tools already exist. They can be sorted in two categories: Mutation based Not very efficient Cannot generate valid input if a checksum mechanism is used
6 Why a new fuzzing tool? Fuzzing tools already exist. They can be sorted in two categories: Mutation based Not very efficient Cannot generate valid input if a checksum mechanism is used Generation based
7 Why a new fuzzing tool? Fuzzing tools already exist. They can be sorted in two categories: Mutation based Not very efficient Cannot generate valid input if a checksum mechanism is used Generation based Better performances
8 Why a new fuzzing tool? Fuzzing tools already exist. They can be sorted in two categories: Mutation based Not very efficient Cannot generate valid input if a checksum mechanism is used Generation based Better performances Often implies having input specification, or source code. Tools exist to automatically get input format, but cannot reverse engineer checksum algorithms.
9 Why a new fuzzing tool? Example of input using checksum: int format int filesize int width int height... int checksum void decode_input(file * f){ int recomputed_checksum = checksum(f); int checksum_in_file = get_checksum(f); if (recomputed_checksum!= checksum_in_file) exit(); width = get_width(f);...
10 Contributions offers several major contributions: Checksum-aware Detect checksum test in tested program Bypass checksum test when fuzz-testing Reconstruct input with valid checksum
11 Contributions offers several major contributions: Checksum-aware Detect checksum test in tested program Bypass checksum test when fuzz-testing Reconstruct input with valid checksum Directed Reduces the space of parameters to mutate
12 Checksum-awareness Checksum-aware fuzz-testing is done in 3 steps:
13 Checksum-awareness Checksum-aware fuzz-testing is done in 3 steps: 1. Pre-processing: locate checksum check points in the program
14 Checksum-awareness Checksum-aware fuzz-testing is done in 3 steps: 1. Pre-processing: locate checksum check points in the program 2. Fuzz-testing: mutate input without touching the checksum data
15 Checksum-awareness Checksum-aware fuzz-testing is done in 3 steps: 1. Pre-processing: locate checksum check points in the program 2. Fuzz-testing: mutate input without touching the checksum data 3. Post-processing: for a crashing input, rebuild valid checksum
16 Checksum-awareness How to locate checksum test in program?
17 Checksum-awareness How to locate checksum test in program?
18 Checksum-awareness How to locate checksum test in program?
19 Checksum-awareness How to locate checksum test in program?
20 Checksum-awareness How to locate checksum test in program?
21 Checksum-awareness How to locate checksum test in program?
22 Checksum-awareness How to locate checksum test in program?
23 Checksum-awareness How to fuzz-test knowing the checksum-point?
24 Checksum-awareness How to fuzz-test knowing the checksum-point?
25 Checksum-awareness Using the checksum locator it is possible to: Bypass checksum test by modifying the program Test input on the modified program to find crashing cases
26 Checksum-awareness Using the checksum locator it is possible to: Bypass checksum test by modifying the program Test input on the modified program to find crashing cases But how to use those inputs on the real program? Need to reconstruct valid checksum
27 Checksum-awareness Using our previous example: int format int filesize int width int height... int checksum void decode_input(file * f){ int recomputed_checksum = checksum(f); int checksum_in_file = get_checksum(f); if (recomputed_checksum!= checksum_in_file) exit(); width = get_width(f);...
28 Checksum-awareness Using our previous example: int format int filesize int width int height... int checksum void decode_input(file * f){ int recomputed_checksum = checksum(f); int checksum_in_file = get_checksum(f); if (recomputed_checksum!= checksum_in_file) exit(); width = get_width(f);...
29 Checksum-awareness Why not use that checksum everytime instead of modifying the program? In practice, finding back the checksum is more complicated That step is too expensive to do it thousands of time
30 Checksum-awareness So is a checksum-aware fuzzing tool: Detects checksum tests Bypasses them for fuzz-testing Corrects input so they can work on original program
31 Directed fuzzing Fuzz-testing is expensive Large size of input Hundreds or thousands of bytes to mutate Very likely to generate rejected input
32 Directed fuzzing Directed fuzzing allows to find hot bytes in the input, which are: Are more likely to trigger bugs or crashes Are less likely to be the cause of rejected input What is a hot byte? An input byte that will be used in a security-sensitive call (such as malloc or strcpy)
33 Directed fuzzing How to find hot bytes? Start from a valid input Give all byte in the input a unique label Use a taint-tracer to see where the input bytes are used If an input byte is used (directly or indirectly) in a sensitive function call, this byte is a hot byte.
34 Directed fuzzing finds those hot bytes and focuses on them for fuzz-testing. The hot-byte detection can be done simultaneously with the checksum pre-processing step, leading to less overhead.
35 Evaluation and results was evaluated on real-world applications such as: Image viewer Google Picasa Adobe Acrobat Image magick Media Players MPlayer Winamp Web Browsers libtiff XEmacs
36 Evaluation and results First test on hot bytes identification. Application Input size # Hot bytes Run time ImageMagick (png) m54s ImageMagick (jpg) m13s Picasa (png) m16s Acrobat (png) m8s Acrobat (jpg m14s
37 Evaluation and results Second test on Checksum localization Application # points (1 st ) # points (2 nd ) Detected Picasa (png) Yes Acrobat (png) Yes TCPDump (pcap) 5 2 Yes Tar 9 1 Yes In practice : Around twenty runs to find the checksum location. Done in tens of minutes.
38 Evaluation and results Third test on checksum reconstruction: Format # checksum size time PNG PCAP TAR
39 Evaluation and results Out of those tests, has found 27 severe vulnerabilities in common applications caused by: Buffer overflow Integer overflow Double free Null pointer dereference Infinite loop
40 Conclusion Only few bytes are hot in most input files, making directed fuzzing essential in fuzz testing is able to detect checksum check points in programs, and checksum fields in input is able to automatically create valid input passing the checksum check can be used on real-world application to find serious vulnerabilities
41 Conclusion However: cannot handle signed inputs. It can bypass the check and find vulnerabilities But cannot recreate valid input afterwards All benefits of directed fuzzing are lost when data is encrypted, as every input byte will be detected as hot. Checksum location depends heavily on the availability of well-formed and malformed inputs
42 Questions?
TaintScope: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection
2010 IEEE Symposium on Security and Privacy TaintScope: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection Tielei Wang 1,2, Tao Wei 1,2, Guofei Gu 3, Wei Zou 1,2 1 Key
Checksum-Aware Fuzzing Combined with Dynamic Taint Analysis and Symbolic Execution
Checksum-Aware Fuzzing Combined with Dynamic Taint Analysis and Symbolic Execution 15 TIELEI WANG and TAO WEI, Peking University GUOFEI GU, Texas A&M University WEI ZOU, Peking University Fuzz testing
CSE 565 Computer Security Fall 2018
CSE 565 Computer Security Fall 2018 Lecture 16: Building Secure Software Department of Computer Science and Engineering University at Buffalo 1 Review A large number of software vulnerabilities various
Automatic program generation for detecting vulnerabilities and errors in compilers and interpreters
Automatic program generation for detecting vulnerabilities and errors in compilers and interpreters 0368-3500 Nurit Dor Shir Landau-Feibish Noam Rinetzky Preliminaries Students will group in teams of 2-3
Applications. Cloud. See voting example (DC Internet voting pilot) Select * from userinfo WHERE id = %%% (variable)
Software Security Requirements General Methodologies Hardware Firmware Software Protocols Procedure s Applications OS Cloud Attack Trees is one of the inside requirement 1. Attacks 2. Evaluation 3. Mitigation
It was a dark and stormy night. Seriously. There was a rain storm in Wisconsin, and the line noise dialing into the Unix machines was bad enough to
1 2 It was a dark and stormy night. Seriously. There was a rain storm in Wisconsin, and the line noise dialing into the Unix machines was bad enough to keep putting garbage characters into the command
Detecting Integer Overflow Vulnerabilities in Binaries. Tielei Wang Institute of Computer Science and Technology, Peking University
Detecting Integer Overflow Vulnerabilities in Binaries Tielei Wang Institute of Computer Science and Technology, Peking University About Me 4 th Ph.D. student in Peking Univ. Interested in binary program
CSC 405 Introduction to Computer Security Fuzzing
CSC 405 Introduction to Computer Security Fuzzing Alexandros Kapravelos akaprav@ncsu.edu Let s find some bugs (again) We have a potentially vulnerable program The program has some inputs which can be controlled
Last week. Data on the stack is allocated automatically when we do a function call, and removed when we return
Last week Data can be allocated on the stack or on the heap (aka dynamic memory) Data on the stack is allocated automatically when we do a function call, and removed when we return f() {... int table[len];...
Analysis/Bug-finding/Verification for Security
Analysis/Bug-finding/Verification for Security VIJAY GANESH University of Waterloo Winter 2013 Analysis/Test/Verify for Security Instrument code for testing Heap memory: Purify Perl tainting (information
CS 161 Computer Security
Popa & Wagner Spring 2016 CS 161 Computer Security Homework 2 Due: Monday, February 22nd, at 11:59pm Instructions. This homework is due Monday, February 22nd, at 11:59pm. It must be submitted electronically
Unleashing D* on Android Kernel Drivers. Aravind Machiry
Unleashing D* on Android Kernel Drivers Aravind Machiry (@machiry_msidc) $ whoami Fourth year P.h.D Student at University of California, Santa Barbara. Vulnerability Detection in System software. machiry.github.io
Memory Safety (cont d) Software Security
Memory Safety (cont d) Software Security CS 161: Computer Security Prof. Raluca Ada Popa January 17, 2016 Some slides credit to David Wagner and Nick Weaver Announcements Discussion sections and office
Guarding Vulnerable Code: Module 1: Sanitization. Mathias Payer, Purdue University
Guarding Vulnerable Code: Module 1: Sanitization Mathias Payer, Purdue University http://hexhive.github.io 1 Vulnerabilities everywhere? 2 Common Languages: TIOBE 18 Jul 2018 Jul 2017 Change Language 1
TI2725-C, C programming lab, course
Valgrind tutorial Valgrind is a tool which can find memory leaks in your programs, such as buffer overflows and bad memory management. This document will show per example how Valgrind responds to buggy
ECE 471 Embedded Systems Lecture 22
ECE 471 Embedded Systems Lecture 22 Vince Weaver http://www.eece.maine.edu/~vweaver vincent.weaver@maine.edu 31 October 2018 Don t forget HW#7 Announcements 1 Computer Security and why it matters for embedded
18-642: Code Style for Compilers
18-642: Code Style for Compilers 9/25/2017 1 Anti-Patterns: Coding Style: Language Use Code compiles with warnings Warnings are turned off or over-ridden Insufficient warning level set Language safety
Static Analysis and Bugfinding
Static Analysis and Bugfinding Alex Kantchelian 09/12/2011 Last week we talked about runtime checking methods: tools for detecting vulnerabilities being exploited in deployment. So far, these tools have
Control Flow Hijacking Attacks. Prof. Dr. Michael Backes
Control Flow Hijacking Attacks Prof. Dr. Michael Backes Control Flow Hijacking malicious.pdf Contains bug in PDF parser Control of viewer can be hijacked Control Flow Hijacking Principles Normal Control
Black Hat Webcast Series. C/C++ AppSec in 2014
Black Hat Webcast Series C/C++ AppSec in 2014 Who Am I Chris Rohlf Leaf SR (Security Research) - Founder / Consultant BlackHat Speaker { 2009, 2011, 2012 } BlackHat Review Board Member http://leafsr.com
OptimiData. JPEG2000 Software Development Kit for C/C++ Reference Manual. Version 1.6. from
OptimiData for optimized data handling JPEG2000 Software Development Kit for C/C++ Reference Manual Version 1.6 from 2004-07-29 (Windows and Linux Versions) www.optimidata.com OptimiData JPEG2000 C-SDK
INTRODUCTION TO EXPLOIT DEVELOPMENT
INTRODUCTION TO EXPLOIT DEVELOPMENT Nathan Ritchey and Michael Tucker Who Am I (Nathan Ritchey) Have Bachelors in Computer Science Member of CSG Working on Masters with focus on Information Assurance Some
CSE484/CSE584 BLACK BOX TESTING AND FUZZING. Dr. Benjamin Livshits
CSE484/CSE584 BLACK BOX TESTING AND FUZZING Dr. Benjamin Livshits Approaches to Finding Security Bugs 2 Runtime Monitoring Black-box Testing Static Analysis Fuzzing Basics 3 A form of vulnerability analysis
Static Vulnerability Analysis
Static Vulnerability Analysis Static Vulnerability Detection helps in finding vulnerabilities in code that can be extracted by malicious input. There are different static analysis tools for different kinds
(Early) Memory Corruption Attacks
(Early) Memory Corruption Attacks CS-576 Systems Security Instructor: Georgios Portokalidis Fall 2018 Fall 2018 Stevens Institute of Technology 1 Memory Corruption Memory corruption occurs in a computer
This is CS50. Harvard University Fall Quiz 0 Answer Key
Quiz 0 Answer Key Answers other than the below may be possible. Binary Bulbs. 0. Bit- Sized Questions. 1. Because 0 is non- negative, we need to set aside one pattern of bits (000) for it, which leaves
COMP 3704 Computer Security
COMP 3704 Computer Security christian@grothoff.org http://grothoff.org/christian/ 1 Application Security Suppose...... protocol design is secure.... cryptographic primitives are secure.... users / key
Simple Overflow. #include <stdio.h> int main(void){ unsigned int num = 0xffffffff;
Simple Overflow 1 #include int main(void){ unsigned int num = 0xffffffff; printf("num is %d bits long\n", sizeof(num) * 8); printf("num = 0x%x\n", num); printf("num + 1 = 0x%x\n", num + 1); }
Buffer overflow background
and heap buffer background Comp Sci 3600 Security Heap Outline and heap buffer Heap 1 and heap 2 3 buffer 4 5 Heap Outline and heap buffer Heap 1 and heap 2 3 buffer 4 5 Heap Address Space and heap buffer
Fuzzing: Breaking software in an automated fashion
Fuzzing: Breaking software in an automated fashion Ilja van Sprundel December 8, 2005 1 Introduction Fuzzing is the art of automatic bug finding. This is done by providing an application with semi-valid
Course organization. Course introduction ( Week 1)
Course organization Course introduction ( Week 1) Code editor: Emacs Part I: Introduction to C programming language (Week 2-9) Chapter 1: Overall Introduction (Week 1-3) Chapter 2: Types, operators and
Using static analysis to detect use-after-free on binary code
Using static analysis to detect use-after-free on binary code Josselin Feist Laurent Mounier Marie-Laure Potet Verimag / University of Grenoble - Alpes France SDTA 2014 - Clermont-Ferrand 5 décembre 2014
CSSV: Towards a Realistic Tool for Statically Detecting All Buffer Overflows in C
CSSV: Towards a Realistic Tool for Statically Detecting All Buffer Overflows in C Nurit Dor, Michael Rodeh, Mooly Sagiv PLDI 2003 DAEDALUS project Vulnerabilities of C programs /* from web2c [strpascalc]
One-Slide Summary. Lecture Outline. Language Security
Language Security Or: bringing a knife to a gun fight #1 One-Slide Summary A language s design principles and features have a strong influence on the security of programs written in that language. C s
Lecture Embedded System Security A. R. Darmstadt, Runtime Attacks
2 ARM stands for Advanced RISC Machine Application area: Embedded systems Mobile phones, smartphones (Apple iphone, Google Android), music players, tablets, and some netbooks Advantage: Low power consumption
EURECOM 6/2/2012 SYSTEM SECURITY Σ
EURECOM 6/2/2012 Name SYSTEM SECURITY 5 5 5 5 5 5 5 5 5 5 50 1 2 3 4 5 6 7 8 9 10 Σ Course material is not allowed during the exam. Try to keep your answers precise and short. You will not get extra points
In-Memory Fuzzing in JAVA
Your texte here. In-Memory Fuzzing in JAVA 2012.12.17 Xavier ROUSSEL Summary I. What is Fuzzing? Your texte here. Introduction Fuzzing process Targets Inputs vectors Data generation Target monitoring Advantages
Undefined Behaviour in C
Undefined Behaviour in C Report Field of work: Scientific Computing Field: Computer Science Faculty for Mathematics, Computer Science and Natural Sciences University of Hamburg Presented by: Dennis Sobczak
CYSE 411/AIT681 Secure Software Engineering Topic #12. Secure Coding: Formatted Output
CYSE 411/AIT681 Secure Software Engineering Topic #12. Secure Coding: Formatted Output Instructor: Dr. Kun Sun 1 This lecture: [Seacord]: Chapter 6 Readings 2 Secure Coding String management Pointer Subterfuge
2/9/18. CYSE 411/AIT681 Secure Software Engineering. Readings. Secure Coding. This lecture: String management Pointer Subterfuge
CYSE 411/AIT681 Secure Software Engineering Topic #12. Secure Coding: Formatted Output Instructor: Dr. Kun Sun 1 This lecture: [Seacord]: Chapter 6 Readings 2 String management Pointer Subterfuge Secure
Finding media bugs in Android using file format fuzzing. Costel Maxim Intel OTC Security
Finding media bugs in Android using file format fuzzing Costel Maxim Intel OTC Security 1 Agenda File format fuzzing Generate high-quality corpus of files Fuzzing the Stagefright Framework Logging & Triage
1.1 For Fun and Profit. 1.2 Common Techniques. My Preferred Techniques
1 Bug Hunting Bug hunting is the process of finding bugs in software or hardware. In this book, however, the term bug hunting will be used specifically to describe the process of finding security-critical
Infecting the Embedded Supply Chain
SESSION ID: PDAC-F01 Infecting the Embedded Supply Chain Zach Miller Security Researcher in8 Solutions (Formerly Somerset Recon) @bit_twidd1er Inspiration Inspiration Countless embedded devices exist Each
Programmer s Points to Remember:
Programmer s Points to Remember: Always do bounds checking on arrays. Always do bounds checking on pointer arithmetic. Before you copy to, format, or send input to a buffer make sure it is big enough to
Pointers, Dynamic Data, and Reference Types
Pointers, Dynamic Data, and Reference Types Review on Pointers Reference Variables Dynamic Memory Allocation The new operator The delete operator Dynamic Memory Allocation for Arrays 1 C++ Data Types simple
Automated Whitebox Fuzz Testing. by - Patrice Godefroid, - Michael Y. Levin and - David Molnar
Automated Whitebox Fuzz Testing by - Patrice Godefroid, - Michael Y. Levin and - David Molnar OUTLINE Introduction Methods Experiments Results Conclusion Introduction Fuzz testing is an effective Software
finding vulnerabilities
cs6 42 computer security finding vulnerabilities adam everspaugh ace@cs.wisc.edu hw1 Homework 1 will be posted after class today Due: Feb 22 Should be fun! TAs can help with setup Use Piazza as first step
Secure Software Development: Theory and Practice
Secure Software Development: Theory and Practice Suman Jana MW 2:40-3:55pm 415 Schapiro [SCEP] *Some slides are borrowed from Dan Boneh and John Mitchell Software Security is a major problem! Why writing
MPATE-GE 2618: C Programming for Music Technology. Unit 5.1
MPATE-GE 2618: C Programming for Music Technology Unit 5.1 Review: automatic vs. static variables Variables declared and passed to functions are automatic variables. As soon as you leave the function,
Secure Programming I. Steven M. Bellovin September 28,
Secure Programming I Steven M. Bellovin September 28, 2014 1 If our software is buggy, what does that say about its security? Robert H. Morris Steven M. Bellovin September 28, 2014 2 The Heart of the Problem
AET60 BioCARDKey. Application Programming Interface. Subject to change without prior notice
AET60 BioCARDKey Application Programming Interface Subject to change without prior notice Table of Contents 1.0. Introduction... 3 2.0. Application Programming Interface... 4 2.1. Overview...4 2.2. Data
C++ Undefined Behavior
C++ Undefined Behavior What is it, and why should I care? A presentation originally by Marshal Clow Original: https://www.youtube.com/watch?v=uhclkb1vkay Original Slides: https://github.com/boostcon/cppnow_presentations_2014/blob/master/files/undefined-behavior.pdf
Introduction to software exploitation ISSISP 2017
Introduction to software exploitation ISSISP 2017 1 VM https://drive.google.com/open?id=0b8bzf4ybu s1kltjsnlnwqjhss1e (sha1sum: 36c32a596bbc908729ea9333f3da10918e24d767) Login / pass: issisp / issisp 2
Using Static Code Analysis to Find Bugs Before They Become Failures
Using Static Code Analysis to Find Bugs Before They Become Failures Presented by Brian Walker Senior Software Engineer, Video Product Line, Tektronix, Inc. Pacific Northwest Software Quality Conference,
Copyright 2015 MathEmbedded Ltd.r. Finding security vulnerabilities by fuzzing and dynamic code analysis
Finding security vulnerabilities by fuzzing and dynamic code analysis Security Vulnerabilities Top code security vulnerabilities don t change much: Security Vulnerabilities Top code security vulnerabilities
Homework 3 CS161 Computer Security, Fall 2008 Assigned 10/07/08 Due 10/13/08
Homework 3 CS161 Computer Security, Fall 2008 Assigned 10/07/08 Due 10/13/08 For your solutions you should submit a hard copy; either hand written pages stapled together or a print out of a typeset document
Limitations of the stack
The heap hic 1 Limitations of the stack int *table_of(int num, int len) { int table[len+1]; for (int i=0; i
CS 62 Practice Final SOLUTIONS
CS 62 Practice Final SOLUTIONS 2017-5-2 Please put your name on the back of the last page of the test. Note: This practice test may be a bit shorter than the actual exam. Part 1: Short Answer [32 points]
INITIALISING POINTER VARIABLES; DYNAMIC VARIABLES; OPERATIONS ON POINTERS
INITIALISING POINTER VARIABLES; DYNAMIC VARIABLES; OPERATIONS ON POINTERS Pages 792 to 800 Anna Rakitianskaia, University of Pretoria INITIALISING POINTER VARIABLES Pointer variables are declared by putting
Lecture Notes for 04/04/06: UNTRUSTED CODE Fatima Zarinni.
Lecture Notes for 04/04/06 UNTRUSTED CODE Fatima Zarinni. Last class we started to talk about the different System Solutions for Stack Overflow. We are going to continue the subject. Stages of Stack Overflow
CYSE 411/AIT681 Secure Software Engineering Topic #10. Secure Coding: Integer Security
CYSE 411/AIT681 Secure Software Engineering Topic #10. Secure Coding: Integer Security Instructor: Dr. Kun Sun 1 This lecture: [Seacord]: Chapter 5 Readings 2 Secure Coding String management Pointer Subterfuge
malloc() is often used to allocate chunk of memory dynamically from the heap region. Each chunk contains a header and free space (the buffer in which
Heap Overflow malloc() is often used to allocate chunk of memory dynamically from the heap region. Each chunk contains a header and free space (the buffer in which data are placed). The header contains
Brave New 64-Bit World. An MWR InfoSecurity Whitepaper. 2 nd June Page 1 of 12 MWR InfoSecurity Brave New 64-Bit World
Brave New 64-Bit World An MWR InfoSecurity Whitepaper 2 nd June 2010 2010-06-02 Page 1 of 12 Abstract Abstract Memory requirements on server and desktop systems have risen considerably over the past few
Dynamic Allocation in C
Dynamic Allocation in C C Pointers and Arrays 1 The previous examples involved only targets that were declared as local variables. For serious development, we must also be able to create variables dynamically,
2/9/18. Readings. CYSE 411/AIT681 Secure Software Engineering. Introductory Example. Secure Coding. Vulnerability. Introductory Example.
This lecture: [Seacord]: Chapter 5 Readings CYSE 411/AIT681 Secure Software Engineering Topic #10. Secure Coding: Integer Security Instructor: Dr. Kun Sun 1 2 String management Pointer Subterfuge Secure
2/9/18. CYSE 411/AIT681 Secure Software Engineering. Readings. Secure Coding. This lecture: String management Pointer Subterfuge
CYSE 411/AIT681 Secure Software Engineering Topic #10. Secure Coding: Integer Security Instructor: Dr. Kun Sun 1 This lecture: [Seacord]: Chapter 5 Readings 2 String management Pointer Subterfuge Secure
Rooting Routers Using Symbolic Execution. Mathy HITB DXB 2018, Dubai, 27 November 2018
Rooting Routers Using Symbolic Execution Mathy Vanhoef @vanhoefm HITB DXB 2018, Dubai, 27 November 2018 Overview Symbolic Execution 4-way handshake Handling Crypto Results 2 Overview Symbolic Execution
CS2255 HOMEWORK #1 Fall 2012
CS55 HOMEWORK #1 Fall 01 1.What is assigned to the variable a given the statement below with the following assumptions: x = 10, y = 7, and z, a, and b are all int variables. a = x >= y; a. 10 b. 7 c. The
Dynamic Software Model Checking
Dynamic Software Model Checking Patrice Godefroid Microsoft Research Page 1 September 2014 Ed Clarke: A man, An idea LASER 2011 summer school (Elba island, Italy) Page 2 September 2014 Ed Clarke: A man,
C++ Undefined Behavior What is it, and why should I care?
C++ Undefined Behavior What is it, and why should I care? Marshall Clow Qualcomm marshall@idio.com http://cplusplusmusings.wordpress.com (intermittent) Twitter: @mclow ACCU 2014 April 2014 What is Undefined
CS 241 Data Organization Binary Trees
CS 241 Data Organization Binary Trees Brooke Chenoweth University of New Mexico Fall 2017 Binary Tree: Kernighan and Ritchie 6.5 Read a file and count the occurrences of each word. now is the time for
C Arrays and Pointers
C Arrays and Pointers Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel +41 55 214 41 60 Fax +41 55 214 41 61 team@csnc.ch www.csnc.ch Content Intel Architecture Memory Layout C
Memory and Addresses. Pointers in C. Memory is just a sequence of byte-sized storage devices.
Memory and Addresses Memory is just a sequence of byte-sized storage devices. 1 The bytes are assigned numeric addresses, starting with zero, just like the indexing of the cells of an array. It is the
IPS Signature Database
IPS Signature Database Version: 3.4.56 Date:22 nd February, 208 IPS Signature Database Release Notes Version 3.4.56 Release Notes Release Information Upgrade Applicable on IPS Signature Release Version
18-642: Code Style for Compilers
18-642: Code Style for Compilers 9/6/2018 2017-2018 Philip Koopman Programming can be fun, so can cryptography; however they should not be combined. Kreitzberg and Shneiderman 2017-2018 Philip Koopman
Heap Arrays and Linked Lists. Steven R. Bagley
Heap Arrays and Linked Lists Steven R. Bagley Recap Data is stored in variables Can be accessed by the variable name Or in an array, accessed by name and index Variables and arrays have a type Create our
Enhancing Memory Error Detection for Large-Scale Applications and Fuzz testing
Enhancing Memory Error Detection for Large-Scale Applications and Fuzz testing Wookhyun Han, Byunggil Joe, Byoungyoung Lee *, Chengyu Song, Insik Shin KAIST, * Purdue, UCR 1 Memory error Heartbleed Shellshock
What You Corrupt Is Not What You Crash: Challenges in Fuzzing Embedded Devices
What You Corrupt Is Not What You Crash: Challenges in Fuzzing Embedded Devices Marius Muench 1 Jan Stijohann 2,3 Frank Kargl 3 Aurélien Francillon 1 Davide Balzarotti 1 1 EURECOM 2 Siemens AG 3 Ulm University
About unchecked management SMM & UEFI. Vulnerability. Patch. Conclusion. Bruno Pujos. July 16, Bruno Pujos
July 16, 2016 1/45 Whoami RE, vulnerability research LSE 2015 Sogeti since 2/45 1 2 Reverse Exploitation 3 4 3/45 Agenda 1 4/45 Agenda 1 5/45 Unified Extended FIrmware is based on EFI Specification for
CS 161 Computer Security
Wagner Spring 2014 CS 161 Computer Security 1/27 Reasoning About Code Often functions make certain assumptions about their arguments, and it is the caller s responsibility to make sure those assumptions
Recursion. What is Recursion? Simple Example. Repeatedly Reduce the Problem Into Smaller Problems to Solve the Big Problem
Recursion Repeatedly Reduce the Problem Into Smaller Problems to Solve the Big Problem What is Recursion? A problem is decomposed into smaller sub-problems, one or more of which are simpler versions of
API 퍼징을통한취약점탐지 카이스트 차상길
API 퍼징을통한취약점탐지 카이스트 차상길 API Fuzzing? void foo(int x) // This is an API function { // (side-effect-free) //... } void fuzz() { while (1) { foo(rand()); } } // Fuzzer MAIN Found a crash in foo when x = 42
Identifying Memory Corruption Bugs with Compiler Instrumentations. 이병영 ( 조지아공과대학교
Identifying Memory Corruption Bugs with Compiler Instrumentations 이병영 ( 조지아공과대학교 ) blee@gatech.edu @POC2014 How to find bugs Source code auditing Fuzzing Source Code Auditing Focusing on specific vulnerability
Analysis of MS Multiple Excel Vulnerabilities
Analysis of MS-07-036 Multiple Excel Vulnerabilities I. Introduction This research was conducted using the Office 2003 Excel Viewer application and the corresponding security patch for MS-07-036 - Vulnerabilities
Fuzzing. compass-security.com 1
Fuzzing compass-security.com 1 Fuzzing Finding bugs by bombarding target with nonconform data Think: Flip a few bits in a PDF, then start Acrobat with that PDF Just more automated Steps: Create input corpus
Preventing Use-after-free with Dangling Pointers Nullification
Preventing Use-after-free with Dangling Pointers Nullification Byoungyoung Lee, Chengyu Song, Yeongjin Jang Tielei Wang, Taesoo Kim, Long Lu, Wenke Lee Georgia Institute of Technology Stony Brook University
CSE 565 Computer Security Fall 2018
CSE 565 Computer Security Fall 2018 Lecture 14: Software Security Department of Computer Science and Engineering University at Buffalo 1 Software Security Exploiting software vulnerabilities is paramount
CS107 Handout 08 Spring 2007 April 9, 2007 The Ins and Outs of C Arrays
CS107 Handout 08 Spring 2007 April 9, 2007 The Ins and Outs of C Arrays C Arrays This handout was written by Nick Parlante and Julie Zelenski. As you recall, a C array is formed by laying out all the elements
prin'() tricks DC4420 slides, Feb 2012
prin'() tricks DC4420 slides, Feb 2012 1 Who am I? Shaun Colley Senior Security Consultant at IOAcFve Exploit development, reverse engineering, development, pen- tesfng 2 Prin'() tricks - Agenda ShiMing
2 Sadeghi, Davi TU Darmstadt 2012 Secure, Trusted, and Trustworthy Computing Chapter 6: Runtime Attacks
Runtime attacks are major threats to today's applications Control-flow of an application is compromised at runtime Typically, runtime attacks include injection of malicious code Reasons for runtime attacks
Automotive Software Security Testing
Detecting and Addressing Cybersecurity Issues V1.1 2018-03-05 Code ahead! 2 Automated vulnerability detection and triage + = 3 How did we get here? Vector was engaged with a large, US Tier 1 and we were
C and C++ Secure Coding 4-day course. Syllabus
C and C++ Secure Coding 4-day course Syllabus C and C++ Secure Coding 4-Day Course Course description Secure Programming is the last line of defense against attacks targeted toward our systems. This course
UniFinger Engine SFR300 SDK Reference Manual
UniFinger Engine SFR300 SDK Reference Manual Version 2.5 2005 by Suprema Inc. Contents SF_Initialize...3 SF_Uninitialize...4 SF_SetFastMode...5 SF_GetDeviceNumber...6 SF_GetDevice...7 SF_SetDevice...8
C and C++: vulnerabilities, exploits and countermeasures
C and C++: vulnerabilities, exploits and countermeasures Yves Younan DistriNet, Department of Computer Science Katholieke Universiteit Leuven Belgium Yves.Younan@cs.kuleuven.ac.be Introduction C/C++ programs:
SoK: Eternal War in Memory
SoK: Eternal War in Memory László Szekeres, Mathias Payer, Tao Wei, Dawn Song Presenter: Wajih 11/7/2017 Some slides are taken from original S&P presentation 1 What is SoK paper? Systematization of Knowledge
Effective Memory Protection Using Dynamic Tainting
Effective Memory Protection Using Dynamic Tainting James Clause Alessandro Orso (software) and Ioanis Doudalis Milos Prvulovic (hardware) College of Computing Georgia Institute of Technology Supported
(a) Which of these two conditions (high or low) is considered more serious? Justify your answer.
CS140 Winter 2006 Final Exam Solutions (1) In class we talked about the link count in the inode of the Unix file system being incorrect after a crash. The reference count can either be either too high
Fault Injection in System Calls
Fault Injection in System Calls Angelo Haller 2015-05-28 Fault Injection in System Calls 1 Angelo Haller 1 Why System Calls? 2 Trinity Bugs Found Inner Workings Fuzzing Process 3 Demo Annotated System
CIS 551 / TCOM 401 Computer and Network Security. Spring 2007 Lecture 2
CIS 551 / TCOM 401 Computer and Network Security Spring 2007 Lecture 2 Announcements First project is on the web Due: Feb. 1st at midnight Form groups of 2 or 3 people If you need help finding a group,
Embedded/Connected Device Secure Coding. 4-Day Course Syllabus
Embedded/Connected Device Secure Coding 4-Day Course Syllabus Embedded/Connected Device Secure Coding 4-Day Course Course description Secure Programming is the last line of defense against attacks targeted