Department of Computer Science. AIMS Verification HT 2018

Transcription

1 Department of Computer Science AIMS Verification HT 2018

2 Outine Back Hats Back Hats Exempars for entry points of attacks Symboic Execution Basic idea of soving the formuas Path-based Merging paths Automated Back Hats Symboic execution on x86 Exempars Acceeration Outook: open probems

3 Back Hats Obtain contro over eectronic devices Ideay targeted, but mass market has appea as we Your phone, aptop, househod eectronics But coud aso be your car Or coud servers Medica records, Good expoits are >$1m

4 WannaCry

5 WannaCry Based on EthernaBue Infection via bug in SMB impementation in Windows (CVE ) Microsoft: buit by NSA Leaked 8 th of Apri 2017 Fix reeased by Microsoft on 14 th of March

6 Exempars for Attack Vectors Websites Any fie you open (or preview) Software updates WiFi, even before connecting (remember Iphone baseband bugs) 2G, 3G, 4G, no ca needed, even anaog USB, Firewire

7 Department of Computer Science Symboic Execution

8 Overview SAT/SMT: enabing technoogy Over- vs. underapproximating static anaysis Path-based symboic simuation Path merging

9 Enabing Technoogy: SAT/SMT CPU Time (in seconds) Resuts of the SAT competition/race winners on the SAT 2009 appication benchmarks, 20mn timeout Number of probems soved

10 Propositiona SAT SAT sovers accept propositiona ogic in the form of CNF as input Minisat, Picosat, and many others Generay good idea for NP-hard probems Provide satisfying assignment Aso: incrementa soving and confict variabes

11 Confict-driven Cause Learning Decide α a assigned SAT α BackTrack b 0 BCP confict Anayze- Confict b < 0 UNSAT

12 SMT Satisfiabiity Moduo Theories This is a fie format (and API) for specifying formuas taken from specific theories Uninterpreted functions Rationa/integer inear arithmetic Arrays Bit-vectors

13 DPLL(T) Uses propositiona SAT sover as centra component Tight integration with theory sovers Z3, CVC, Booector, MathSAT Bjørner wi teach this next week

14 DPLL(T) Decide α a assigned SAT Nothing to propagate, no confict ˆ Th(α) Deduction α BCP α t e(t) Theory propagation / confict BackTrack confict AddCauses Anayze- Confict b 0 UNSAT b < 0

15 Bit-Vector Fattening C/C++ and Java use semantics with moduar arithmetic (i.e., wrap-around) In the SMT context: SMT-BV Can be soved effectivey with fattening

16 Bit-Vector Fattening This is straight forward for Equaity Bit-wise operators (&,, ^) Transformation into CNF is done using Tseitin s encoding

17 Fattening Arithmetic How to fatten a + b?! we can buid a circuit that adds them! a b i FA o s Fu Adder s (a + b + i )mod2 a b i o (a + b + i )div2 a b + a i + b i The fu adder in CNF: (a _ b _ o) ^ (a _ b _ i _ o) ^ (a _ b _ i _ o)^ ( a _ b _ i _ o) ^ ( a _ b _ i _ o) ^ ( a _ b _ o)

18 Fattening Arithmetic Ok, this is good for one bit! How about more? 8-Bit rippe carry adder (RCA) o a 7 b 7 a 6 b 6 a 5 b 5 a 4 b 4 a 3 b 3 a 2 b 2 a 1 b 1 a 0 b 0 FA FA FA FA FA FA FA FA s 7 s 6 s 5 s 4 s 3 s 2 s 1 s 0 i I Aso caed carry chain adder I Adds variabes I Adds 6 causes

19 Incrementa Fattening Idea: add easy parts of the formua first Ony add hard parts when needed CNF ony gets stronger use an incrementa SAT sover

20 Incrementa Fattening? ' f := ' sk, F := ; Pick F 0 (I \ F ) F := F [ F 0 ' f := ' f ^ CONSTRAINT(F )? Is ' f SAT? Yes! - 6 I 6= ; compute I No!? UNSAT I = ;? SAT ' sk : Booean part of ' F : set of terms that are in the encoding I: set of terms that are inconsistent with the current assignment

21 More Reading on SAT/SMT Book on decision procedures (happy to emai PDFs) Armin s Handbook on SAT

22 Static Anaysis Gain information about the program without running it No test inputs needed Better hande on non-determinism, i.e., thread-schedue and input data

23 Approximating Static Anaysis The precise behaviour of programs is incrediby compex Static anayses thus approximate program behaviours Most aim to over-approximate

24 Over-Approximating Static Anaysis foat A1[3] = { 1, , 1.0 }; foat b1[2] = { , }; foat A2[3] = { 1, , 1.0 }; foat b2[2] = { , }; foat D1[2], D2[2]; foat P, X; void iir4(foat *x, foat *y) { foat x1, y1, t1, t2; X1 = * *x; t1 = x1 + b1[0]*d1[0] - b1[1]*d1[1]; y1 = A1[0]*t1 - A1[1]*D1[0] + A1[2]*D1[1]; D1[1] = D1[0]; D1[0] = t1; t2 = y1 + b2[0]*d2[0] - b2[1]*d2[1]; *y = A2[0]*t2 - A2[1]*D2[0] + A2[2]*D2[1]; D2[1] = D2[0]; D2[0] = t2; } [ESOP 2005] int main () { whie (1) { X = input(); iir4(&x,&p); } }

25 Over-Approximating Static Anaysis Key benefit: üwhen done right, one can prove absence of certain bugs [ESOP 2005]

26 Over-Approximating Static Anaysis Key probems: ûapproximation is often hard-wired to particuar kinds of bugs and program constructs ûnot hepfu for nove bugs or new ways of doing things ûfase aarms!

27 Fase Aarms

28 const char * read_response(const char *prompt, int fags) { char *askpass = NULL, *ret = NULL, buf[1024]; int rppfags, use_askpass = 0, ttyfd; rppfags = (fags & RP_ECHO)? RPP_ECHO_ON : RPP_ECHO_OFF; if (fags & RP_USE_ASKPASS) use_askpass = 1; ese if (fags & RP_ALLOW_STDIN) { if (!isatty(stdin_fileno)) { debug("read_response: stdin is not a tty"); use_askpass = 1; } } ese { rppfags = RPP_REQUIRE_TTY; ttyfd = open(_path_tty); if (ttyfd >= 0) cose(ttyfd); ese { debug("read_response: can't open %s: %s", _PATH_TTY, strerror(errno)); use_askpass = 1; } } if ((fags & RP_USE_ASKPASS)!(ret = getenv("display"))) goto end; if (use_askpass && getenv("display")) { if (getenv(ssh_askpass_env)) askpass = getenv(ssh_askpass_env); ese askpass = _PATH_SSH_ASKPASS_DEFAULT; if ((ret = ssh_askpass(askpass, prompt)) == NULL) if (!(fags & RP_ALLOW_EOF)) return xstrdup(""); goto end; } [PLDI 2012] ret = xstrdup(buf); memset(buf, 'x', sizeof buf); end: return ret; }

29 Under-Approximation Any behaviour anaysed is genuine Promises fewer fase aarms But may miss some bugs Much ike testing! But automatic Can sti dea with partia systems

30 Symboic Execution Run program, but write down formua instead of program state Get program inputs from constraint sover View as sover-guided fuzz-testing

31 Path-based Symboic Execution

32 Path-based Symboic Execution

33 Path-based Symboic Execution

34 Path-based Symboic Execution

35 Path-based Symboic Execution What if variabe is assigned twice? Rename appropriatey: x=0; if (y>=0) x++; x 1 =0 ^ y 0 0 ^ x 2 = x 1 +1 This is a specia case of SSA (static singe assignment)

36 Symboic Execution: Advantages Can ook for very specific things - Look for user-specified events - Constrain with partia inputs - Constrain with observations from ogs (e.g.: NASA uses this for probe ogs) Ony needs an operationa mode, and thus has been done for wide range of anguages (incuding JavaScript and x86 assember)

37 Prominent Toos SAGE, PEX, CodeDigger (Microsoft) KLEE Verisoft (concurrency) Romano: Linux Bug Reease 30k binaries, 5 min symboic execution per binary

38 Path-based Symboic Exection: Scaabiity

39 Improving Scaabiity The SAT probems are too easy! [ICSE 2014]

40 Path Merging Idea: use SSA φ-nodes when paths meet Much ike φ-foding in compiers

41 Merge A: BMC Aso caed Bounded Mode Checking Buids one big formua Users are primariy in the automotive domain - Toyota - BTC-ES - TCS

42 Exampe Program void my func(int param 0 ) { int x, y; y 1 = 0xabc; x 1 = param 0 +1; if (x 1 >10) x 2 = 10; x 3 = (x 1, x 2 ); Formua y 1 = 2748 ^ x 1 = param 0 +1 ^ cond 1 =(x 1 > 10) ^ x 2 = 10 ^ x 3 = ITE(cond 1,x 2,x 1 ) } y 2 =y+x; 1 3 ; ^ y 2 = y 1 +1

43

44 Information Leakage: Heartbeed OpenSSL is widey used In Apri 2014 an impementation error was found in OpenSSL through manua code review Because of this error, passwords and other private information coud be extracted from a remote system As the error was in the heartbeat protoco, it was named Heartbeed Tautschnig/Maacaria: CBMC for measuring eakage

45 Department of Computer Science Automated Back Hats

46 Appication Memory

47 Appication Memory int goba; int main() { int oca; printf("goba: %16p\n", &goba); printf("main: %16p\n", &main); printf("oca: %16p\n", &oca); printf("heap: %16p\n", maoc(4)); } goba: main: oca: heap: 0x108f x108f40ed0 0x7fff56cbf8dc 0x7ff d0

48 What is the Stack used for? The stack enabes functions/procedures Stores Procedure-oca data Return address of cas Benefits: More economica Permits recursion

49 SP Stack return address void f(void) { char buffer[100]; } strcpy(buffer, INPUT); void g(void) { IP f(); }

50 Stack IP void f(void) { char buffer[100]; SP SP return address BUFFER } strcpy(buffer, INPUT); void g(void) { f(); }

51 SP Stack return address BUFFER void f(void) { char buffer[100]; IP } strcpy(buffer, INPUT); void g(void) { f(); }

52 Stack void f(void) { char buffer[100]; SP return address BUFFER IP } strcpy(buffer, INPUT); void g(void) { f(); }

53 SP IP Stack return address BUFFER void f(void) { char buffer[100]; } strcpy(buffer, INPUT); void g(void) { f(); }

54 Other Options C++ gives rise to a arge number of function pointers to impement virtua methods These are typicay on the heap Expoit ike return addresses There are simiar pointers for dynamicay oaded ibraries

55 Countermeasures Address space ayout randomization (ASLR) Execution protection (NX) for stack and heap Read-ony code segments (W^X) Stack canaries Contro-fow integrity

56 Countermeasure: ROP Return-oriented programming Rummage through existing code (say ibc) to find return instructions (0xc3) Any instructions before these can do usefu work Pace address of next instruction on stack Countermeasure: ASCII armoring

57 A Harder Bug I beieve that these two fies summarize we some of the reasons why code anaysis toos are not very good at finding sophisticated bugs with a very ow fase positive rate. -- Havar Fake taking about the Sendmai crackaddr bug. Let's anayse those two fies...

58 The crackaddr Bug We need to aternate between these two branches severa times...so that we can eventuay push this write beyond the end of the buffer

59 Hacking with BMC We can unwind oops a fixed number of times char A[100]; char c; int i = 0; whie(c = read()) { A[i++] = c; } Unwind twice i_0 = 0; c_0 = read(); assume(c_0!= 0); A[i_0] = c_0; assert(i_0 < 100); i_1 = i_0 + 1; c_1 = read(); assume(c_1 == 0); The first two characters read Check we didn't overfow the buffer The oop runs exacty once This gives us a probem we can pass to SAT sover

60 Hacking with BMC The SAT probem we just generated doesn't have a soution (which means we coudn't find a bug). That's because the bug doesn't show up unti the oop has run 101 times. That means we have to unwind the oop 101 times. This is reay sow! Worse sti, we don't know how many times we need to unwind!

61 Acceeration Repace a oop with a singe expression that encodes an arbitrary number of oop iterations We ca these cosed forms whie (i < 100) { i++; } Acceerate niterations = nondet(); i += niterations; assume(i <= 100); Number of oop iterations

62 Cacuating Cosed Forms We need some way of taking a oop and finding its cosed form. There are many options: Match the text of the oop Find cosed forms with constraint soving Linear agebra We use constraint soving, since it aows us to reuse a ot of existing code.

63 Dotting i's, Crossing t's There are a few more things we need to do to make an acceerator: Ensure that the oop is abe to run as many times as we'd ike it to (weakest precondition) Make sure we hande integer overfows correcty (path spitting) Add the effects of array update (quantifiers) For more detais, see our CAV 2013 paper.

64 Exampe int sz = read(); char *A = maoc(sz); char c; int i = 0; whie (c = read()) { A[i++] = c; } Acceerate int sz = read(); char *A = maoc(sz); char c; int i = 0; int niters = nondet(); assume(fora i < j <= niters. A[j]!= 0); i += niters; assert(i <= sz); Unwind once BUG: niters = sz + 1 SAT sove sz = read(); i_0 = 0; niters = nondet(); assume(fora i < j <= niters. A[j]!= 0); i_1 = i_0 + niters; assert(i_1 <= sz); Note: there's no fixed number of unwindings that wi aways hit this bug!

65 Acceerating crackaddr We unro the oop twice and acceerate the resut int niters = nondet(); assume(fora 0 <= j < niters. input[2*j] == '(' && input[2*j+1] == ')'); upperimit += niters; and int niters = nondet(); d += niters; assume(d < upperimit); assert(d < &ocabuf[200]); These are enough to find the bug!

66 Downoad me! Prototype acceerator avaiabe as part of goto-instrument Source-to-source transformation: use your favourite program anayser! Get via

67 Making this Rea Actua expoits require more work Requires precise heap and stack modes Address space randomization ROP for non-executabe stacks Frequenty done for binaries (reay want hybrid source/binary)