AxProtector Exposed. Integrity Protection of a Modular Application. Rüdiger Kügler Security Expert

Transcription

1 AxProtector Exposed Integrity Protection of a Modular Application Rüdiger Kügler Security Expert Ruediger.Kuegler@wibu.com Wolfgang Völker Director Product Management Wolfgang.Voelker@wibu.com

2 Introduction Threats and Requirements for Independent Software Vendors and Users AxProtector Exposed 2

3 Threats / Requirements Software Vendor User Copy Protection Mods Cheats Virus Sabotage Cheats AxProtector Exposed 3

4 Authenticode Friend or Foe? AxProtector Exposed 4

5 Question My application is signed, using Authenticode. A cracker is NOT able to change my application. Right? Wrong? AxProtector Exposed 5

6 Correctly Signed Application It works AxProtector Exposed 6

7 The Patch AxProtector Exposed 7

8 Invalid Signature It STILL works! AxProtector Exposed 8

9 Answer My application is signed, using Authenticode. A cracker is NOT able to change my application. Right? Wrong? AxProtector Exposed 9

10 Authenticode Microsoft Windows starts any application Without signature With valid signature With invalid signature Authenticode is made to protect the user against virus Authenticode is not made for copy protection and licensing AxProtector Exposed 10

11 Yes, but I check the Authenticode signature within my own application. I m secure. Right? Wrong? AxProtector Exposed 11

12 Signature Check Signature check Valid / not valid? Who signed? When was it signed? Action in case of error AxProtector Exposed 12

13 Weak Point Your Software Patch Hook Override Well documented API call WINTRUST.DLL AxProtector Exposed 13

14 Override Code during Runtime in Memory var lib: THandle; p: Pointer; old: Cardinal; // Byte code for assembler // xor eax, eax; // ret // (returns 0) const fake: array[0..2] of byte = ($31, $C0, $C3); AxProtector Exposed 14

15 Override Code during Runtime in Memory begin // Load Wintrust.dll lib := LoadLibrary('WINTRUST.DLL'); if (lib <> 0) then begin // Entry Point of WinVerifyTrust p := GetProcAddress(lib, 'WinVerifyTrust'); if (p <> nil) then begin // p is pointer to code of WinVerifyTrust // in memory AxProtector Exposed 15

16 Override Code during Runtime in Memory // Remove write protection VirtualProtect(p, 3, PAGE_EXECUTE_READWRITE, old); // Apply patch move(fake, P^, 3); // Reset write protection VirtualProtect(p, 3, old, old); end; end; end; Myth uncovered: You CAN override code in memory, with standard user s privileges! AxProtector Exposed 16

17 And Again I check the Authenticode signature within my own application. I m secure. Right? Wrong? AxProtector Exposed 17

18 Summary Authenticode Software Vendor User Copy Protection Mods Cheats Virus Sabotage Cheats AxProtector Exposed 18

19 Solution Wibu Protection Suite AxProtector Exposed 19

20 Features of Wibu Protection Suite Software Authorization (Secure Load) Only approved software runs on device Integrity Protection (Tamper Protection) Detects changes of software during runtime Automatic Protection (IP Protection) Protects automatically against reverse engineering and pirates copies Encryption on Method Level Increases protection level AxProtector Exposed 20

21 Wibu Protection Suite - Overview Wibu Protection Suite Windows OS X Desktop Linux.NET Standard Framework Java SE Java EE Embedded Operating Systems Software Authorization (Secure Loader) Integrity Protection (Tamper Protection) ExProtector AxProtector Automatic Protection (IP Protection) Encryption on Method Level AxProtector.NET AxProtector Java IxProtector AxProtector Exposed 21

22 Best fitting tool suite AxProtector Automatic encryption of native applications and libraries Adds protection and security shell automatically (AxEngine) Automatic decryption of applications at startup Automatic security checks IxProtector Encryption on method level Dynamic decryption using Wupi-API during runtime AxProtector Exposed 22

23 Best fitting tool suite AxProtector.NET Automatic protection of.net assemblies on method level Adds automatically protection and security shell (AxEngine) Automatic decryption of methods during runtime AxProtector Java Automatic protection of Java applications ExProtector For embedded operating systems AxProtector Exposed 23

24 AxProtector / IxProtector Protection Process Header Header Compiled Executable / Library Code Section Data Section Resource Section Definition of licenses and modules AxProtector Encrypted Code Section Encrypted Data Section Encrypted Resource Section AxEngine (Security Engine) Protected Executable / Library AxProtector Exposed 24

25 AxProtector.NET Unprotected Assembly.NET code can be disassembled very easily AxProtector Exposed 25

26 AxProtector.NET Protection Process Compiled Assembly Header Original Code Definition of licenses and modules AxProtector.NET Header Stub Code (Without Intellectual Properties) AxEngine (Security Engine) Encrypted Code (Original Code with Intellectual Properties) Protected Assembly Assembly has same structure as original Assembly AxProtector Exposed 26

27 AxProtector.NET Protected Assembly Code is protected now! AxProtector Exposed 27

28 ExProtector Protection Process Original Executable / Library Header Original Code Keys for Encryption Keys for Code Signing ExProtector Header Encrypted Code Credentials (Hash, Signature, ) Protected Executable / Library AxProtector Exposed 28

29 ExProtector Integration into Loader Operating System (without modification) Original Loader Operating System Modified Loader Engineering ExEngine (ExProtector Runtime) CodeMeter Embedded Driver Root Public Key AxProtector Exposed 29

30 Integrity Protection Basics of cryptography Self Check Exe Dll Check AxProtector Exposed 30

31 Hash Function Cryptographic checksum Any data size as input Small change in input = complete different result One way function (no way back) Hash with key (salt value) Check of hash = generate hash and compare with stored value AxProtector Exposed 31

32 Executable + Hash C E 42 2A F 6F 6C E C D C FF E FF FF FF 7F 8B C FF C F FF FF E 61 6C FF FF FF FF A E 67 EC EC C B EC F 62 6A F F 62 6A C0 EB 02 B A 5B C C4 F8 8B F2 8B D8 8B CC 8D B C3 E8 A3 F8 FF PE..L...^B*.....@...Boolean......@..False.True.@.,.@...Ch ar...ÿ...@.@...integer...ÿÿ ÿ..àx.@...byte.....ÿ...l.@...wo rd...ÿÿ...@...cardinal...ÿ ÿÿÿ...@...string ì.@ ì.@...d3@. P3@.T3@.X3@.L3@..0@. 0@.ì0@..TOb jectø.@...tobjec.3àë..yz[ã.sv.ä ø.ò.ø.ì.v..ãè øÿ AxProtector Exposed 32

33 Hash Function Advantages Easy to implement Fast during runtime Disadvantages Everybody can generate a hash value (needs to extract salt value) One module (exe, dll, operating system, ) cannot check integrity of other module AxProtector Exposed 33

34 Signatures Signature = Sign (Hash(Plaintext), Private Key) Verification (Hash(Plaintext), Signature, Public Key) Only person with Private Key can generate signature Everybody can check a signature AxProtector Exposed 34

35 Signatures Data Data Signature Hash (Digest) Signature Private Key Public Key Signature Hash (Digest) Yes / No AxProtector Exposed 35

36 Executable + Hash + Signature C E 42 2A F 6F 6C E C D C FF E FF FF FF 7F 8B C FF C F FF FF E 61 6C FF FF FF FF A E 67 EC C0 EB 02 B A 5B C C4 F8 8B F2 8B D8 8B CC 8D B C3 E8 A3 F8 FF D8 8B CC 8D B C3 E8 A3 F8 FF FF 83 3C B 8B C4 E8 26 FF FF FF 84 C EB 02 B A 5E 5B C3 8D D2 85 C C0 03 C1 F8 02 3D PE..L...^B*.....@...Boolean......@..False.True.@.,.@...Ch ar...ÿ...@.@...integer...ÿÿ ÿ..àx.@...byte.....ÿ...l.@...wo rd...ÿÿ...@...cardinal...ÿ ÿÿÿ...@...string ì.@ àë..yz[ã.sv.ä ø.ò.ø.ì.v..ãè øÿ Ø.Ì.V..Ãè øÿÿ.<$.t..äè&ÿÿÿ.à... ë..yz^[ã.@.3ò.à y..à.áø.= AxProtector Exposed 36

37 AxProtector Protection Process Compiled Executable / Library Header Code Section Data Section Resource Section Definition of licenses and modules AxProtector Public Key Private Key for Signature Header Encrypted Code Section Encrypted Data Section Encrypted Resource Section AxEngine (Security Engine + Public Key) Protected Executable / Library Signature AxProtector Exposed 37

38 AxProtector [WIBU-SYSTEMS Control File]... [Commandline]... -cav... [CheckCodeIntegrity Dlls] Image1 = ShowHex.dll... Self check Check other modules AxProtector Exposed 38

39 Encrypted Executable + Hash + Signature C E 42 2A PE..L...^B* B E8 00 E1 03 CA E 6F 24 6F C5 30 6C D8 65 4E E 7A DC 00 D1..@...Boolean... ²"èáÊ.>$Å0ØN.zÜÑ B FC 00 E6 10 7E B 05 A D 6C D...@..False Y.KuSüæ~ C C 75 AF D C DE 10 A6 40 F F True.@.,.@...Ch Ç., i.sbþ ôh#..e F 01 F E7 00 B0 FF DA 00 D1 00 4F 00 3E 90 EF FA 40 FB 00 5D ar...ÿ...@.@. IoöH"ç ÚÑO>ï9úû] 01 A D0 6E BD 74 1A 65 A9 67 DD 65 F DB C1 80 B8 FF 82 FF 0C..Integer...ÿÿ Yн. ÝôgDÛ0Á.. FF C3 7F FE 8B 28 C C A C EE 65 BD 01 1D 00 4B ÿ..àx.@...byte.. Ãþ(5`ÃPFJcL7î½.K 00 A8 00 B9 00 DB FF C5 00 D3 00 AE 00 C C B6 40 7A F 79...ÿ...l.@...Wo ¹ÛÅÓ ÅQ' z.u.ry 72 A C 00 B2 00 1E 00 FA 00 D3 FF DD FF 10 DD 00 E0 00 F6 90 D6 80 B B rd...ÿÿ...@. 5.².úÓÝ.ÝàöÖ ;A 01 E8 08 D1 43 D9 61 6D 72 DD 64 1B E CB C A 00 F7 00 B3 00 0C FF 21..Cardinal...ÿ èñùmý.të.c.. ³.! FF CF FF BD 5D FF F 40 EF 00 C4 0A 4C 06 F E AA 6E BF ÿÿÿ...@...string Ͻ]q#.ïÄLðy.Bª. EC EA 10 5F 40 E9 00 DC 00 C5 00 2E 00 7E 00 CC 00 A2 00 3B 00 5D 00 C3 00 F9 00 5F 00 AC 00 B2 ì.@... ê_éüå.~ì ;]Ãù_ ² E3 00 B0 00 0F 00 E8 00 D D4 00 6E 00 7E 00 9C 00 E2 00 C9 00 7A Yã.èÐXÔn~.âÉze C0 EB 02 B A 5B C C4 F8 8B F2 8B D8 8B CC 8D B C3 E8 A3 F8 FF D8 8B CC 8D B C3 E8 A3 F8 FF FF 83 3C B 8B C4 E8 26 FF FF FF 84 C EB 02 B A 5E 5B C3 8D D2 85 C C0 03 C1 F8 02 3D Àë..YZ[Ã.SV.Ä ø.ò.ø.ì.v..ãè øÿ Ø.Ì.V..Ãè øÿÿ.<$.t..äè&ÿÿÿ.à... ë..yz^[ã.@.3ò.à y..à.áø.= AxProtector Exposed 39

40 Self Check Executable / Library Calculate Hash of Executable Executable AxEngine (Security Engine + Public Key) Validate Signature (Hash, Public Key, Signature) No Error Message Signature Yes AxProtector Exposed 40

41 Cross Check Executable / Library exe - exe Executable Dynamic Link Library exe - dll AxEngine (Security Engine + Public Key) Signature AxEngine (Security Engine + Public Key) Signature dll - dll dll - exe AxProtector Exposed 41

42 AxProtector During development Generates hash from original executable (relocations) AxProtector signs hash with private key AxProtector adds public key into security engine During runtime AxEngine decrypts encrypted code AxEngine generates hash from decrypted code in memory AxEngine uses public key to check signature of hash AxProtector Exposed 42

43 Demo Protection Process Successful Integrity Check Tampered exe / dll AxProtector Exposed 43

44 Summary AxProtector Exposed 44

45 Authenticode EXE DLL One Single Point of Attack! DLL Authenticode DLL DLL DLL AxProtector Exposed 45

46 AxProtector EXE DLL DLL DLL DLL DLL AxProtector Exposed 46

47 AxProtector Integrity Protection Easy to use Security for Software Vendors and Users No single point for hackers Each module (EXE / DLL) can be updated separately AxProtector Exposed 47

48 Security for Software Vendor and User Software Vendor User Copy Protection Mods Cheats Virus (use Authenticode) Sabotage Cheats AxProtector Exposed 48

49 Thank You WIBU-SYSTEMS AG AxProtector Exposed 49