The Experts below are selected from a list of 483 Experts worldwide ranked by ideXlab platform
Hung Thinh Pham - One of the best experts on this subject based on the ideXlab platform.
-
tad time side channel attack defense of Obfuscated source Code
Asia and South Pacific Design Automation Conference, 2019Co-Authors: Alexander Fell, Hung Thinh PhamAbstract:Program obfuscation is widely used to protect commercial software against reverse-engineering. However, an adversary can still download, disassemble and analyze binaries of the Obfuscated Code executed on an embedded System-on-Chip (SoC), and by correlating execution times to input values, extract secret information from the program. In this paper, we show (1) the impact of widely-used obfuscation methods on timing leakage, and (2) that well-known software countermeasures to reduce timing leakage of programs, are not always effective for low-noise environments found in embedded systems. We propose two methods for mitigating timing leakage in Obfuscated Codes. The first is a compiler driven method, called TAD, which removes conditional branches with distinguishable execution times for an input program. In the second method (TADCI), TAD is combined with dynamic hardware diversity by replacing primitive instructions with Custom Instructions (CIs) that exhibit non-deterministic execution times at runtime. Experimental results on the RISC-V platform show that the information leakage is reduced by 92% and 82% when TADCI is applied to the original and Obfuscated source Code, respectively.
-
ASP-DAC - TAD: time side-channel attack defense of Obfuscated source Code
Proceedings of the 24th Asia and South Pacific Design Automation Conference, 2019Co-Authors: Alexander Fell, Hung Thinh PhamAbstract:Program obfuscation is widely used to protect commercial software against reverse-engineering. However, an adversary can still download, disassemble and analyze binaries of the Obfuscated Code executed on an embedded System-on-Chip (SoC), and by correlating execution times to input values, extract secret information from the program. In this paper, we show (1) the impact of widely-used obfuscation methods on timing leakage, and (2) that well-known software countermeasures to reduce timing leakage of programs, are not always effective for low-noise environments found in embedded systems. We propose two methods for mitigating timing leakage in Obfuscated Codes. The first is a compiler driven method, called TAD, which removes conditional branches with distinguishable execution times for an input program. In the second method (TADCI), TAD is combined with dynamic hardware diversity by replacing primitive instructions with Custom Instructions (CIs) that exhibit non-deterministic execution times at runtime. Experimental results on the RISC-V platform show that the information leakage is reduced by 92% and 82% when TADCI is applied to the original and Obfuscated source Code, respectively.
M. Madou - One of the best experts on this subject based on the ideXlab platform.
-
Understanding Obfuscated Code
14th IEEE International Conference on Program Comprehension (ICPC'06), 2006Co-Authors: M. Madou, K. De BosschereAbstract:Code obfuscation makes it harder for a security analyst to understand the malicious payload of a program. In most cases an analyst needs to study the program at the machine Code level, with little or no extra information available, apart from his experience. An unexperienced analyst is confronted with a steep learning curve, as understanding unObfuscated machine Code already requires some skills. We have built Loco, a graphical, interactive environment to help a security analyst improving his skills in understanding Obfuscated Code
-
ICPC - Understanding Obfuscated Code
14th IEEE International Conference on Program Comprehension (ICPC'06), 2006Co-Authors: M. Madou, K. De BosschereAbstract:Code obfuscation makes it harder for a security analyst to understand the malicious payload of a program. In most cases an analyst needs to study the program at the machine Code level, with little or no extra information available, apart from his experience. An unexperienced analyst is confronted with a steep learning curve, as understanding unObfuscated machine Code already requires some skills. We have built LOCO, a graphical, interactive environment to help a security analyst improving his skills in understanding Obfuscated Code.
-
WCRE - Deobfuscation: reverse engineering Obfuscated Code
12th Working Conference on Reverse Engineering (WCRE'05), 2005Co-Authors: S.k. Udupa, Saumya K Debray, M. MadouAbstract:In recent years, Code obfuscation has attracted attention as a low cost approach to improving software security by making it difficult for attackers to understand the inner workings of proprietary software systems. This paper examines techniques for automatic deobfuscation of Obfuscated programs, as a step towards reverse engineering such programs. Our results indicate that much of the effects of Code obfuscation, designed to increase the difficulty of static analyses, can be defeated using simple combinations of straightforward static and dynamic analyses. Our results have applications to both software engineering and software security. In the context of software engineering, we show how dynamic analyses can be used to enhance reverse engineering, even for Code that has been designed to be difficult to reverse engineer. For software security, our results serve as an attack model for Code obfuscators, and can help with the development of obfuscation techniques that are more resilient to straightforward reverse engineering.
-
Deobfuscation: reverse engineering Obfuscated Code
12th Working Conference on Reverse Engineering (WCRE'05), 2005Co-Authors: S.k. Udupa, S.k. Debray, M. MadouAbstract:In recent years, Code obfuscation has attracted attention as a low cost approach to improving software security by making it difficult for attackers to understand the inner workings of proprietary software systems. This paper examines techniques for automatic deobfuscation of Obfuscated programs, as a step towards reverse engineering such programs. Our results indicate that much of the effects of Code obfuscation, designed to increase the difficulty of static analyses, can be defeated using simple combinations of straightforward static and dynamic analyses. Our results have applications to both software engineering and software security. In the context of software engineering, we show how dynamic analyses can be used to enhance reverse engineering, even for Code that has been designed to be difficult to reverse engineer. For software security, our results serve as an attack model for Code obfuscators, and can help with the development of obfuscation techniques that are more resilient to straightforward reverse engineering.
Alexander Fell - One of the best experts on this subject based on the ideXlab platform.
-
tad time side channel attack defense of Obfuscated source Code
Asia and South Pacific Design Automation Conference, 2019Co-Authors: Alexander Fell, Hung Thinh PhamAbstract:Program obfuscation is widely used to protect commercial software against reverse-engineering. However, an adversary can still download, disassemble and analyze binaries of the Obfuscated Code executed on an embedded System-on-Chip (SoC), and by correlating execution times to input values, extract secret information from the program. In this paper, we show (1) the impact of widely-used obfuscation methods on timing leakage, and (2) that well-known software countermeasures to reduce timing leakage of programs, are not always effective for low-noise environments found in embedded systems. We propose two methods for mitigating timing leakage in Obfuscated Codes. The first is a compiler driven method, called TAD, which removes conditional branches with distinguishable execution times for an input program. In the second method (TADCI), TAD is combined with dynamic hardware diversity by replacing primitive instructions with Custom Instructions (CIs) that exhibit non-deterministic execution times at runtime. Experimental results on the RISC-V platform show that the information leakage is reduced by 92% and 82% when TADCI is applied to the original and Obfuscated source Code, respectively.
-
ASP-DAC - TAD: time side-channel attack defense of Obfuscated source Code
Proceedings of the 24th Asia and South Pacific Design Automation Conference, 2019Co-Authors: Alexander Fell, Hung Thinh PhamAbstract:Program obfuscation is widely used to protect commercial software against reverse-engineering. However, an adversary can still download, disassemble and analyze binaries of the Obfuscated Code executed on an embedded System-on-Chip (SoC), and by correlating execution times to input values, extract secret information from the program. In this paper, we show (1) the impact of widely-used obfuscation methods on timing leakage, and (2) that well-known software countermeasures to reduce timing leakage of programs, are not always effective for low-noise environments found in embedded systems. We propose two methods for mitigating timing leakage in Obfuscated Codes. The first is a compiler driven method, called TAD, which removes conditional branches with distinguishable execution times for an input program. In the second method (TADCI), TAD is combined with dynamic hardware diversity by replacing primitive instructions with Custom Instructions (CIs) that exhibit non-deterministic execution times at runtime. Experimental results on the RISC-V platform show that the information leakage is reduced by 92% and 82% when TADCI is applied to the original and Obfuscated source Code, respectively.
Denys Poshyvanyk - One of the best experts on this subject based on the ideXlab platform.
-
On automatically detecting similar Android apps
2016 IEEE 24th International Conference on Program Comprehension (ICPC), 2016Co-Authors: Mario Linares-vásquez, Andrew Holtzhauer, Denys PoshyvanykAbstract:Detecting similar applications is a challenging problem, since it implies that similar high-level features and their low-level implementations can be detected and matched automatically. We propose an approach for automatically detecting Closely reLated applications in ANdroid (CLANdroid) by relying on advanced Information Retrieval techniques and five semantic anchors: identifiers, Android APIs, intents, permissions, and sensors. To evaluate CLANdroid we created a benchmark consisting of 14,450 apps along with information on similar apps provided by Google Play. We also compared effectiveness of different semantic anchors for detecting similar apps as perceived by 27 users. The results show that using Android-specific semantic anchors are useful for detecting similar Android apps across different categories. We also measured the impact of third-party libraries and Obfuscated Code when identifying similar Android apps, and our results suggest that there is significant difference in the accuracy when third-party libraries are excluded.
-
ICPC - On automatically detecting similar Android apps
2016 IEEE 24th International Conference on Program Comprehension (ICPC), 2016Co-Authors: Mario Linares-vásquez, Andrew Holtzhauer, Denys PoshyvanykAbstract:Detecting similar applications is a challenging problem, since it implies that similar high-level features and their low-level implementations can be detected and matched automatically. We propose an approach for automatically detecting Closely reLated applications in ANdroid (CLANdroid) by relying on advanced Information Retrieval techniques and five semantic anchors: identifiers, Android APIs, intents, permissions, and sensors. To evaluate CLANdroid we created a benchmark consisting of 14,450 apps along with information on similar apps provided by Google Play. We also compared effectiveness of different semantic anchors for detecting similar apps as perceived by 27 users. The results show that using Android-specific semantic anchors are useful for detecting similar Android apps across different categories. We also measured the impact of third-party libraries and Obfuscated Code when identifying similar Android apps, and our results suggest that there is significant difference in the accuracy when third-party libraries are excluded.
Alexander Pretschner - One of the best experts on this subject based on the ideXlab platform.
-
USENIX Security Symposium - Predicting the Resilience of Obfuscated Code Against Symbolic Execution Attacks via Machine Learning
2020Co-Authors: Sebastian Banescu, Christian Collberg, Alexander PretschnerAbstract:Software obfuscation transforms Code such that it is more difficult to reverse engineer. However, it is known that given enough resources, an attacker will successfully reverse engineer an Obfuscated program. Therefore, an open challenge for software obfuscation is estimating the time an Obfuscated program is able to withstand a given reverse engineering attack. This paper proposes a general framework for choosing the most relevant software features to estimate the effort of automated attacks. Our framework uses these software features to build regression models that can predict the resilience of different software protection transformations against automated attacks. To evaluate the effectiveness of our approach, we instantiate it in a case-study about predicting the time needed to deobfuscate a set of C programs, using an attack based on symbolic execution. To train regression models our system requires a large set of programs as input. We have therefore implemented a Code generator that can generate large numbers of arbitrarily complex random C functions. Our results show that features such as the number of community structures in the graphrepresentation of symbolic path-constraints, are far more relevant for predicting deobfuscation time than other features generally used to measure the potency of controlflow obfuscation (e.g. cyclomatic complexity). Our best model is able to predict the number of seconds of symbolic execution-based deobfuscation attacks with over 90% accuracy for 80% of the programs in our dataset, which also includes several realistic hash functions.
-
predicting the resilience of Obfuscated Code against symbolic execution attacks via machine learning
USENIX Security Symposium, 2017Co-Authors: Sebastian Banescu, Christian Collberg, Alexander PretschnerAbstract:Software obfuscation transforms Code such that it is more difficult to reverse engineer. However, it is known that given enough resources, an attacker will successfully reverse engineer an Obfuscated program. Therefore, an open challenge for software obfuscation is estimating the time an Obfuscated program is able to withstand a given reverse engineering attack. This paper proposes a general framework for choosing the most relevant software features to estimate the effort of automated attacks. Our framework uses these software features to build regression models that can predict the resilience of different software protection transformations against automated attacks. To evaluate the effectiveness of our approach, we instantiate it in a case-study about predicting the time needed to deobfuscate a set of C programs, using an attack based on symbolic execution. To train regression models our system requires a large set of programs as input. We have therefore implemented a Code generator that can generate large numbers of arbitrarily complex random C functions. Our results show that features such as the number of community structures in the graphrepresentation of symbolic path-constraints, are far more relevant for predicting deobfuscation time than other features generally used to measure the potency of controlflow obfuscation (e.g. cyclomatic complexity). Our best model is able to predict the number of seconds of symbolic execution-based deobfuscation attacks with over 90% accuracy for 80% of the programs in our dataset, which also includes several realistic hash functions.