CYBERDYNE: Automatic bug-finding at scale Peter Goodman - - PowerPoint PPT Presentation

▶
cyberdyne
SMART_READER_LITE
LIVE PREVIEW

CYBERDYNE: Automatic bug-finding at scale Peter Goodman - - PowerPoint PPT Presentation

Feb 13, 2024 167 likes •811 views

CYBERDYNE: Automatic bug-finding at scale Peter Goodman COUNTERMEASURE 2016 Cyberdyne (ex)terminates bugs Finds bug in binaries Combines different techniques Coverage-guided fuzzing Symbolic execution Trail of Bits |

slide-1
SLIDE 1

CYBERDYNE: Automatic bug-finding at scale

Peter Goodman COUNTERMEASURE 2016

slide-2
SLIDE 2
slide-3
SLIDE 3

2

  • Finds bug in binaries
  • Combines different techniques
  • Coverage-guided fuzzing
  • Symbolic execution

Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Cyberdyne (ex)terminates bugs

slide-4
SLIDE 4

3

  • Part 1: high level architecture
  • How to coordinate bug-finding tools
  • Part 2: low level tools
  • How do the bug-finding tools work?

Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Get to know the mind of the machine

slide-5
SLIDE 5

4 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

History: Cyber Grand Challenge (1)

slide-6
SLIDE 6

5 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

  • Capture-the-flag (CTF) competition
  • Goal: find and exploit bugs in binaries
  • Goal: patch binaries
  • Competitors were programs
  • “Cyber Reasoning Systems” (CRS)

History: Cyber Grand Challenge (2)

slide-7
SLIDE 7

6 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

  • Shaped the design of Cyberdyne
  • Distributed system
  • Runs on any number of nodes
  • Automated system
  • No human intervention required

History: Cyber Grand Challenge (3)

slide-8
SLIDE 8

Part 1 Skeleton of a bug-finding system

7 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

slide-9
SLIDE 9

8

  • Find bugs
  • Simple, right?
  • Work on real programs
  • Be easy to scale

Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Ideally, a bug-finding system should …

slide-10
SLIDE 10

9 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

When I grow up …

slide-11
SLIDE 11

10 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

First kill: simple fuzzing (1)

Splice Slice Bit flips Byte flips

Seed Inputs Mutation Engine Mutated Inputs

slide-12
SLIDE 12

11 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

First kill: simple fuzzing (1)

Seed Inputs Mutation Engine Mutated Inputs

Radamsa, zzuf, etc.

slide-13
SLIDE 13

12 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

First kill: simple fuzzing (2)  Mutate inputs Execute inputs … Profit?

  • Find bugs!

  

12 1 2 3 4 5 6 7 8 9 10 11

Terminator

pag@sloth:~/ cyberdyne start pag@sloth:~/ cyberdyne analyze –program foo –binaries bar pag@sloth:~/ cyberdyne seed –program foo – inputs ./inputs/*

slide-14
SLIDE 14

13 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

First kill: simple fuzzing (2)  Mutate inputs  Execute inputs … Profit?

  • Find bugs!

  

12 1 2 3 4 5 6 7 8 9 10 11

Terminator

pag@sloth:~/ cyberdyne start pag@sloth:~/ cyberdyne analyze –program foo –binaries bar pag@sloth:~/ cyberdyne seed –program foo – inputs ./inputs/*

slide-15
SLIDE 15

14 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

First kill: simple fuzzing (2)  Mutate inputs  Execute inputs … Profit?

  • Find bugs!

  

12 1 2 3 4 5 6 7 8 9 10 11

Terminator

pag@sloth:~/ cyberdyne start pag@sloth:~/ cyberdyne analyze –program foo –binaries bar pag@sloth:~/ cyberdyne seed –program foo – inputs ./inputs/*

slide-16
SLIDE 16

15 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

First kill: simple fuzzing (2)  Mutate inputs  Execute inputs … Profit?

  • Find bugs!
  • Right????

  

12 1 2 3 4 5 6 7 8 9 10 11

Terminator

pag@sloth:~/ cyberdyne start pag@sloth:~/ cyberdyne analyze –program foo –binaries bar pag@sloth:~/ cyberdyne seed –program foo – inputs ./inputs/*

slide-17
SLIDE 17

16 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

First kill: simple fuzzing (2)   

Terminator

pag@sloth:~/ cyberdyne start pag@sloth:~/ cyberdyne analyze –program foo –binaries bar pag@sloth:~/ cyberdyne seed –program foo – inputs ./inputs/*

 Mutate inputs  Execute inputs … Risk of loss!

  • No bugs found
  • Lost cycles, time
slide-18
SLIDE 18

17

  • Searching for bugs takes time
  • Need accountability
  • Is it worth it to keep searching?
  • Is progress being made?
  • How do we measure progress?

Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Misfire: Check your targets

slide-19
SLIDE 19

18

  • Idea: has something new happened?
  • Track when new code is executed
  • Code coverage: Instrument program to

detect when new code is executed

  • Inputs that cover new code signal

progress

Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Reload: Track bug-finding progress

slide-20
SLIDE 20

19

  • Eventually hit a “coverage ceiling”
  • Decreasing marginal returns
  • Need heavier guns
  • Coverage-guided fuzzing: re-seed with

inputs that got new coverage (next)

  • Symbolic execution (later)

Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Need more ammo

slide-21
SLIDE 21

Crashes!

20 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Coverage-guided mutational fuzzing (1)

Terminator

cyberdyne start cyberdyne analyze –pr… cyberdyne launch nukes

Ste tep p 1 Mutate inputs Ste tep p 2 Execute mutations Step p 3 Gets new Coverage? Ste tep p 4 Re-seed mutator

slide-22
SLIDE 22

Crashes!

21 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Coverage-guided mutational fuzzing (1)

Ste tep p 1 Mutate inputs Ste tep p 2 Execute mutations Step p 3 Gets new Coverage? Ste tep p 4 Re-seed mutator

Terminator

cyberdyne start cyberdyne analyze –pr… cyberdyne launch nukes

AFL

slide-23
SLIDE 23

22

  • Trivially parallelizable
  • Run mutation engines concurrently
  • Scaling fuzzing in Cyberdyne
  • Fuzzer service internalizes mutation,

execution, code coverage

  • Runs many fuzzers, one mutator each

Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Coverage-guided mutational fuzzing (2)

slide-24
SLIDE 24

Look under the skin of Cyberdyne (1)

23 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

slide-25
SLIDE 25

24 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Look under the skin of Cyberdyne (2)

Terminator

cyberdyne start cyberdyne analyze –pr… cyberdyne launch nukes

slide-26
SLIDE 26

25 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Look under the skin of Cyberdyne (3)

Terminator

cyberdyne start cyberdyne analyze –pr… cyberdyne launch nukes

Fuz uzze zer r (with GRR)

  • Mutates and

executes inputs

  • Easy to scale
slide-27
SLIDE 27

26 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Look under the skin of Cyberdyne (4)

Terminator

cyberdyne start cyberdyne analyze –pr… cyberdyne launch nukes

Py PySy SymE mEmu mu

  • Coverage-guided

binary symbolic executor

  • Harder to scale
slide-28
SLIDE 28

27 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Look under the skin of Cyberdyne (5)

Terminator

cyberdyne start cyberdyne analyze –pr… cyberdyne launch nukes

KL KLEE EE (with McSema)

  • LLVM bitcode

symbolic executor

  • Hard to use
  • Hard to scale
slide-29
SLIDE 29

28 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Look under the skin of Cyberdyne (6)

Terminator

cyberdyne start cyberdyne analyze –pr… cyberdyne launch nukes

Or Orac acle le

  • Gatekeeper

for minset

  • Detects crashes
  • Easy to scale
slide-30
SLIDE 30

29 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Look under the skin of Cyberdyne (7)

Terminator

cyberdyne start cyberdyne analyze –pr… cyberdyne launch nukes

Mi Mins nset

  • Finds inputs that get

new code coverage

  • One input at a time
  • Bottleneck?
slide-31
SLIDE 31

Part 2 The servos and the gears

30 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

slide-32
SLIDE 32

31

  • What is it?
  • Minimum set of inputs that produce

maximum code coverage

  • Why use it?
  • Identify “interesting” inputs
  • Good candidates for exploration

Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

How it works: Minset (1)

slide-33
SLIDE 33

32 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 09.17.2016 | trailofbits.com

How it works: Minset (2)

2 3 4

4 3 1 2 3 4 2 1

1

slide-34
SLIDE 34

3 4

33 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 09.17.2016 | trailofbits.com

How it works: Minset (3)

2

4 3 1 2 3 4

1

2 1

slide-35
SLIDE 35

4 2 3

34 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 09.17.2016 | trailofbits.com

How it works: Minset (4)

4 1 2 3 4

1

3 2 1

𝐷𝑝𝑤(𝐽3) ⊆ 𝐷𝑝𝑤(𝐽1) ∪ 𝐷𝑝𝑤(𝐽2)

slide-36
SLIDE 36

2 3

35 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 09.17.2016 | trailofbits.com

How it works: Minset (5)

4 1 2 3 4 3 2 1

4

1

slide-37
SLIDE 37

36

  • Redundancy within the Minset
  • First input tested guaranteed entry
  • Newly added inputs tend to cover

same code as old inputs

  • Idea: fold the minset
  • Reconstruct it in reverse order

Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

How it works: Minset (6)

slide-38
SLIDE 38

2

37 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 09.17.2016 | trailofbits.com

How it works: Minset (7)

1 2 4 1

1

2 4

4

slide-39
SLIDE 39

1

2

38 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 09.17.2016 | trailofbits.com

How it works: Minset (8)

1 2 4

1

2 4

4

slide-40
SLIDE 40

2

1

39 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 09.17.2016 | trailofbits.com

How it works: Minset (9)

1 2 4 2 4

4

1

𝐷𝑝𝑤(𝐽1) ⊆ 𝐷𝑝𝑤(𝐽4) ∪ 𝐷𝑝𝑤(𝐽2)

slide-41
SLIDE 41

40

  • Corpus distillation is fast and easy
  • If bottleneck, map and reduce
  • What they don’t tell you
  • What you measure is important
  • Different metrics, different features
  • Fold to compose metrics/features

Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

How it works: Minset (10)

slide-42
SLIDE 42

41

  • Minset is friendly
  • Doesn’t care who or what produced

the inputs (e.g. fuzzer, symexec)

  • Challenge: cooperation
  • Make two independent bug-finding

tools coordinate to discover bugs

Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

The gears don’t fit

slide-43
SLIDE 43

42 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Cooperation among friends (1)

Symbolic executor produces an input

Terminator

cyberdyne start cyberdyne analyze –pr… cyberdyne launch nukes

ssssss ssssss

slide-44
SLIDE 44

43 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Cooperation among friends (2)

Input from symexec is added to minset

Terminator

cyberdyne start cyberdyne analyze –pr… cyberdyne launch nukes

slide-45
SLIDE 45

44 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Cooperation among friends (3)

Input from symexec seeds the fuzzer

Terminator

cyberdyne start cyberdyne analyze –pr… cyberdyne launch nukes

slide-46
SLIDE 46

45 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Cooperation among friends (4)

Fuzzer mutates input from symexec

Terminator

cyberdyne start cyberdyne analyze –pr… cyberdyne launch nukes

slide-47
SLIDE 47

46 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Cooperation among friends (5)

Mutated input is added to the minset

Terminator

cyberdyne start cyberdyne analyze –pr… cyberdyne launch nukes

slide-48
SLIDE 48

47 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Cooperation among friends (6)

How do we symexec a fuzzed input?

Terminator

cyberdyne start cyberdyne analyze –pr… cyberdyne launch nukes

slide-49
SLIDE 49

48 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Cooperation among friends (7)

Easy way to scale: partial symexec

Terminator

cyberdyne start cyberdyne analyze –pr… cyberdyne launch nukes

ssssss ssssss

slide-50
SLIDE 50

49

  • Symbolic executors are monolithic
  • Reason about all program paths
  • Somehow use theorem provers
  • Bugs fall out the other end…?
  • Challenge: make symexec

cooperate in a scalable way

Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Some friendships are a lot of work

slide-51
SLIDE 51

50

  • All input bytes are “symbols”
  • Fork execution when if-then-else

branch depends on symbolic input

  • Follow feasible branches, record

tested constraints down each path

Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

How it works: symbolic execution (1)

slide-52
SLIDE 52

51

  • Special kind of CPU emulator
  • Registers/memory can hold bytes,

symbols, or symbolic expressions

  • Instructions emulated in software
  • Simulates operations of instructions to

work with symbols and bytes

Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

How it works: symbolic execution (2)

slide-53
SLIDE 53

How it works: symbolic execution (3)

52 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

eax = BitVec(32) symbol ϵ [-231, 231-1]

slide-54
SLIDE 54

How it works: symbolic execution (4)

53 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

eax = BitVec(32) symbol ϵ [-231, 231-1] eax >= 0xa symbol ϵ [10, 231-1) eax < 0xa symbol ϵ [-231, 10)

slide-55
SLIDE 55

How it works: symbolic execution (5)

54 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

eax = BitVec(32) symbol ϵ [-231, 231-1] eax >= 0xa symbol ϵ [10, 231-1) return eax < 0xa symbol ϵ [-231, 10) symbol ϵ [0, 10) jump with table symbol ϵ [-231, 0) error?!

slide-56
SLIDE 56

There’s too many of them!

55 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

slide-57
SLIDE 57

56

  • Symbolic executors fork a lot!
  • Branches, loops, branches in loops
  • Takes too long to get deep into the

program, only finds shallow bugs

  • Heuristics, like coverage-guided

exploration, are band-aids

Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Symbolic execution is hard to scale

slide-58
SLIDE 58

57

  • Partial symbolic execution
  • Jump deep into a program using a

concrete input prefix

  • Trivially parallelizable
  • Run independent symbolic

executors with different prefixes

Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Easy way to scale symbolic execution

slide-59
SLIDE 59

End of days

58 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

slide-60
SLIDE 60

59 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Skeleton of a bug-finding system (1)

Terminator

cyberdyne start cyberdyne analyze –pr… cyberdyne launch nukes

ssssss ssssss ssssss ssssss ssssss ssssss

slide-61
SLIDE 61

60

  • Started with simple fuzzing
  • Added accountability
  • Coverage-guided mutational fuzzing
  • Sets groundwork for new tools
  • Going from there
  • Minset as the mediator

Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

Skeleton of a bug-finding system (2)

slide-62
SLIDE 62

61

  • Mediating with the minset
  • Fuzzer cooperates with anything
  • Symbolic executors need a bit

more massaging

  • The path to scalability
  • Go for trivial parallelization

Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

The servos and the gears

slide-63
SLIDE 63

Cyberdyne kills bugs...now you can too!

62 Trail of Bits | CYBERDYNE: Automatic Bug-Finding at Scale | 11.17.2016 | trailofbits.com

slide-64
SLIDE 64

Let’s chat

peter@trailofbits.com Senior Security Engineer

Peter Goodman