Deploying Dynamic Analyses and Preventing Compiler Backdoors with - - PowerPoint PPT Presentation

▶
deploying dynamic analyses and preventing compiler
SMART_READER_LITE
LIVE PREVIEW

Deploying Dynamic Analyses and Preventing Compiler Backdoors with - - PowerPoint PPT Presentation

Mar 26, 2023 205 likes •947 views

Deploying Dynamic Analyses and Preventing Compiler Backdoors with Multi-Version Execution Lus Pina l.pina@imperial.ac.uk Joint work with Cristian Cadar , Anastasios Andronidis , and John Regehr Imperial College London, UK University of

slide-1
SLIDE 1

Deploying Dynamic Analyses and Preventing Compiler Backdoors with Multi-Version Execution

Luís Pina

l.pina@imperial.ac.uk

Joint work with Cristian Cadar , Anastasios Andronidis , and John Regehr

Imperial College London, UK University of Utah, USA

Runtime Verification beyond Monitoring (ArVi) ICT COST Action IC1402

Barcelona, March 10th, 2016

slide-2
SLIDE 2

Deploying Dynamic Analysis?

Why? ./server

2

slide-3
SLIDE 3

Deploying Dynamic Analysis?

Why? ./server

Segmentation fault

3

slide-4
SLIDE 4

Deploying Dynamic Analysis?

Why? ./server

4

slide-5
SLIDE 5

Deploying Dynamic Analysis?

Why? valgrind --tool=memcheck server Invalid read of size 32 by 0x40B07FF4: memcpy (mc_replace_strmem.c:635) by 0x40AC751B: dtls1_process_heartbeat(SSL *s) (ssl/d1_both.c:1497) Address 0xBFFFF0E0 is not stack’d, malloc’d or free’d

5

slide-6
SLIDE 6

Deploying Dynamic Analysis?

Why? valgrind --tool=memcheck server Invalid read of size 32 by 0x40B07FF4: memcpy (mc_replace_strmem.c:635) by 0x40AC751B: dtls1_process_heartbeat(SSL *s) (ssl/d1_both.c:1497) Address 0xBFFFF0E0 is not stack’d, malloc’d or free’d

7x–57x slowdown

6

slide-7
SLIDE 7

Deploying Dynamic Analysis?

Why? gcc -fsanitize=address server.c -o server ./server ==2268==ERROR: AddressSanitizer: heap-buffer-overflow

  • n address 0x629000013748 at pc 0x7f228f5f0cfa

READ of size 32768 at 0x629000013748 thread T0 #0 0x43d075 in memcpy /usr/include/bits/string3.h:51 #1 0x43d075 in tls1_process_heartbeat ssl/t1_lib.c:2586 #2 0x50e498 in ssl3_read_bytes ssl/s3_pkt.c:1092 #3 0x51895c in ssl3_get_message ssl/s3_both.c:457 ... ==2268== ABORTING

1.10x–2.67x slowdown

7

slide-8
SLIDE 8

N-Version Execution

Server

8

slide-9
SLIDE 9

N-Version Execution

Server Coordinator Version 1 Version 2

9

slide-10
SLIDE 10

N-Version Execution

Server Coordinator Version 1 Version 2

10

slide-11
SLIDE 11

N-Version Execution

Server Coordinator Version 1 Version 2

11

slide-12
SLIDE 12

N-Version Execution

Server Coordinator Version 1 Version 2

12

slide-13
SLIDE 13

Varan

Version 1 Version 2 Coordinator

13

slide-14
SLIDE 14

Varan

Version 1 Version 2 Coordinator Leader Follower 1

14

slide-15
SLIDE 15

Varan

Version 1 Version 2 Leader Follower 1

15

slide-16
SLIDE 16

Varan

Version 1 Version 2 Leader Follower 1

16

slide-17
SLIDE 17

Varan

Version 1 Version 2 Leader Follower 1

17

slide-18
SLIDE 18

Varan

Version 1 Version 2 Leader Follower 1

18

slide-19
SLIDE 19

Varan

Version 1 Version 2 Leader Follower 1

19

slide-20
SLIDE 20

Varan

Version 1 Version 2 Leader Follower 1

20

slide-21
SLIDE 21

Varan

Version 1 Version 2 Leader Follower 1

21

slide-22
SLIDE 22

Varan

Version 1 Version 2 Leader Follower 1

22

slide-23
SLIDE 23

Varan

Version 1 Version 2 Leader Follower 1

23

slide-24
SLIDE 24

Varan

System calls

01 02 while (true) { 03 04 sckt = accept(); // Wait for client 05 06 req = parse(read(skt)); // Handle request 07 file = open(req); 08 rsp = read(file); 09 10 11 12 write(skt, rsp); // Send response 13 14 } 15

24

slide-25
SLIDE 25

Varan

System calls

01 02 while (true) { 03 04 sckt = accept (); // Wait for client 05 06 req = parse( read (skt)); // Handle request 07 file = open (req); 08 rsp = read (file); 09 10 11 12 write (skt, rsp); // Send response 13 14 } 15

25

slide-26
SLIDE 26

Varan

Version 1 Version 2 Leader Follower 1

26

slide-27
SLIDE 27

Varan

Version 1 Version 2 Leader Follower 1

1x–1.17x slowdown

27

slide-28
SLIDE 28

Varan + Dynamic Analysis

Leader Follower 1 Native Sanitized

28

slide-29
SLIDE 29

Varan + Dynamic Analysis

Leader Follower 1 Native Sanitized

29

slide-30
SLIDE 30

Varan + Dynamic Analysis

Leader Follower 1 Native Sanitized

30

slide-31
SLIDE 31

Varan + Dynamic Analysis

Leader Follower 1 Native Sanitized

31

slide-32
SLIDE 32

Varan + Dynamic Analysis

Leader Follower 1 Native Sanitized

32

slide-33
SLIDE 33

Varan + Dynamic Analysis

Leader Follower 1 Native Sanitized

33

slide-34
SLIDE 34

Varan + Dynamic Analysis

Leader Follower 1 Native Sanitized

34

slide-35
SLIDE 35

Varan + Dynamic Analysis

Leader Follower 1 Native Sanitized

35

slide-36
SLIDE 36

Varan + Dynamic Analysis

Leader Follower 1 Native Sanitized

36

slide-37
SLIDE 37

Varan + Dynamic Analysis

Leader Follower 1 Native Sanitized

37

slide-38
SLIDE 38

Larger ringbuffer?

Leader Follower 1 Native Sanitized

38

slide-39
SLIDE 39

Larger ringbuffer?

Leader Follower 1 Native Sanitized

39

slide-40
SLIDE 40

Larger ringbuffer

Interactive applications

◮ alias vim=’vx vim vim-asan’ ◮ alias htop=’vx htop htop-asan’ ◮ alias mutt=’vx mutt mutt-asan’ ◮ alias ssh=’vx ssh ssh-asan’ ◮ alias ls=’vx ls ls-asan’ 40

slide-41
SLIDE 41

Drop requests

Leader Follower 1 Native Sanitized

41

slide-42
SLIDE 42

Drop requests

Leader Follower 1 Native Sanitized

? 42

slide-43
SLIDE 43

Drop requests

Leader Follower 1 Native Sanitized

? ✓ 43

slide-44
SLIDE 44

Drop requests

Leader Follower 1 Native Sanitized

? 44

slide-45
SLIDE 45

Drop requests

Leader Follower 1 Native Sanitized

? ✗ 45

slide-46
SLIDE 46

Experiment

Check performance with varying drop rate on simple HTTP server

◮ Single process/thread ◮ gcc -fsanitize=address on follower ◮ BZip2 the response 46

slide-47
SLIDE 47

Results

No Varan Varan

# files downloaded in 30 seconds 219 196

HTTP Server

Native

HTTP Server HTTP Server

Native

47

slide-48
SLIDE 48

Results

No Varan Varan

# files downloaded in 30 seconds 219 196

HTTP Server

Native

HTTP Server HTTP Server

Native

HTTP Server

Sanitized

No Varan Varan

# files downloaded in 30 seconds 219 196 82 93

HTTP Server

Sanitized

48

slide-49
SLIDE 49

Results

No Varan Varan

# files downloaded in 30 seconds 219 196

HTTP Server

Native

HTTP Server HTTP Server

Native

HTTP Server

Sanitized

No Varan Varan

# files downloaded in 30 seconds 219 196 82 93

HTTP Server

Sanitized

2.75 13.3 23.7 32.1 38.8 50.3 65.6 82.5 88.3 97.0

sanitized requests (%)

# files downloaded in 30 seconds 216 204 209 201 197 182 141 122 109 99

49

slide-50
SLIDE 50

Multi-version execution for security

50

slide-51
SLIDE 51

a or b?

01 int x = 1; 02 03 void f(void) { 04 if (5 % (3 * x) + 2 != 4) 05 puts("a"); 06 else 07 puts("b"); 08 }

51

slide-52
SLIDE 52

a or b?

01 int x = 1; 02 03 void f(void) { 04 if (5 % (3 * x) + 2 != 4) 05 puts("a"); 06 else 07 puts("b"); 08 } Clang 3.3 says a https://llvm.org/bugs/show_bug.cgi?id=15940

52

slide-53
SLIDE 53

sudo

01 htop 02 # command not found: htop 03 04 apt-get install htop 05 # Permission denied, are you root? 06 07 sudo apt-get install htop 08 # Installing... 09 10 htop 11 # running htop...

53

slide-54
SLIDE 54

sudo

01 whoami 02 # user 03 04 sudo whoami 05 # root

54

slide-55
SLIDE 55

sudo backdoor

01 gcc sudo.c -o sudo-gcc 02 clang sudo.c -o sudo-clang 03 04 ./sudo-gcc whomai 05 # user is not in the sudoers file. 06 # This incident will be reported. 07 08 ./sudo-clang whomai 09 # root 10 11 12 https://github.com/regehr/sudo-1.8.13/tree/ compromise/backdoor-info

55

slide-56
SLIDE 56

sudo backdoor

01 gcc sudo.c -o sudo-gcc 02 clang sudo.c -o sudo-clang 03 04 ./sudo-gcc whomai 05 # user is not in the sudoers file. 06 # This incident will be reported. 07 08 ./sudo-clang whomai 09 # root 10 11 vx ./sudo-gcc ./sudo-clang -- whoami 12 # divergence detected, terminating Cristian Cadar and Luís Pina and John Regehr, Multi-Version Execution Defeats a Compiler-Bug-Based Backdoor, http://blog.regehr.org/archives/1282, 2015

56

slide-57
SLIDE 57

Undefined behavior

01 int saturating_add(int x, int y) { 02 if(x > 0 && y > 0 && x + y < 0) 03 return INT_MAX; 04 if(x < 0 && y < 0 && x + y > 0) 05 return INT_MIN; 06 return x + y; 07 }

57

slide-58
SLIDE 58

Undefined behavior

01 int saturating_add(int x, int y) { 02 if(x > 0 && y > 0 && x + y < 0) 03 return INT_MAX; 04 if(x < 0 && y < 0 && x + y > 0) 05 return INT_MIN; 06 return x + y; 07 } x y Result 1 2 3

58

slide-59
SLIDE 59

Undefined behavior

01 int saturating_add(int x, int y) { 02 if(x > 0 && y > 0 && x + y < 0) 03 return INT_MAX; 04 if(x < 0 && y < 0 && x + y > 0) 05 return INT_MIN; 06 return x + y; 07 } x y Result 1 2 3 1000000000 1000000000 2000000000

59

slide-60
SLIDE 60

Undefined behavior

01 int saturating_add(int x, int y) { 02 if(x > 0 && y > 0 && x + y < 0) 03 return INT_MAX; 04 if(x < 0 && y < 0 && x + y > 0) 05 return INT_MIN; 06 return x + y; 07 } x y Result 1 2 3 1000000000 1000000000 2000000000 2000000000 2000000000 2147483647

60

slide-61
SLIDE 61

Undefined behavior

01 int saturating_add(int x, int y) { 02 if(x > 0 && y > 0 && x + y < 0) 03 return INT_MAX; 04 if(x < 0 && y < 0 && x + y > 0) 05 return INT_MIN; 06 return x + y; 07 } x y gcc -O0 gcc -O2 1 2 3 3 1000000000 1000000000 2000000000 2000000000 2000000000 2000000000 2147483647

  • 294967296

61

slide-62
SLIDE 62

Multi-version execution for security

◮ Prevents compiler backdoors ◮ Detects exploits based on undefined behavior ◮ Interesting programs:

◮ Sudo ◮ OpenSSH ◮ Password vaults ◮ GnuPG

62

slide-63
SLIDE 63

Conclusion

◮ Retain performance? ✓ ◮ Prevent backdoors? ✓ ◮ Still detect bugs? ◮ Real server software? ◮ Other analyses?

2.75 13.3 23.7 32.1 38.8 50.3 65.6 82.5 88.3 97.0

sanitized requests (%)

# files downloaded in 30 seconds 216 204 209 201 197 182 141 122 109 99 ◮ Luís Pina and Cristian Cadar, Towards Deployment-Time

Dynamic Analysis of Server Applications, WODA, 2015

◮ Cristian Cadar and Luís Pina and John Regehr, Multi-Version

Execution Defeats a Compiler-Bug-Based Backdoor, http://blog.regehr.org/archives/1282, 2015

63

slide-64
SLIDE 64

Thank you!

64

slide-65
SLIDE 65

Conclusion

◮ Retain performance? ✓ ◮ Prevent backdoors? ✓ ◮ Still detect bugs? ◮ Real server software? ◮ Other analyses?

2.75 13.3 23.7 32.1 38.8 50.3 65.6 82.5 88.3 97.0

sanitized requests (%)

# files downloaded in 30 seconds 216 204 209 201 197 182 141 122 109 99 ◮ Luís Pina and Cristian Cadar, Towards Deployment-Time

Dynamic Analysis of Server Applications, WODA, 2015

◮ Cristian Cadar and Luís Pina and John Regehr, Multi-Version

Execution Defeats a Compiler-Bug-Based Backdoor, http://blog.regehr.org/archives/1282, 2015

65

slide-66
SLIDE 66

Varan Implementation

kernel varan code libc.so mov 0x0,$rax syscall

✗

mov 0x0, $rax jmp

66

slide-67
SLIDE 67

Varan Implementation

kernel varan code libc.so mov 0x0, $rax jmp read()

67

slide-68
SLIDE 68

Varan Implementation

kernel varan code libc.so mov 0x0, $rax jmp read() code libc.so varan

68

slide-69
SLIDE 69

Drop requests — Implementation Challenges

01 02 while (true) { 03 04 sckt = accept(); // Wait for client 05 06 req = parse(read(skt)); // Handle request 07 file = open(req); 08 rsp = read(file); 09 10 11 12 write(skt, rsp); // Send response 13 14 } 15

69

slide-70
SLIDE 70

Drop requests — Implementation Challenges

01 02 while (true) { 03 04 sckt = accept (); // Wait for client 05 06 req = parse( read (skt)); // Handle request 07 file = open (req); 08 rsp = read (file); 09 10 11 12 write (skt, rsp); // Send response 13 14 } 15

70

slide-71
SLIDE 71

Drop requests — Implementation Challenges

01 02 while (true) { 03

  • pen("VARAN_DUMMY");

04 sckt = accept (); // Wait for client 05 06 req = parse( read (skt)); // Handle request 07 file = open (req); 08 rsp = read (file); 09 10 11 12 write (skt, rsp); // Send response 13 14 } 15

71

slide-72
SLIDE 72

Drop requests — Implementation Challenges

01 void http_server() { 02 while (true) { 03

  • pen("VARAN_DUMMY");

04 sckt = accept (); // Wait for client 05 06 req = parse( read (skt)); // Handle request 07 file = open (req); 08 rsp = read (file); 09 10 rsp = bzip2(rsp); 11 12 write (skt, rsp); // Send response 13 14 } 15 }

72