Symbolic Execution of Security Protocol Impl.: Handling - - PowerPoint PPT Presentation

symbolic execution of security protocol
SMART_READER_LITE
LIVE PREVIEW

Symbolic Execution of Security Protocol Impl.: Handling - - PowerPoint PPT Presentation

Symbolic Execution of Security Protocol Impl.: Handling Cryptographic Primitives Mathy Vanhoef @vanhoefm USENIX WOOT, Baltimore, US, 14 August 2018 Overview Symbolic Execution 4-way handshake Handling Crypto Results 2 Overview Symbolic


slide-1
SLIDE 1

Symbolic Execution of Security Protocol Impl.: Handling Cryptographic Primitives

Mathy Vanhoef — @vanhoefm USENIX WOOT, Baltimore, US, 14 August 2018

slide-2
SLIDE 2

Overview

2

Symbolic Execution Handling Crypto 4-way handshake Results

slide-3
SLIDE 3

Overview

3

Symbolic Execution Handling Crypto 4-way handshake Results

slide-4
SLIDE 4

Symbolic Execution

4

void recv(data, len) { if (data[0] != 1) return if (data[1] != len) return int num = len/data[2] ... }

Mark data as symbolic Symbolic branch

slide-5
SLIDE 5

Symbolic Execution

5

data[0] != 1 void recv(data, len) { if (data[0] != 1) return if (data[1] != len) return int num = len/data[2] ... } data[0] == 1 void recv(data, len) { if (data[0] != 1) return if (data[1] != len) return int num = len/data[2] ... }

slide-6
SLIDE 6

Symbolic Execution

6

data[0] == 1 data[0] != 1

Continue execution: if (data[1] != len)

PC = Path Constraint

slide-7
SLIDE 7

Symbolic Execution

7

data[0] != 1 Continue execution

data[0] == 1 && data[1] != len data[0] == 1 && data[1] == len

slide-8
SLIDE 8

Symbolic Execution

8

Can data[2] equal zero under the current PC?

data[0] == 1 && data[1] == len void recv(data, len) { if (data[0] != 1) return if (data[1] != len) return int num = len/data[2] ...

slide-9
SLIDE 9

Symbolic Execution

9

Can data[2] equal zero under the current PC? Yes! Bug detected!

data[0] == 1 && data[1] == len void recv(data, len) { if (data[0] != 1) return if (data[1] != len) return int num = len/data[2] ...

slide-10
SLIDE 10

Implementations

Practical limitations: › 𝑞𝑏𝑢ℎ𝑡 = 2|𝑗𝑔−𝑡𝑢𝑏𝑢𝑓𝑛𝑓𝑜𝑢𝑡| › Infinite-length paths › SMT query complexity

10

We build upon KLEE › Works on LLVM bytecode › Actively maintained

slide-11
SLIDE 11

Overview

11

Symbolic Execution Handling Crypto 4-way handshake Results

slide-12
SLIDE 12

Motivating Example

12

void recv(data, len) { plain = decrypt(data, len) if (plain == NULL) return if (plain[0] == COMMAND) process_command(plain) else ... }

Mark data as symbolic

slide-13
SLIDE 13

Motivating Example

13

void recv(data, len) { plain = decrypt(data, len) if (plain == NULL) return if (plain[0] == COMMAND) process_command(plain) else ... }

Mark data as symbolic Summarize crypto algo. (time consuming) Analyze crypto algo. (time consuming)

Won’t reach this code!

slide-14
SLIDE 14

Efficiently handling decryption?

Decrypted output = fresh symbolic variable

14

slide-15
SLIDE 15

Example

15

void recv(data, len) { plain = decrypt(data, len) if (plain == NULL) return if (plain[0] == COMMAND) process_command(plain) else ... }

create fresh symbolic variable Normal analysis Mark data as symbolic

 Can now analyze code that parses decrypted data

slide-16
SLIDE 16

Other Applications

Handling hash functions › Output = fresh symbolic variable › Also works for HMACs (Message Authentication Codes)

16

Tracking use of crypto primitives? › Recording relationship between input & output › Treating fresh variable as information flow taint

slide-17
SLIDE 17

Detecting Crypto Misuse

Timing side-channels › ∀(𝑞𝑏𝑢ℎ𝑡): all bytes of MAC in path constraint? › If not: comparison exits on first difference

17

Decryption oracles › Behavior depends on unauth. decrypted data › Decrypt data is in path constraint, but not in MAC

slide-18
SLIDE 18

Overview

18

Symbolic Execution Handling Crypto 4-way handshake Results

slide-19
SLIDE 19

The 4-way handshake

Used to connect to any protected Wi-Fi network

19

Negotiates fresh PTK: pairwise transient key Mutual authentication

slide-20
SLIDE 20

4-way handshake (simplified)

20

slide-21
SLIDE 21

4-way handshake (simplified)

21

slide-22
SLIDE 22

4-way handshake (simplified)

22

PTK = Combine(shared secret, ANonce, SNonce)

slide-23
SLIDE 23

4-way handshake (simplified)

23

slide-24
SLIDE 24

4-way handshake (simplified)

24

Encrypted with PTK

slide-25
SLIDE 25

4-way handshake (simplified)

25

slide-26
SLIDE 26

4-way handshake (simplified)

26

slide-27
SLIDE 27

4-way handshake (simplified)

27

Authenticated with a MAC

slide-28
SLIDE 28

We focus on the client

Symbolic execution of

28

How to get these working under KLEE? Intel’s iwd deamon wpa_supplicant kernel driver

slide-29
SLIDE 29

Intel’s iwd

Avoid running full program under KLEE › Would need to model Wi-Fi stack symbolically Our approach › iwd contains unit test for the 4-way handshake › Reuse initialization code of unit test! › Symbolically execute only receive function

29

slide-30
SLIDE 30

wpa_supplicant

Unit test uses virtual hardware and runs full AP › Still need to simulate Wi-Fi stack… Alternative approach: › Write unit test that isolates 4-way handshake like iwd › Then symbolically execute receive function! › Need to modify code of wpa_supplicant (non-trivial)

30

slide-31
SLIDE 31

MediaTek’s Driver

No unit tests & it’s a Linux driver › Symbolically executing the Linux kernel?! Inspired by previous cases › Write unit test & simulate used kernel functions in userspace › Verify extracted code is correctly simulated in userspace!

31

slide-32
SLIDE 32

Not all our unit tests are created equally

32

https://github.com/vanhoefm/woot2018

slide-33
SLIDE 33

Overview

33

Symbolic Execution Handling Crypto 4-way handshake Results

slide-34
SLIDE 34

Discovered Bugs I

34

Timing side-channels › Authentication tag not checked in constant time › MediaTek and iwd are vulnerable Denial-of-service in iwd › Caused by integer underflow › Leads to huge malloc that fails

slide-35
SLIDE 35

Discovered Bugs II

Flawed AES unwrap crypto primitive › Also in MediaTek’s kernel driver › Manually discovered

35

Buffer overflow in MediaTek kernel driver › Occurs when copying the group key › May lead to remote code execution

slide-36
SLIDE 36

Decryption oracle in wpa_supplicant

 Decrypt group key (GTK) in Message 3 (Msg3)

36

Decryption oracle: › Doesn’t check authenticity of malformed handshake message › But does decrypt and process data

slide-37
SLIDE 37

Decryption oracle in wpa_supplicant II

Msg3’: decrypted using RC4, but not authenticated

37

header 221 36 𝒚𝟏 … 𝒚𝟒𝟔 𝒚𝟒𝟕 𝒚𝟒𝟖 Type Length GTK’ Type’ Length’ header 221 38 𝒚𝟏 … 𝒚𝟒𝟖 Type Length GTK

 Parsing only succeeds if 𝑦37 is zero

slide-38
SLIDE 38

Future work

Short-term › Efficiently simulate reception of multiple packets › If 1st packet doesn’t affect state, stop exploring this path Long-term › Extract packet formats and state machine › Verify basic properties of protocol

38

slide-39
SLIDE 39

Conclusion

› Symbolic execution of protocols › Simple simulation of crypto › Interesting future work

39

slide-40
SLIDE 40

As a final note…

40

slide-41
SLIDE 41

Questions?

Thank you!