Taintscope: A Checksum-Aware Directed Fuzzing Tool for Automatic - - PowerPoint PPT Presentation

▶
taintscope a checksum aware directed fuzzing tool for
SMART_READER_LITE
LIVE PREVIEW

Taintscope: A Checksum-Aware Directed Fuzzing Tool for Automatic - - PowerPoint PPT Presentation

May 04, 2023 316 likes •746 views

Taintscope: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection Tielei Wang Tao Wei Guofei Gu Wei Zou March 12, 2014 Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope Taintscope is: A Fuzzing tool

slide-1
SLIDE 1

Taintscope: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection

Tielei Wang Tao Wei Guofei Gu Wei Zou March 12, 2014

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-2
SLIDE 2

Taintscope is:

◮ A Fuzzing tool ◮ Checksum-Aware ◮ Directed

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-3
SLIDE 3

Why a new fuzzing tool?

Fuzzing tools already exist. They can be sorted in two categories:

◮ Mutation based

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-4
SLIDE 4

Why a new fuzzing tool?

Fuzzing tools already exist. They can be sorted in two categories:

◮ Mutation based

◮ Not very efficient Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-5
SLIDE 5

Why a new fuzzing tool?

Fuzzing tools already exist. They can be sorted in two categories:

◮ Mutation based

◮ Not very efficient ◮ Cannot generate valid input if a checksum mechanism is used Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-6
SLIDE 6

Why a new fuzzing tool?

Fuzzing tools already exist. They can be sorted in two categories:

◮ Mutation based

◮ Not very efficient ◮ Cannot generate valid input if a checksum mechanism is used

◮ Generation based

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-7
SLIDE 7

Why a new fuzzing tool?

Fuzzing tools already exist. They can be sorted in two categories:

◮ Mutation based

◮ Not very efficient ◮ Cannot generate valid input if a checksum mechanism is used

◮ Generation based

◮ Better performances Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-8
SLIDE 8

Why a new fuzzing tool?

Fuzzing tools already exist. They can be sorted in two categories:

◮ Mutation based

◮ Not very efficient ◮ Cannot generate valid input if a checksum mechanism is used

◮ Generation based

◮ Better performances ◮ Often implies having input specification, or source code. ◮ Tools exist to automatically get input format, but cannot

reverse engineer checksum algorithms.

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-9
SLIDE 9

Why a new fuzzing tool?

Example of input using checksum: int format int fileSize int width int height ... int checksum void decode_input(File * f){ int recomputed_checksum = checksum(f); int checksum_in_file = get_checksum(f); if (recomputed_checksum != checksum_in_file) exit(); width = get_width(f); ...

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-10
SLIDE 10

Contributions

Taintscope offers several major contributions:

◮ Checksum-aware

◮ Detect checksum test in tested program ◮ Bypass checksum test when fuzz-testing ◮ Reconstruct input with valid checksum Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-11
SLIDE 11

Contributions

Taintscope offers several major contributions:

◮ Checksum-aware

◮ Detect checksum test in tested program ◮ Bypass checksum test when fuzz-testing ◮ Reconstruct input with valid checksum

◮ Directed

◮ Reduces the space of parameters to mutate Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-12
SLIDE 12

Checksum-awareness

Checksum-aware fuzz-testing is done in 3 steps:

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-13
SLIDE 13

Checksum-awareness

Checksum-aware fuzz-testing is done in 3 steps:

  • 1. Pre-processing: locate checksum check points in the program

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-14
SLIDE 14

Checksum-awareness

Checksum-aware fuzz-testing is done in 3 steps:

  • 1. Pre-processing: locate checksum check points in the program
  • 2. Fuzz-testing: mutate input without touching the checksum

data

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-15
SLIDE 15

Checksum-awareness

Checksum-aware fuzz-testing is done in 3 steps:

  • 1. Pre-processing: locate checksum check points in the program
  • 2. Fuzz-testing: mutate input without touching the checksum

data

  • 3. Post-processing: for a crashing input, rebuild valid checksum

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-16
SLIDE 16

Checksum-awareness

How to locate checksum test in program?

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-17
SLIDE 17

Checksum-awareness

How to locate checksum test in program?

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-18
SLIDE 18

Checksum-awareness

How to locate checksum test in program?

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-19
SLIDE 19

Checksum-awareness

How to locate checksum test in program?

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-20
SLIDE 20

Checksum-awareness

How to locate checksum test in program?

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-21
SLIDE 21

Checksum-awareness

How to locate checksum test in program?

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-22
SLIDE 22

Checksum-awareness

How to locate checksum test in program?

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-23
SLIDE 23

Checksum-awareness

How to fuzz-test knowing the checksum-point?

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-24
SLIDE 24

Checksum-awareness

How to fuzz-test knowing the checksum-point?

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-25
SLIDE 25

Checksum-awareness

Using the checksum locator it is possible to:

◮ Bypass checksum test by modifying the program ◮ Test input on the modified program to find crashing cases

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-26
SLIDE 26

Checksum-awareness

Using the checksum locator it is possible to:

◮ Bypass checksum test by modifying the program ◮ Test input on the modified program to find crashing cases

But how to use those inputs on the real program?

◮ Need to reconstruct valid checksum

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-27
SLIDE 27

Checksum-awareness

Using our previous example: int format int fileSize int width int height ... int checksum void decode_input(File * f){ int recomputed_checksum = checksum(f); int checksum_in_file = get_checksum(f); if (recomputed_checksum != checksum_in_file) exit(); width = get_width(f); ...

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-28
SLIDE 28

Checksum-awareness

Using our previous example: int format int fileSize int width int height ... int checksum void decode_input(File * f){ int recomputed_checksum = checksum(f); int checksum_in_file = get_checksum(f); if (recomputed_checksum != checksum_in_file) exit(); width = get_width(f); ...

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-29
SLIDE 29

Checksum-awareness

Why not use that checksum everytime instead of modifying the program?

◮ In practice, finding back the checksum is more complicated ◮ That step is too expensive to do it thousands of time

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-30
SLIDE 30

Checksum-awareness

So Taintscope is a checksum-aware fuzzing tool:

◮ Detects checksum tests ◮ Bypasses them for fuzz-testing ◮ Corrects input so they can work on original program

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-31
SLIDE 31

Directed fuzzing

Fuzz-testing is expensive

◮ Large size of input ◮ Hundreds or thousands of bytes to mutate ◮ Very likely to generate rejected input

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-32
SLIDE 32

Directed fuzzing

Directed fuzzing allows to find hot bytes in the input, which are:

◮ Are more likely to trigger bugs or crashes ◮ Are less likely to be the cause of rejected input

What is a hot byte?

◮ An input byte that will be used in a security-sensitive call

(such as malloc or strcpy)

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-33
SLIDE 33

Directed fuzzing

How to find hot bytes?

◮ Start from a valid input ◮ Give all byte in the input a unique label ◮ Use a taint-tracer to see where the input bytes are used

If an input byte is used (directly or indirectly) in a sensitive function call, this byte is a hot byte.

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-34
SLIDE 34

Directed fuzzing

Taintscope finds those hot bytes and focuses on them for fuzz-testing. The hot-byte detection can be done simultaneously with the checksum pre-processing step, leading to less overhead.

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-35
SLIDE 35

Evaluation and results

Taintscope was evaluated on real-world applications such as:

◮ Image viewer

◮ Google Picasa ◮ Adobe Acrobat ◮ Image magick

◮ Media Players

◮ MPlayer ◮ Winamp

◮ Web Browsers ◮ libtiff ◮ XEmacs

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-36
SLIDE 36

Evaluation and results

First test on hot bytes identification. Application Input size # Hot bytes Run time ImageMagick (png) 5149 9 1m54s ImageMagick (jpg) 6617 11 1m13s Picasa (png) 2730 18 5m16s Acrobat (png) 770 21 3m8s Acrobat (jpg 1012 13 4m14s

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-37
SLIDE 37

Evaluation and results

Second test on Checksum localization Application # points (1st) # points (2nd) Detected Picasa (png) 830 1 Yes Acrobat (png) 5805 1 Yes TCPDump (pcap) 5 2 Yes Tar 9 1 Yes In practice : Around twenty runs to find the checksum location. Done in tens of minutes.

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-38
SLIDE 38

Evaluation and results

Third test on checksum reconstruction: Format # checksum size time PNG 4 4 271.9 PCAP 8 2 455.6 TAR 3 8 572.8

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-39
SLIDE 39

Evaluation and results

Out of those tests, Taintscope has found 27 severe vulnerabilities in common applications caused by:

◮ Buffer overflow ◮ Integer overflow ◮ Double free ◮ Null pointer dereference ◮ Infinite loop

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-40
SLIDE 40

Conclusion

◮ Only few bytes are hot in most input files, making directed

fuzzing essential in fuzz testing

◮ Taintscope is able to detect checksum check points in

programs, and checksum fields in input

◮ Taintscope is able to automatically create valid input passing

the checksum check

◮ Taintscope can be used on real-world application to find

serious vulnerabilities

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-41
SLIDE 41

Conclusion

However:

◮ Taintscope cannot handle signed inputs.

◮ It can bypass the check and find vulnerabilities ◮ But cannot recreate valid input afterwards

◮ All benefits of directed fuzzing are lost when data is

encrypted, as every input byte will be detected as hot.

◮ Checksum location depends heavily on the availability of

well-formed and malformed inputs

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope

slide-42
SLIDE 42

Questions?

Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Taintscope