Trustworthy Systems from Un-Trusted Components http://www.comp.nus.edu.sg/~tsunami PRESENTED BY PROF. ABHIK ROYCHOUDHURY NATIONAL UNIVERSITY OF SINGAPORE ABHIK@COMP.NUS.EDU.SG
Enhancing local Ongoing NRF Project Overall capabilities Outlook Education – NUS (Bachelors in Infosec) Vulnerability Binary Discovery Hardening Industry Agency Collaboration Collaboration Data Verification Protection Research Outputs – Publications, Tools, Academic Collaboration, Exchanges, Seminars, Workshops 2
Project Highlights Usage and Research impact ◦ Integration to widely used tools like AFL with active user groups ◦ DARPA CGC binaries – finds crashes faster >10 times ◦ Integrated into the most widely used security testing tool ◦ Angelix tool on automated program repair ◦ Security Vulnerabilities remain un-patched for long …. Research Visibility ◦ Invited talks at Summer School on Information Security and many other venues ◦ IEEE Innovation Spotlight 2018 from among all IEEE article. Educational Impact ◦ Degree Program in Infosec at NUS started concurrently ◦ Modules being created using outcomes of the project ◦ Hands-on CTF education in existing classes using project outcomes. 3
Highlights Scholarly Impact ◦ High-citation trend ◦ Data oriented programming, April 2016 [FWCI 22.89] ◦ Angelix paper on automated program repair, May 2016 [FWCI 26.09] ◦ Home run papers with field weighted citation impact > 20 ◦ Dagstuhl work-shop on Automated Repair organized – January 2017 ◦ Recent Invited talks ◦ Distinguished Lecture at Luxembourg S&T center, January 2017 ◦ KLEE workshop on Symbolic Execution, April 2018 ◦ 9 th International Summer School on Information Security and Protection July 2018 ◦ https://cs.anu.edu.au/cybersec/issisp2018/ ◦ Publications: CCS, NDSS, Usenix Security, S&P, ICSE, FSE 4
Sample Technologies from TSUNAMi AFLGo — 1st directed greybox fuzzer AFLFast — 10x faster than AFL ◦ 17 CVEs @ US National Vulnerability Database ◦ 1 st place @ Hackernews ◦ 2 nd place @ DARPA CGC (Team Codejitsu) ◦ 39 bugs @ security-critical internet libraries (libxml) ◦ 6 CVEs @ US National Vulnerability Database (initial count ◦ 41 stars @ Github (9 forks) only during publication) ◦ 180 stars @ Github (+90 forks) ◦ Outperforms state-of-the-art in patch testing (KATCH) ◦ 2000 USD @ Google Security bug bounties ◦ Outperforms state-of-the-art in crash reproduction (BugRedux) ◦ Integrated into main-line AFL LowFat — Efficient Binary Hardening Detects stack/buffer overflows and type confusion attacks 17% performance overhead (vs. 45% state-of-the-art) 12% memory overhead (vs. 700% state-of-the-art) Integrated with AFLFast and AFLGo to detect more vulnerabilities more efficiently ! 1 PRESENTATION TO NRF EXPERT PANEL, FEB 23, 2018 5
Secure Smart Nation Infra-structure Certification of software for IoT devices in smart home, smart health, robots/drones Focus on environment aware functionality certification, but also weave in non-functional properties Capabilities for such certification exist in NUS, and some partnerships for translation, but more may be needed. 6
TSUNAMi project TSUNAMi Project ◦ Reactive Software Security (WP1) ◦ Automated Vulnerability Detection ◦ Automated Vulnerability Repair ◦ Proactive Software Security (WP2 + WP3) ◦ Automated Hardening ◦ Automated Protocol Verification ◦ Assuming Compromised Operating System (WP4) ◦ Ensuring Secure Application Execution
WP1: Binary Analysis
AFLGo: Directed Greybox Fuzzing • Directed Fuzzing as an optimization problem (No constraint solving ) • Program analysis moved to instrumentation time to retain efficiency of greybox fuzzing. • Distance to targets efficiently computed at runtime. • Find global minimum using search meta-heuristic – Simulated Annealing • Results: outperforms KATCH and BugRedux. 17 CVEs assigned • Application: patch testing, crash reproduction, information flow analysis [CCS’17]
AFLFast: Coverage-based Greybox Fuzzing • Model Greybox Fuzzing as Markov chain • Design power schedules to regulate the “ energy ” to gravitate path exploration towards low-frequency paths • Results & Impact • 10x faster than the state of the art Received 2000 USD @Google bug bounty • Outperforms KLEE on vulnerability detection • 2nd place (on vulnerability detection) @DARPA CGC (Team Codejitsu) • 6 CVEs [CCS’16, TSE’18]
Bucketing Failing Test via Symbolic Analysis • Point-of-failure and Call-stack based Bucketing do not take program semantics into account leading to over-condensing, send-bucket and long- tail problems b1 b2 • Our symbolic analysis based solution Culprit constraint b3 • Identify culprit constraint • Use culprit constraint as semantic “reason” of failure b4 p1 • Group failing paths having same “reason” together b5 x x x f4 f3 f2 f1 [FASE’17]
Automated Program Repair User-defined condition: length = 3 & a[0] < a[1] < a[2] 1 int search(int x, int a[], int length) { 1 int search(int x, int a[], int length) { 2 int i; 2 int L = 0; 3 for (i=0; i<length; i++) { 3 int R = length-1; 4 if (x == a[i]) 4 do { 5 return i; 5 int m = (L+R)/2; 6 } 6 if (x == a[m]) { 7 return −1; 7 return m; 8 } 8 } else if ( x < a[m] ) { // bug fix: x > a[m] 9 L = m+1; (a) Correct linear search 10 } else { 11 R = m-1; 12 } 13 } while (L <= R); Verification condition 14 return -1; 15 } Experiments on embedded Linux Busybox (b) Buggy binary search 12
SemGraft (ICSE18) Symbolic Negate No analysis Verification Patch found Buggy program Is SAT? condition Yes Reference Candidate Counterexample program patch Buggy program Yes Is SAT? Is SAT? Yes Angelic Component forest library 13
WP2: Binary Hardening
EffectiveSan: Dynamically Typed C/C++ • EffectiveSan is a comprehensive dynamic type checker for C/C++ programs • Key observation: most C/C++ vulnerabilities are type errors: • EffectiveSan directly detects the following classes of error: • Type errors (type confusion, bad casts, etc.) • Bounds errors (buffer overflows, etc.) • Sub-object bounds errors (overwriting vptrs, etc.) • Use-after-free, reuse-after-free, and double free errors [PLDI’18]
How EffectiveSan Works • EffectiveSan stores meta data (META) at the base of all objects • Given p into object q, use low-fat pointer base(p) to find (META) LOW FAT • (META) stores the dynamic type which is checked at runtime [PLDI’18]
WP3: Formal Verification
Communication as protocol • The interaction between components is termed as protocols • E.g., Single-Sign-On (SSO) protocol: the communication among a browser, a web server and a website using SSO service Username&password Access token Identity Provider (IdP) Access token A.com login User (Client)
Communication as protocol • Developed a framework to extract protocols from messages and perform formal analysis • Protocol extraction Modelling Protocol SDK Security Attacker Extraction Analysis • Protocol modelling Property Model Network Protocol • Model verification Traces Fuzzing Repeat Refined Protocol • Result confirmation Refinement Protocol Refine Modelling Finished? N Y Model Report Formal Report Analysis Verification Confirmed Reconstruct Attacker vulnerability Attack Model Analysis Verification
Formal verification of protocols • Formal verification of the communication/protocols are necessary • Protocols, especially security protocols, are error-prone • Model checking based on PAT (Process Analysis Toolkit) • Protocol: CSP# model • Security properties: assertions or LTL • Built a PAT library for modelling cryptographic primitives and reasoning on attacker knowledge bounded sessions [ICFEM‘17]
Formal verification of protocols • Verification of security protocols with unbounded sessions • Stateful security protocols - global states which influence the protocol behavior and may unboundedly evolving • Developed a specification framework based on horn clauses • Developed a verification algorithm for verifying stateful security protocols with unbounded evolving of global states Represent as horn Deduction of a Reasoning Stateful protocol Result clauses with states targeted rule change Knowledge forward • YES protocol search for the attacker state OR State backward search to influence • Verification Specification find a valid evolving trace NO Algorithm Framework [ICFEM‘17]
WP4: Sensitive Data Protection
Constant Latency Read-Only ORAM Secret User Online queries Behavior § Leakage via data access patterns is common keys Encrypted Encrypted Peer-to-peer/ Cloud Storage RAM Distributed system § Oblivious RAM incurs at best O(log N) overhead for read/write accesses RQ: Can we achieve “constant latency” for specific case in real applications? § Key Insight: For read-only data, shuffle & access steps can be parallelized PDFs § Our Approach: With √N trusted hardware (SGX) cores on the server Videos § Distribute work in each shuffle step to multiple threads § This matches the rate of access and shuffle operations Photos § Result: Constant latency with sufficient computational cores (80 threads) § 0.3 seconds to fetch a block of 256 KB Music
Recommend
More recommend
