ASI36

Software attacks are extensively hitting the headlines nowadays. This course aims at demystifying them by giving the fundamentals to understand these attacks, what they consist in and how to protect from them. We will mostly focus on software vulnerabilities.

We will cover the following topics:

  • semantics and modelization of low-level languages
  • classical attack and exploitation
  • control-flow integrity techniques
  • MATE attacks and reverse engineering
  • code obfuscation
  • malware: principles and analysis

Lectures

# Date Title
1 2019-01-17 Introduction
2 2019-01-25 Basic attacks & exploitation
3 2019-02-07 MATE, attack & defense
4 2019-02-14 Control-flow integrity
5 2019-02-21 Semantic attacks (program analysis)
6 2019-02-25 Fuzzing
7 2019-02-28 Exam

References

1. Introduction

Description

This introductory session presents an overview of the contents, the issues surrounding security in general, the more restricted issue of analyzing vulnerabilities in low-level code, as well as reminders regarding compilation and code analysis.

Lecture contents

Reading material

2. Basic attacks & exploitation

Description

This session presents basic low-level attack techniques:

  • buffer overflows;
  • heap overflows; &
  • format string exploitation.

Most of the session is allotted to hands-on experimentation.

Lecture contents

Reading material

3. MATE, attack & defense

Description

TBA

4. Control-flow integrity

Description

This session presents three main basic binary exploitation mitigation techniques:

  • stack canaries;
  • data execution prevention; &
  • ASLR.

We will also talk about their limitations and briefly present more advanced control-flow integrity measures that are currently available.

A good part of the session is allotted to hands-on experimentations.

Lecture contents

Reading material

5. Semantic attacks (program analysis)

Description

TBA

6. Fuzzing

Description

An overview of the current state of software fuzzing.

Lecture contents

Reading material

7. Exam

Description

The final exam will contain 2 parts:

  • The presentation of a research article (groups of 2, 20 minutes + questions) – rank the articles from the list in decreasing order and send a message ranking them to the professors; (see list here) ;
  • A mini CTF problem (find the secret key!) and its written solution report (5p. max).

The CTFs are available from https://github.com/rbonichon/asi36-ctf

Presentations (Feb. 28)

Selected article Students Scheduled
Binary Code is not easy Kaori, Willy 9:15
Compiler-Agnostic Function Detection in Binaries Ali, Matthieu 9:45
The Geometry of Innnocent Flesh on the Bone Ignacio 10:15
Hacking Blind François, Louis-Marie 11:00
SoK: (State of) The Art of War: Offensive Techniques in Binary Analysis Benjamin, Cyrielle 11:30
All you Ever Wanted to Know About Dynamic Taint Analysis and Forward Symbolic Execution (but might have been afraid to ask) Pierre, Léo 12:00

Papers