ASI36 — Analyse de vulnérabilité (2021)

Overview of the contents, the issues surrounding security in general, the more restricted issue of analyzing vulnerabilities in low-level code, as well as reminders regarding compilation and code analysis.

Materials :: Slides-I · Slides-II

References

• Mind Your Languages
• wtfjs
• Some thoughts on security after ten years of qmail 1.0
• Undefined Behavior: What happened to My Code?
• Reflections on Trusting Trust

Basic low-level attack techniques: buffer overflows, heap overflows, format string exploitation. Most of the session is allotted to hands-on experimentation.

Materials :: Slides · Exercises · Tarball

References

• How to write Buffer Overflows
• Smashing The Stack For Fun And Profit
• Microcorruption
• 80x86 CodeTable
• X86 opcode/instruction reference
• Intel full ISA reference
• w00w00 on Heap Overflows
• Hacking: The Art of Exploitation (Jon Erickson) — Ch. 0x200 & 0x300
• Low-level Software Security by Example
• Reverse Engineering for Beginners
• Reverse Engineering Course (in progress)

Discussion of the Man-At-The-End (MATE) scenario — an attack model where attackers are very powerful since they basically are on your computer: read/write code, execute it step-by-step, patch on the fly. Current state of known attacks and defenses; overview of this research area.

Materials :: Slides

Three main basic binary exploitation mitigation techniques:

• stack canaries
• data execution prevention
• ASLR

We will also discuss their limitations and briefly present more advanced control-flow integrity measures currently available. Hands-on experiments included.

Materials :: Slides · Exercises · Tarball

References

• Exploiting OpenBSD
• Stack Smashing as of Today
• Bypassing PaX ASLR Protection
• The Frame Pointer Overwrite
• Bypassing StackGuard and StackShield
• Practical Control-Flow Integrity & Randomization for Binary Executables
• Enforcing Forward-Edge Control-Flow Integrity in GCC & LLVM
• The Geometry of Innocent Flesh on the Bone
• Framing Signals — A Return to Portable Shellcode
• ASLR Smack & Laugh Reference
• Bad Binder: Android In-The-Wild Exploit
• Preventing zero-day exploits of memory vulnerabilities with guard lines
• Smashing the Stack in 2011

TBA.

Overview of the current state of software fuzzing. Fuzzers have gained tremendous traction recently as automatic tools to find bugs. We will present the basics, an overview of recent results, and devote a good amount of time to hands-on experiments with the AFL fuzzer.

Materials :: Slides · Exercises · Tarball

References

• Driller: Augmenting Fuzzing Through Selective Symbolic Execution
• Angora: Efficient Fuzzing by Principled Search
• VUzzer: Application-aware Evolutionary Fuzzing
• AFL homepage
• Directed Greybox Fuzzing
• FairFuzz: A Targeted Mutation Strategy for Increasing Greybox Fuzz Testing Coverage
• A list of recent results on fuzzing
• The Fuzzing Book

The final exam will contain 2 parts:

• The presentation of a research article (groups of 2, 20 minutes + questions) — rank the articles from the list in decreasing order and send a message ranking them to the professors.
• A mini CTF problem (find the secret key!) and its written solution report (10 p. max).

CTFs available at https://github.com/rbonichon/asi36-ctf/tree/ctf-2020-2021

Deadline for CTF reports: April 2, 2021.

References

• Not All Coverage Measurements Are Equal: Fuzzing by Coverage Accounting for Input
• Transparent ROP Exploit Mitigation using Indirect Branch Tracing
• Weird Machines in ELF
• Q: Exploit Hardening Made Easy
• Towards Paving the Way for Large-Scale Windows Malware Analysis: Generic Binary Unpacking
• Function Boundary Detection in Stripped Binaries
• Grey-box Concolic Testing on Binary Code
• Symbolic execution with SymCC: Don't interpret, compile!
• ContractFuzzer: Fuzzing Smart Contracts for Vulnerability Detection