FUZZIFICATION : Anti-Fuzzing Techniques Jinho Jung , Hong Hu, David - PowerPoint PPT Presentation

FUZZIFICATION : Anti-Fuzzing Techniques Jinho Jung , Hong Hu, David Solodukhin, Daniel Pagan, Kyu Hyung Lee*, Taesoo Kim * 1

Fuzzing Discovers Many Vulnerabilities 2

Fuzzing Discovers Many Vulnerabilities 3

Testers Find Bugs with Fuzzing Detected bugs Normal users Compilation Released Source binary Testers Compilation Distribution Fuzzing 4

But Attackers Also Find Bugs Detected bugs Normal users Compilation Attackers Released Source binary Testers Compilation Distribution Fuzzing 5

Our work: Make the Fuzzing Only Effective to the Testers Detected bugs Normal users ? Fuzzification Fortified binary Attackers Source Compilation Testers Binary Compilation Distribution Fuzzing 6

Threat Model Detected bugs Normal users Fuzzification Fortified binary Attackers Source Compilation Testers Binary Compilation Distribution Fuzzing 7

Threat Model Detected bugs Normal users Fuzzification Fortified binary Attackers Source Compilation Testers Binary Compilation Distribution Fuzzing Adversaries try to find vulnerabilities from fuzzing 8

Threat Model Detected bugs Normal users Fuzzification Fortified binary Attackers Source Compilation Testers Binary Compilation Distribution Fuzzing Adversaries only have a copy of fortified binary 9

Threat Model Detected bugs Normal users Fuzzification Fortified binary Attackers Source Compilation Testers Binary Compilation Distribution Fuzzing Adversaries know Fuzzification and try to nullify 10

Research Goals Detected bugs Normal users Fuzzification Fortified binary Attackers Source Compilation Testers Binary Compilation Distribution Fuzzing 11

Research Goals Detected bugs Normal users Fuzzification Fortified binary Attackers Source Compilation Testers Binary Compilation Distribution Fuzzing Hinder Fuzzing Reduce the number of detected bugs 12

Research Goals Detected bugs Normal users AFL HonggFuzz Fuzzification QSym Fortified VUzzer binary Attackers … Source Compilation Testers Binary Compilation Distribution Fuzzing Generic Affect most of the fuzzers 13

Research Goals Detected bugs Normal users Fuzzification Fortified binary Attackers Source Compilation Testers Binary Compilation Distribution Fuzzing Low overhead to normal user Overhead High overhead to attackers 14

Research Goals Detected bugs Normal users Fuzzification Fortified Fortified binary binary Attackers Source Compilation Testers Binary Compilation Distribution Fuzzing Resilient to the adversarial analysis Resiliency 15

Why Existing Methods Are Not Applicable? Generic to Low Resilient to Method most fuzzers overhead adversary Packing or obfuscation O X O 16

Why Existing Methods Are Not Applicable? Generic to Low Resilient to Method most fuzzers overhead adversary Packing or obfuscation O X O Bug injection O O X 17

Why Existing Methods Are Not Applicable? Generic to Low Resilient to Method most fuzzers overhead adversary Packing or obfuscation O X O Bug injection O O X Fuzzer detection X O X 18

Why Existing Methods Are Not Applicable? Generic to Low Resilient to Method most fuzzers overhead adversary Packing or obfuscation O X O Bug injection O O X Fuzzer detection X O X Emulator detection X O X 19

Why Existing Methods Are Not Applicable? Generic to Low Resilient to Method most fuzzers overhead adversary Packing or obfuscation O X O Bug injection O O X Fuzzer detection X O X Emulator detection X O X Fuzzification O O O 20

Fuzzification Hinders Advanced Features • Fast execution Parallel execution H/W • Coverage-guidance feature Fork • Hybrid approach server 21

Fuzzification Hinders Advanced Features SpeedBump • Fast execution Parallel execution H/W • Coverage-guidance feature Fork • Hybrid approach server 22

Fuzzification Hinders Advanced Features Coverage • Fast execution Parallel execution H/W • Coverage-guidance feature Fork • Hybrid approach server 23

Fuzzification Hinders Advanced Features Coverage • Fast execution Parallel execution H/W • Coverage-guidance feature BranchTrap Fork • Hybrid approach server 24

Fuzzification Hinders Advanced Features Coverage • Fast execution Parallel execution H/W • Coverage-guidance feature Queue Fork • Hybrid approach server Symbolic execution Dynamic taint analysis 25

Fuzzification Hinders Advanced Features Coverage • Fast execution Parallel execution H/W • Coverage-guidance Anti-Hybrid feature Queue Fork • Hybrid approach server Symbolic execution Dynamic taint analysis 26

SpeedBump: Selective Delay Injection Basic block 27

SpeedBump: Selective Delay Injection • Identify frequently and rarely visited paths Basic block Rarely visited path Frequently visited path 28

SpeedBump: Selective Delay Injection • Identify frequently and rarely visited paths 1 • Inject delays from the most rarely visited edges 2 Basic block Rarely visited path Frequently visited path 29

SpeedBump: Selective Delay Injection • Why this is effective? ▫ User: follows common paths ▫ Attacker: searches for new paths 1 ➔ Impact of delay is more significant to attackers 2 Basic block Rarely visited path Frequently visited path 30

SpeedBump: How to delay? • Strawman: using sleep() ➔ trivially removed by adversary 31

SpeedBump: How to delay? • Strawman: using sleep() ➔ trivially removed by adversary • Counter to advanced adversary ▫ Use randomly generated code ➔ avoid static-pattern 32

SpeedBump: How to delay? • Strawman: using sleep() ➔ trivially removed by adversary • Counter to advanced adversary ▫ Use randomly generated code ➔ avoid static-pattern ▫ Impose control-flow and data-flow dependency ➔ avoid automated analysis 33

SpeedBump: Selective Delay Injection int rarely_executed_code () { return 0; } 34

SpeedBump: Selective Delay Injection int rarely_executed_code () { return 0; } //define global variables int global1 = 1; int global2 = 2; int rarely_executed_code () { //inject delay function int pass = 20; global2 = func (pass); return 0; } 35

SpeedBump: Selective Delay Injection int rarely_executed_code () { int func (int p6) { return 0; int local1[10]; } // affect global1 variable global1 = 45; int local2 = global1; //define global variables for (int i = 0; i < 1000; i++) int global1 = 1; // affect local1 variable int global2 = 2; local1[i] = p6 + local2 + i; int rarely_executed_code () // affect global2 variable { return local1[5]; //inject delay function } int pass = 20; global2 = func (pass); return 0; } 36

BranchTrap Hinders Coverage Management Coverage • Fast execution Parallel execution H/W • Coverage-guidance feature Queue Fork • Hybrid approach server Symbolic execution Dynamic taint analysis 37

BranchTrap#1: Fabricates Input-sensitive Paths “AAAA” 1 2 3 Coverage #1 38

BranchTrap#1: Fabricates Input-sensitive Paths “AAAB” “AAAA” 1 2 3 Coverage #1 Coverage #2 39

BranchTrap#1: Fabricates Input-sensitive Paths “AAAA” “AAAB” “AAAA” 1 1 BranchTrap 2 2 3 3 Coverage #1 Coverage #2 Coverage #1 40

BranchTrap#1: Fabricates Input-sensitive Paths “AAAB” “AAAA” “AAAB” “AAAA” 1 1 BranchTrap 2 2 3 3 Coverage #1 Coverage #2 Coverage #1 Coverage #2 41

BranchTrap#1: ROP-based Fake Paths Generation Func1 ( arg1 , arg2 ) Caller call Func1 next inst Original epilogue pop rbp pop r15 ret 42

BranchTrap#1: ROP-based Fake Paths Generation Code Func1 ( arg1 , arg2 ) snippet 1 pop rbp pop r15 ret Caller Code call Func1 snippet 2 next inst pop rbp pop r15 Original ret epilogue … pop rbp pop r15 Code ret snippet N … 43

BranchTrap#1: ROP-based Fake Paths Generation Code Func1 ( arg1 , arg2 ) snippet 1 pop rbp ① pop r15 ② index = arg1 ^ arg2 ret Caller Code call Func1 snippet 2 next inst pop rbp pop r15 Original ret epilogue … pop rbp pop r15 Code ret snippet N … 44

BranchTrap#1: ROP-based Fake Paths Generation Code Func1 ( arg1 , arg2 ) snippet 1 pop rbp ① pop r15 ② index = arg1 ^ arg2 ret Caller ③ ④ Code jmp table [index] call Func1 snippet 2 next inst pop rbp pop r15 Original ret epilogue … pop rbp pop r15 Code ret snippet N … 45

BranchTrap#1: ROP-based Fake Paths Generation Code Func1 ( arg1 , arg2 ) snippet 1 pop rbp ① pop r15 ② index = arg1 ^ arg2 ret Caller ③ ④ Code jmp table [index] call Func1 snippet 2 next inst pop rbp pop r15 ⑤ Original ret epilogue … pop rbp pop r15 Code ret snippet N … 46

BranchTrap#2: Saturate Feedback State • One-time visit makes effect 1 • BranchTrap: 2 ▫ Saturates bitmap data ▫ Prevents coverage recording 3 47

AntiHybrid Hinders Hybrid Fuzzing Coverage • Fast execution Parallel execution H/W • Coverage-guidance feature Queue Fork • Hybrid approach server Symbolic execution Dynamic taint analysis 48