SECFUZZ: Fuzz-testing Security Protocols Petar Tsankov, Mohammad - PowerPoint PPT Presentation

SECFUZZ: Fuzz-testing Security Protocols Petar Tsankov, Mohammad Torabi Dashti, David Basin ETH Zurich

Motivation Input universe Invalid inputs Well-formed inputs Security protocol implementation Abnormal behaviors Behaviors May expose vulnerabilities 19.09.2015 Institute of Information Security / ETH Zurich 2

Fuzz-testing Security Protocols Collect well-formed inputs  Internet Step 1  Source code (white-box)  Model (model-based) Mutate the inputs Step 2  Fuzz operators Execute the inputs and check for failures Step 3  E.g. memory errors, broken invariants 19.09.2015 Institute of Information Security / ETH Zurich 3

Challenges Responder Initiator KE A , N A Fresh KE A , N A KE B , N B Fresh KE B , N B Enc(K, Auth) Compute key K = Hash(KE A , KE B , Secret) ... Challenges:  Encrypted messages  Security protocols are stateful  Messages are non-replayable 19.09.2015 Institute of Information Security / ETH Zurich 4

System Under SecFuzz: Setting Test Initiator Responder Dynamic analysis Fuzzer Log file Key advantages:  Light-weight and modular approach  Fresh messages  Fuzzer can decrypt messages 19.09.2015 Institute of Information Security / ETH Zurich 5

Input Mutation A fuzz operator:  Mutates a well-formed input.  The mutated input is likely to expose vulnerabilities. The fuzz operators should produce mutated inputs that expose common programming mistakes. 19.09.2015 Institute of Information Security / ETH Zurich 6

Input Structure An input consists of:  a sequence of messages  a message consists of fields 19.09.2015 Institute of Information Security / ETH Zurich 7

Fuzz operators  Message fuzz operators  Insert random (well-formed) message  Field fuzz operator  Insert random field  Remove field  Duplicate field  Modify field 19.09.2015 Institute of Information Security / ETH Zurich 8

Fuzz-testing Security Protocols Collect well-formed inputs  Internet Step 1  Source code (white-box)  Model (model-based) Mutate the inputs Step 2  Fuzz operators Execute the inputs and check for failures Step 3  E.g. memory errors, broken invariants 19.09.2015 Institute of Information Security / ETH Zurich 9

Detecting vulnerabilities SUT Initiator Responder Dynamic analysis Fuzzer Log file  The dynamic analysis monitors the SUT and reports failures.  Memory errors are a common source of vulnerabilities:  Tools: Valgrind's Memcheck, IBM's Purify 19.09.2015 Institute of Information Security / ETH Zurich 10

Internet Key Exchange Case Study Experiment 1 Test subject: OpenSwan v2.6.35 Results: Discovered a previously unknown use-after-free vulnerability. Experiment 2 Test subject: ShrewSoft's VPN Client for Windows v2.1.7 Results: Discovered a previously unknown unhandled exception vulnerability . 19.09.2015 Institute of Information Security / ETH Zurich 11

SUT Fuzz-testing OpenSwan OpenSwan OpenSwan (responder) (initiator) Valgrind SecFuzz Log file  SUT: OpenSwan v2.6.35  A popular IPSec implementation for Linux.  Dynamic analysis: Valgrind's Memcheck  Detects different types of memory access errors.  Fuzzer: SecFuzz , implemented using Python / Scapy. 19.09.2015 Institute of Information Security / ETH Zurich 12

OpenSwan: IKE Implementation details SUT Initiator Responder Phase 1 Phase 1 state Propose SAs Crypto Access helper Done Accepted SA Ack SA established 19.09.2015 Institute of Information Security / ETH Zurich 13

OpenSwan: Use-after-free Vulnerability SUT Initiator Responder Invalid memory access Phase 1 Freed Phase 1 Memory state Propose SAs Crypto Access helper Close Session The vulnerability was reported and a security patch was released in CVE-2011-4073. 19.09.2015 Institute of Information Security / ETH Zurich 14

ShrewSoft's VPN Client: Unhandled Exception SUT Initiator Responder Propose SAs Accepted SA KE I : ”0123”, N I KE R : “\0”, N R Unhandled exception The vulnerability details will appear in CVE-2012-0784. 19.09.2015 Institute of Information Security / ETH Zurich 15

Related Approaches Key Requirements:  Stateful exploration  Encryption handling Approach Model-based White-box SecFuzz Task Generate inputs Needs a model Needs the Needs a running source code implementation Execute inputs Concretization Solve crypto Immediate constraints 19.09.2015 Institute of Information Security / ETH Zurich 16

19.09.2015 Institute of Information Security / ETH Zurich 17