Software Attacks Research Articles

Unveiling metamorphism by abstract interpretation of code properties

Metamorphic code includes self-modifying semantics-preserving transformations to exploit code diversification. The impact of metamorphism is growing in security and code protection technologies, both for preventing malicious host attacks, e.g., in software diversification for IP and integrity protection, and in malicious software attacks, e.g., in metamorphic malware self-modifying their own code in order to foil detection systems based on signature matching. In this paper we consider the problem of automatically extracting metamorphic signatures from metamorphic code. We introduce a semantics for self-modifying code, later called phase semantics, and prove its correctness by showing that it is an abstract interpretation of the standard trace semantics. Phase semantics precisely models the metamorphic code behavior by providing a set of traces of programs which correspond to the possible evolutions of the metamorphic code during execution. We show that metamorphic signatures can be automatically extracted by abstract interpretation of the phase semantics. In particular, we introduce the notion of regular metamorphism, where the invariants of the phase semantics can be modeled as finite state automata representing the code structure of all possible metamorphic change of a metamorphic code, and we provide a static signature extraction algorithm for metamorphic code where metamorphic signatures are approximated in regular metamorphism.

The ultimate control flow transfer in a Java based smart card

Recently, researchers published several attacks on smart cards. Among these, software attacks are the most affordable, they do not require specific hardware (laser, EM probe, etc.). Such attacks succeed to modify a sensitive system element which offers access to the smart card assets. To prevent that, smart card manufacturers embed dedicated countermeasures that aim to protect the sensitive system elements. We present a generic approach based on a Control Flow Transfer (CFT) attack to modify the Java Card program counter. This attack is built on a type confusion using the couple of instructions jsr/ret. Evaluated on different Java Cards, this new attack is a generic CFT exploitation that succeeds on each attacked cards. We present several countermeasures proposed by the literature or implemented by smart card designers and for all of them we explain how to bypass them. Then, we propose to use Attack Countermeasure Tree to develop an effective and affordable countermeasure for this attack.

U-HIPE: hypervisor-based protection of user-mode processes in Windows

We propose a method to protect user-processes against malicious software attacks running an introspection and protection tool (U-HIPE) inside a hypervisor. Our solution is based on hardware virtualization support, imposing “no-write” and/or “no-execution” restrictions on different guest virtual machine’s (VM) memory pages. Protected components include process’ thread stacks, heaps and loadable modules. This way most attempts to execute malicious code in a process are detected and blocked. We propose a method to deal with swappable pages. We inject page-fault exceptions in the guest VM when trying to read swapped-out pages for introspection. We also intercept all swap-in and swap-out events to correctly maintain protection on needed memory pages. We implemented a testing prototype for protecting user-processes in several Microsoft Windows operating systems. Tests we performed proved the effectiveness of our solution against attacks like polymorphic/packed viruses, hook injection and injected code execution. The introduced overhead is acceptable for most applications.

HiPeC — High Performance Cryptographic Service for Heterogeneous Network-on-Chip Systems

We propose a high performance cryptographic co-processor integrated in a heterogeneous multi core system connected through a Network-on-Chip (NoC). Any general purpose processor (GPP) in the system can request cryptographic services by configuring the co-processor to perform en-/decryption using cryptography hardware. The co-processor is fully direct memory access (DMA) enabled, thus all connected components can utilize the en-/decryption functionality while copying data with DMA. In order to separate applications running on different GPPs through different keys, the co-processor features logically partitioned embedded key registers. The proposed approach addresses resistance against attackers which are capable of performing software attacks to obtain cryptographic keys from memory and snooping attacks on external interfaces like memory buses or network controllers. To our best knowledge, our solution is the first attempt to implement a cryptography co-processor for NoC systems offering complete functionality with integrated DMA, embedded key registers, command priority queues, and AES counter mode of operation (CTR) available as a service for all NoC components. The performance of our design is compared with a software-based approach. We demonstrate that the co-processor features over 230-times performance gain showing the value of this flexible hardware based approach.

DESIGN AND IMPLEMENTATION OF THE TPM USER AUTHENTICATION MODEL

The Trusted Computing Group (TCG) has introduced the Trusted Platform Module (TPM) as a solution to assure end users of their privacy and confidentiality. Although the TPM is designed to prevent software attacks, the TPM itself is vulnerable to physical attacks that could enable intruders to gain access to confidential data. In general, the TPM provides an ID and implements a password identification technique to prevent unauthorized users from gaining access to the TPM. The TPM user authentication is carried out by the TPM itself, which exposes the TPM to direct risk as highly skilled intruders can break the authentication line of defence and gain access to the TPM. The process of encrypting and decrypting information, especially when asymmetric algorithms are used, is viewed as a process that consumes time and resources, which decreases the speed of the computer. In order to solve the problems, a TPM User Authentication Model (TPM-UAM) that can provide the TPM with a higher level of security and resistance against physical attacks has been proposed as we proposed in our previous research paper (Alshar’e et al., 2014). The technique is based on biometric authentication to prove the identity of the users and to allow the process of authentication to happen at an independent platform using virtualization that will keep the TPM out of reach until a user is completely verified and approved. The TPM-UAM is able to provide a more satisfactory level of confidence for data and processes that can be rated as highly confidential and private. The model was successfully developed and tested and the results confirmed the model efficiency and ability to secure TPM and all functions have been confirmed to be working perfectly according to what they were designed for. This paper describes the design and implementation of TPM-UAM system based on the proposed authentication model, virtualization has been implemented to create authentication platform to prevent direct interaction with TPM and biometrics has been implemented to verify identities and supervise running TPM, the system testing results in confirming the system functionality and ability to secure and protect TPM.

A Method for Memory Integrity Authentication Based on Bloom Filter

Secure processor architectures can provide secure computing environments. All kinds of applications that need high security should be immune to both physical and software attacks through the secure architectures. Memory integrity verification is a key problem while implementing secure processors. This paper proposed a scheme called IV-BF to ensure data integrity. The scheme is one-level hash structure, and it has three advantages over existing mainstream hash tree based schemes: lower computation overhead, lower space overhead and adjustable level of security. This paper evaluated the overhead and the security of IV-BF and compared it with an efficient integrity checking scheme-BMT. The evaluation result shows that for most benchmarks, the overhead of the IV-BF is lower and the IV-BF has 1%–7% performance improvement than the BMT.

A USER PROTECTION MODEL FOR THE TRUSTED COMPUTING ENVIRONMENT

Information security presents a huge challenge for both individuals and organizations. The Trusted Computing Group (TCG) has introduced the Trusted Platform Module (TPM) as a solution to end-users to ensure their privacy and confidentiality. TPM has the role of being the root of trust for systems and users by providing protected storage that is accessible only within TPM and thus, protects computers against unwanted access. TPM is designed to prevent software attacks with minimal consideration being given toward physical attacks. Therefore, TPM focus on PIN password identification to control the physical presence of a user. The PIN Password method is not the ideal user verification method. Evil Maid is one of the attacking methods where a piece of code can be loaded and hidden in the boot loader before loading TPM. The code will then collects confidential information at the next boot and store it or send it to attackers via the network. In order to solve this problem, a number of solutions have been proposed. However, most of these solutions does not provide sufficient level of protection to TPM. In this study we introduce the TPM User Authentication Model (TPM-UAM) that could assist in protecting TPM against physical attack and thus increase the security of the computer system. The proposed model has been evaluated through a focus group discussion consisting of a number of experts. The expert panel has confirmed that the proposed model is sufficient to provide expected level of protection to the TPM and to assist in preventing physical attack against TPM.

Reversing the operating system of a Java based smart card

Attacks on smart cards can only be based on a black box approach where the code of cryptographic primitives and operating system are not accessible. To perform hardware or software attacks, a white box approach providing access to the binary code is more efficient. In this paper, we propose a methodology to discover the romized code whose access is protected by the virtual machine. It uses a hooked code in an indirection table. We gained access to the real processor, thus allowing us to run a shell code written in 8051 assembly language. As a result, this code has been able to dump completely the ROM of a Java Card operating system. One of the issues is the possibility to reverse the cryptographic algorithm and all the embedded countermeasures. Finally, our attack is evaluated on different cards from distinct manufacturers.

Design and implementation of a malware detection system based on network behavior

AbstractWith the increasing of new malicious software attacks, the host‐based malware detection methods cannot always detect the latest unknown malware. Intrusion detection system does not focus on malware detection, whereas the behavior‐based detection methods still have some difficulties in being deployed in the network layer. This paper presents a malware detection method based on network behavior evidence chains. The proposed new method will detect the specific network behavior characteristics on three different stages as connection establishment, operating control, and connection maintenance. Then a final detection decision will be concluded according to the results detected in the different stages before. A system prototype is implemented to proof concept the proposed malware detection methods. Copyright © 2014 John Wiley & Sons, Ltd.

Security through Diversity: Are We There Yet?

Because most software attacks rely on predictable behavior on the target platform, mass distribution of identical software facilitates mass exploitation. Countermeasures include moving-target defenses in general and biologically inspired artificial software diversity in particular. Although the concept of software diversity has interested researchers for more than 20 years, technical obstacles prevented its widespread adoption until now. Massive-scale software diversity has become practical due to the Internet (enabling distribution of individualized software) and cloud computing (enabling the computational power to perform diversification). In this article, the authors take stock of the current state of software diversity research. The potential showstopper issues are mostly solved; the authors describe the remaining issues and point to a realistic adoption path.

DYBS: A Lightweight Dynamic Slicing Framework for Diagnosing Attacks on x86 Binary Programs

Nowadays, applications are usually large-scale, this making tasks of comprehending and debugging software rather complicated. As a dynamic reduction technique for simplifying programs, dynamic program slicing is an effective and important approach for locating and diagnosing software attacks. However, most of the existing dynamic slicing tools perform slicing at the source code level, but the source code of most software is hard to acquire in practice. In order to cope with this issue, a novel lightweight dynamic slicing framework---DYBS, is proposed for diagnosing attacks on x86 binary programs. During the execution, DYBS first gathers the runtime profile information of the target program. Once the attack is encountered and set as the slicing criterion, the normal execution terminates, and a backward program slicing is started to locate the vulnerabilities. Furthermore, a Function Call Filtration optimization mechanism is proposed to improve the performance of the framework. It is proved in the experiments that DYBS can diagnose software attacks with much lower overhead than many other similar analyzing systems.

Brief Review of Software Security History with an Emphasis on Efforts Focused at Early Stages of the Software Lifecycle

The importance of software security has been profound recently. The main issue during the early efforts of the late 90s was how to counterattack the buffer overflows problem. However, emphasis has recently shifted on how to counterfeit software attacks at the design level starting with the introduction of security patterns. We have qualitatively analyzed the most important security patterns, and quantitatively evaluated software systems based on their design, using fuzzy risk analysis, based on the security patterns they contain and the STRIDE model of attacks. Additionally, we have analyzed the effectiveness of code obfuscation techniques, which we think is a starting point for future research.

Malware detection using augmented naive Bayes with domain knowledge and under presence of class noise

Malicious software (malware) attacks on the internet are on the rise in frequency and sophistication. Malware detection based on its content can detect malware more accurate because it relies on screening the payload for known malware signatures. New malware variants still exhibit prevalent contents that can be detected by looking at fixed substrings especially when using n-grams and machine learning technique. This paper focuses on detecting malware based on content classification technique that is augmented with domain knowledge (Snort signatures) to abridge features set and improve detection accuracy. Using 15 days dataset, the generated naive Bayes model with domain knowledge using the most descriptive 91,127 features shows the lowest false negative (around 2%). However, the presence of class noise has a significant impact on the results, even for machine learning technique augmented with domain knowledge.

Malware Detection Using Data Mining Techniques

Nowadays, malicious software attacks and threats against data and information security has become a complex process. The variety and number of these attacks and threats has resulted in providing various type of defending ways against them, but unfortunately current detection technologies are ineffective to cope with new techniques of malware designers which use them to escape from anti-malwares. In current research, we present a combination of static and dynamic methods to accelerate and improve malware detection process and to enable malware detection systems to detect malware with high precision, in less time and help network security experts to react well since time detection of security threats has a high importance in dealing with attacks.

Bringing strong authentication and transaction security to the realm of mobile devices

Widespread usage of mobile devices in conjunction with malicious software attacks calls for the development of mobile-device-oriented mechanisms aiming to provide strong authentication and transaction security. This paper considers the eBanking application scenario and argues that the concept of using a trusted companion device can be ported to the mobile realm. Trusted companion devices involve established and proven techniques in the PC (personal computer) environment to secure transactions. Various options for the communication between mobile and companion devices are discussed and evaluated in terms of technical feasibility, usability, and cost. Accordingly, audio communication across the 3.5-mm audio jack--also known as tip-ring-ring-sleeve, or TRRS connector,--is determined to be quite appropriate. We present a proof-of-concept companion device implementing binary frequency shift keying across this interface. Results from a field study performed with the proof-of-concept device further confirm the feasibility of the proposed solution.

Software tamper resistance based on function-level control-flow monitoring

Software tamper resistance is an important method for software protection. Concerning the control-flow tampering invoked by buffer overflow as well as some other software attacks, a software tamper-proofing method based on Function-Level Control-Flow( FLCF) monitoring was proposed. This method described the software's normal behaviors by FLCF and instrumented one guard at every entrance of functions by binary rewriting technology. The monitoring module decided whether the software was tampered or not by comparing the running status received from the guards' reports with the expected condition. A prototype system was realized and its performance was analyzed. The experimental results show that this method can effectively detect the control-flow tampering with less overhead and no false positives. It can be easily deployed and transplanted as its implementation does not need source code or any modifications of underlying devices, and system security is strengthened by isolating the monitoring module with the software being protected.

An Improved Secured Client Authentication to Protect Software against Piracy

protection and security plays a vital role to the business and commercial organizations. Various techniques has been proposed to enhance the security of the client's system to authenticate the software against piracy protection. Various software attacks like hardware cloning, software cloning ,software cracking, virus scripts provides high influence on economic development. So it is necessary to develop an enhanced framework to protect software systems against piracy. Existing approaches provide solutions against using smart cards or internet based secured user authentication mechanisms. Existing literature work mainly provides solutions to software piracy against different attacks. But existing approaches doesn't protect software's through reverse engineering or hardware cloning threats. This paper proposed a framework which can be used to protect piracy against hardware piracy. Experimental results shows proposed approach provides better software protection against existing smart card based techniques. KeywordsProtection, Authentication, Hashing, Internet, Piracy.

Design on Virtual Machine Frame of Cloud Computing Platform

In the framework of the virtual machine can be well applied to cloud computing platforms such as multi-level security environment for guest virtual machines and communication between the fine-grained access control to prevent malicious software attacks and the spread between the guest virtual machine. This paper presents a set of virtual machines framework for assurance in the cloud computing software services in the guest virtual machines user-level application security.

Research on Computer Network Security Architecture of Universities in China

With the development of network, the computer systems of universities in China gradually use network management and services. However, in network the system faces security threats like virus, malicious software and human attack, which may cause data damage, missing and stealing of confidential documents, or even lead to the breakdown of network system. Therefore, it is important to promote the security of computer network systems of universities. This paper gives the comprehensive analysis on the security system of computer network systems of universities in China, analyzes the factors easily leading to the security and provides suggestions and reference for network construction.

Novel Secure Code Encryption Techniques Using Crypto Based Indexed Table for Highly Secured Software

Software security has become one of the active areas of research due to various cyber threats and attacks that can be very dangerous. The main goals of software protection are Intellectual property protection, Protection beside function investigation in mobile environments, Protection beside illegal copy and use of software. Software security is dependent on both security code and software protection. Various techniques have been developed to deal with the software threats and attacks. However, the available software protection approaches in the literature do not offer trustworthy security in all the scenarios. In recent years, cryptographic techniques are observed to be very efficient in dealing with a number of software threats and attacks. Code encryption has received much attention in the field of software security. This paper proposes novel software protection code encryption schemes based on the index table. This approach uses three novel and efficient encryption techniques namely quasigroup encryption, quasi group encryption with transformation and KIST approach