information hiding in program binaries rakan el-khalil xvr xvr net

50
Information Hiding in Program Binaries Rakan El- Khalil xvr xvr

Post on 19-Dec-2015

218 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Information Hiding in Program Binaries

Rakan El-Khalil

xvr xvr net

Page 2: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Warning:

Steganography vs. Stenography.

Page 3: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Intro

Information hiding overview Theoretical aspects of Software marking In practice… Applications

Page 4: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Types of Information Hiding

Steganography Covert channels Anonymity Copyright marking

Robust marks Fingerprinting Watermarking [imperceptible or visible]

Fragile marks

Page 5: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

General Methods

Security through obscurity Mostly used historically Sometimes used today

Camouflage Hiding in plain sight Hiding the location of the embedded data

Spreading the hidden information

Page 6: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Strength Evaluation

Data-Rate Stealth Resilience

Page 7: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Attacks

Subtractive

Distortive

Additive

w

Page 8: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Attacks

Subtractive

Distortive

Additive w

Page 9: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Attacks

Subtractive

Distortive

Additive w w’

Page 10: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Attacks

Subtractive

Distortive

Additive w w+w’

w’

Page 11: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Mediums

Sound Image Video Text Relational Databases Sets of Numbers Etc…

Page 12: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Binary Info Hiding Overview

Low redundancy medium Static marks Dynamic marks

Page 13: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Static Data Marks

char mark[] = “All your base…” switch (a) {

case 1: return “are”;case 2: return “belong”;case 3: return “to us”;

…}

Etc…

Page 14: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Static Code Marks

{int gonads, strife;

gonads = 1;strife = 1;printf (“weeeeee”);

}

{int gonads, strife;

printf (“weeeeee”);gonads = 1;strife = 1;

}

Page 15: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Static Code Marks [cont.]…

if(…) goto a

if(…) goto d

if(…) goto d

if(…) goto b

a

b

c

d

Page 16: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Static Code Marks [fin.]

Pro: easy to implement Con: easy to break.

Page 17: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Dynamic Marks

Mark stored in program’s execution state Types of marks:

Data structure Execution trace Easter egg

Page 18: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Easter Egg

Page 19: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Dynamic Data StructureVar[0] = 0x01010101; Var[1] = 0x03030303;Var[2] = 0x02020202; Var[3] = 0x04040404;

Var[0] = 0x54686520; Var[1] = 0x47726561;Var[2] = 0x74204d61; Var[3] = 0x68697200;

Op1

OpN

“The Great Mahir”

Input1

InputN

Page 20: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Dynamic Graph Watermarking

Generate a number n = P x Q Watermark is the graph topology Eg: Radix-5 encoding

2•54 + 0•53 + 3•52 + 2•51 + 2•50

= 7*191 = 1337

4 3 2 1 0

Page 21: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Dynamic Execution Trace

80480d3: 85 db test %ebx,%ebx 80480d5: 7e 29 jle 0x8048100 80480d7: 83 7d 08 00 cmpl $0x0,0x8(%ebp) 80480db: 74 23 je 0x8048105 80480dd: 8b 45 08 mov 0x8(%ebp),%eax 80480e0: a3 40 bc 08 08 mov %eax,0x808bc40 80480e5: 80 38 00 cmpb $0x0,(%eax)

… …

8048100: b8 00 00 00 00 mov $0x0,%eax 8048105: 85 c0 test %eax,%eax 8048107: 74 0c je 0x8048115 8048109: 83 c4 f4 add $0xfffffff4,%esp

Page 22: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Attacks

Semantics preserving transformations

{ char c1, c2, c3; c1 = ‘u’; c2 = ‘n’; c3 = ‘f’;}

char c1, c2, c3;int i;for (i=1; i <= 3; i++) { switch (i) { case 1:

c1 = ‘u’ - 2; break; case 2:

c2 = ‘n’ - 1;c1++; break;

case 3:c3 = ‘f’;c1++; c2++; break;

}}

Page 23: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Attacks on Dynamic Marking

Add extra pointers Rename and reorder fields Add levels of indirection

Page 24: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

In Practice…

Difference between bytecode [Java, .Net, etc] and machine code [x86 asm].

Data vs. Code Problem.

Page 25: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

In Practice

Can’t use advanced techniques. Little work done on machine code watermarking.

Page 26: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Virus Intro

Virus Code

ProgramEntry Point

Control Hijacking

Control Return

Page 27: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Virus Code Obfuscation

Encrypted Fixed decryption routine Changing virus body

Polymorphic Mutation engine that randomizes decryption routine

Metamorphic No decryptor Randomizes its code

Page 28: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Metamorphic Tricks

Register Swapping:

89 c4 mov %eax,%eax80 3e 2f cmpb $0x2f,(%esi)75 09 jne 0x80480fa8d 52 01 lea 0x1(%esi),%ebx46 inc %esi80 3e 00 cmpb $0x0,(%esi)

89 f6 mov %esi,%esi80 38 2f cmpb $0x2f,(%eax)75 09 jne 0x80480fa8d 48 01 lea 0x1(%eax),%ecx40 inc %eax80 38 00 cmpb $0x0,(%eax)

Page 29: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

More Tricks

Instruction substitutions Changing of data values Nop and garbage insertions Branch reversals Alternate opcode encodings …

Page 30: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Hydan

Generic information hiding tool Works with instruction substitution

Page 31: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Hydan Demo

Page 32: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Example Substitutions

83 c0 40: add %eax, $0x40

83 c0 40: add %eax, $0x4083 e8 c0: sub %eax, $-0x40

85 c0: test %eax, %eax

85 c0: test %eax, %eax09 c0: or %eax, %eax0b c0: or %eax, %eax21 c0: and %eax, %eax

01

011011

00

Page 33: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Hydan Examples [cont.]

Embed 0100 into a listing:

83 c4 10 add %esp,$0x1021 c0 and %eax,%eax74 10 je 0x804cbc083 ec 04 sub %esp,$0x450 push %eax

83 c4 10 add %esp,$0x10ob c0 or %eax,%eax74 10 je 0x804cbc083 c4 fc add %esp,$-0x450 push %eax

010

0

Page 34: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Extra Security Techniques

Message Whitening: ASCII text easily recognizable Text encrypted with Blowfish in CBC mode Length masked with SHA hash of password

Page 35: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Random Walk:

Page 36: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Flag Collision Detection:

Some ‘equivalent’ instructions set flags differently: Eg: add vs. sub

What to do? Scan forwards.

xorl %eax, %eaxaddl $0xffffff, %eax

xorl %eax, %eaxsubl $0x1, %eax

%eax: -1, OF = 0, CF = 0

%eax: -1, OF = 0, CF = 1

Page 37: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Codebook Embedding:

Build a codebook of equivalent instructions: 2 insns --> 1 bit 4 insns --> 2 bits 8 insns --> 3 bits

What happens if we have 7 insns? Encoding Rate:

{ log2(N): N is a power of 2

log2(N-1) : otherwise

Page 38: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Hydan Issues

Detectable Instructions are not created equal

Low bandwidth 1/110 vs. Outguess’ 1/17

Easy to tamper with Breaks SMC

Page 39: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Statistics

Page 40: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Future Work: Reordering

Given a list of n objects: Can embed: floor [ log2(n!) ] bits:

N Bits

2 1

4 4

8 15

16 44

32 117

64 295

Page 41: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

0

100

200

300

400

500

600

700

0 4 8 12 16 20 24 28 32 36 40 44 48 52 56 60 64 68 72 76 80 84 88 92 96100104108112116

N

NLog2(N!)

Page 42: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Reordering Method

How does one encode data with an ordering? Eg: n = 3:

000 abc001 acb010 bac011 bca100 cab101 cba

Page 43: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Encoding Algorithm

More specifically: floor [ log2(n!) ] bits of input Take input and decompose it along its factorials. Each factor represents the index of item in the sorted

substring.

Eg: n = 4, input = 110110 Floor [ log2(4!) ] 4bits First 4 bits: 1101 == 13 Decomposition: 13 == 2*3! + 0*2! + 1*1! Resulting string: abcd cabd cabd cadb

Page 44: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Decoding Algorithm

Similarly: floor [ log2(strlen(input)!) ] bits of output Take input string and decompose it along its factorials. Each factor represents the index of item in the sorted

substring.

Eg: input = cadb Floor [ log2(4!) ] 4bits Decomposition: 2*3! + 0*2! + 1*1! == 13 Result: 1101

Page 45: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Reorderables

What can be reordered? Functions Independent instructions Arguments Register allocation Data …

Page 46: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Instruction Reordering

mov $2, %eaxmov $3, %ebxpush %ecxcall $0x8056213

mov $2, %eaxmov $3, %ebxpush %ecx

mov $2, %eaxpush %ecxmov $3, %ebx

mov $3, %ebxmov $2, %eaxpush %ecx

mov $3, %ebx push %ecxmov $2, %eax

push %ecxmov $2, %eaxmov $3, %ebx

push %ecxmov $3, %ebxmov $2, %eax

000 001 010 011 100 101

Page 47: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Instruction Reordering Problem

mov $2, %eaxmov $3, %ebxpush %ecx

call $0x808000

Page 48: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Insn Reordering Prob [cont]

Need to use a VM to emulate: All Execution paths Stack Heap

Page 49: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Uses

Traditional info hiding Security Polymorphism

Page 50: Information Hiding in Program Binaries Rakan El-Khalil xvr  xvr  net

Conclusion + QA