FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop...

65
FUZZIFICATION: Anti-Fuzzing Techniques Jinho Jung , Hong Hu, David Solodukhin, Daniel Pagan, Kyu Hyung Lee*, Taesoo Kim * 1

Transcript of FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop...

Page 1: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

FUZZIFICATION: Anti-Fuzzing Techniques

Jinho Jung, Hong Hu, David Solodukhin, Daniel Pagan,

Kyu Hyung Lee*, Taesoo Kim

*

1

Page 2: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Fuzzing Discovers Many Vulnerabilities

2

Page 3: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Fuzzing Discovers Many Vulnerabilities

3

Page 4: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Testers Find Bugs with Fuzzing

Source

Compilation

Released

binary

Normal users

Testers

Detected

bugs

Compilation Distribution Fuzzing

4

Page 5: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

But Attackers Also Find Bugs

Source

Compilation

Released

binary

Testers

Detected

bugs

Compilation Distribution Fuzzing

5

Attackers

Normal users

Page 6: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Our work: Make the Fuzzing Only Effective to the Testers

Source

Fuzzification

Compilation

Fortified

binary

Binary Testers

Detected

bugs

Attackers

Compilation Distribution Fuzzing

6

Normal users

?

Page 7: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Threat Model

Source

Fuzzification

Compilation

Fortified

binary

Binary Testers

Detected

bugs

Attackers

Compilation Distribution Fuzzing

7

Normal users

Page 8: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Threat Model

Source

Fuzzification

Compilation

Fortified

binary

Binary Testers

Detected

bugs

Attackers

Compilation Distribution Fuzzing

8

Normal users

Adversaries try to find vulnerabilities from fuzzing

Page 9: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Threat Model

Source

Fuzzification

Compilation

Fortified

binary

Binary Testers

Detected

bugs

Attackers

Compilation Distribution Fuzzing

9

Normal users

Adversaries only have a copy of fortified binary

Page 10: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Threat Model

Source

Fuzzification

Compilation

Fortified

binary

Binary Testers

Detected

bugs

Attackers

Compilation Distribution Fuzzing

10

Normal users

Adversaries know Fuzzification and try to nullify

Page 11: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Research Goals

Source

Fuzzification

Compilation

Fortified

binary

Binary Testers

Detected

bugs

Attackers

Compilation Distribution Fuzzing

11

Normal users

Page 12: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Research Goals

Source

Fuzzification

Compilation

Fortified

binary

Binary Testers

Detected

bugs

Attackers

Compilation Distribution Fuzzing

12

Normal users

Hinder Fuzzing Reduce the number of detected bugs

Page 13: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Research Goals

Source

Fuzzification

Compilation

Fortified

binary

Binary Testers

Detected

bugs

Attackers

Compilation Distribution Fuzzing

13

Normal users

Generic Affect most of the fuzzers

AFL

HonggFuzz

VUzzer

QSym

…

Page 14: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Research Goals

Source

Fuzzification

Compilation

Fortified

binary

Binary Testers

Detected

bugs

Attackers

Compilation Distribution Fuzzing

14

Normal users

Low overhead to normal user

High overhead to attackersOverhead

Page 15: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Research Goals

Source

Fuzzification

Compilation

Fortified

binary

Binary Testers

Detected

bugs

Attackers

Compilation Distribution Fuzzing

15

Normal users

Fortified

binary

Resilient to the adversarial analysisResiliency

Page 16: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Why Existing Methods Are Not Applicable?

MethodGeneric to

most fuzzers

Low

overhead

Resilient to

adversary

Packing or obfuscation O X O

16

Page 17: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Why Existing Methods Are Not Applicable?

MethodGeneric to

most fuzzers

Low

overhead

Resilient to

adversary

Packing or obfuscation O X O

Bug injection O O X

17

Page 18: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Why Existing Methods Are Not Applicable?

MethodGeneric to

most fuzzers

Low

overhead

Resilient to

adversary

Packing or obfuscation O X O

Bug injection O O X

Fuzzer detection X O X

18

Page 19: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Why Existing Methods Are Not Applicable?

MethodGeneric to

most fuzzers

Low

overhead

Resilient to

adversary

Packing or obfuscation O X O

Bug injection O O X

Fuzzer detection X O X

Emulator detection X O X

19

Page 20: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Why Existing Methods Are Not Applicable?

MethodGeneric to

most fuzzers

Low

overhead

Resilient to

adversary

Packing or obfuscation O X O

Bug injection O O X

Fuzzer detection X O X

Emulator detection X O X

Fuzzification O O O

20

Page 21: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Fuzzification Hinders Advanced Features

21

Parallel execution

Fork

server

• Fast execution

• Coverage-guidance

• Hybrid approach

H/W

feature

Page 22: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Fuzzification Hinders Advanced Features

22

• Fast execution

• Coverage-guidance

• Hybrid approach

Parallel execution

Fork

server

H/W

feature

SpeedBump

Page 23: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Fuzzification Hinders Advanced Features

23

Parallel execution

Fork

server

Coverage

• Fast execution

• Coverage-guidance

• Hybrid approach

H/W

feature

Page 24: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Fuzzification Hinders Advanced Features

24

• Fast execution

• Coverage-guidance

• Hybrid approach

Parallel execution

Fork

server

Coverage

H/W

feature

BranchTrap

Page 25: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Fuzzification Hinders Advanced Features

25

Symbolic

execution

Dynamic

taint

analysis

Queue

Parallel execution

Fork

server

Coverage

• Fast execution

• Coverage-guidance

• Hybrid approach

H/W

feature

Page 26: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Fuzzification Hinders Advanced Features

26

• Fast execution

• Coverage-guidance

• Hybrid approach Symbolic

execution

Dynamic

taint

analysis

Queue

Parallel execution

Fork

server

Coverage

H/W

feature Anti-Hybrid

Page 27: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

SpeedBump: Selective Delay Injection

27

Basic block

Page 28: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

SpeedBump: Selective Delay Injection

28

Basic block

Rarely visited path

Frequently visited path

• Identify frequently and rarely visited paths

Page 29: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

SpeedBump: Selective Delay Injection

29

1

2

Basic block

Rarely visited path

Frequently visited path

• Identify frequently and rarely visited paths

• Inject delays from the most rarely visited edges

Page 30: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

SpeedBump: Selective Delay Injection

30

Basic block

Rarely visited path

Frequently visited path

• Why this is effective?

▫ User: follows common paths

▫ Attacker: searches for new paths

➔ Impact of delay is more significant to attackers

1

2

Page 31: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

SpeedBump: How to delay?

• Strawman: using sleep()

➔ trivially removed by adversary

31

Page 32: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

SpeedBump: How to delay?

• Strawman: using sleep()

➔ trivially removed by adversary

• Counter to advanced adversary

▫ Use randomly generated code ➔ avoid static-pattern

32

Page 33: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

SpeedBump: How to delay?

• Strawman: using sleep()

➔ trivially removed by adversary

• Counter to advanced adversary

▫ Use randomly generated code ➔ avoid static-pattern

▫ Impose control-flow and data-flow dependency➔ avoid automated analysis

33

Page 34: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

SpeedBump: Selective Delay Injection

34

int rarely_executed_code (){

return 0;}

Page 35: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

SpeedBump: Selective Delay Injection

35

int rarely_executed_code (){

return 0;}

//define global variablesint global1 = 1;int global2 = 2;

int rarely_executed_code (){

//inject delay functionint pass = 20;global2 = func(pass);return 0;

}

Page 36: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

SpeedBump: Selective Delay Injection

36

int func(int p6) {int local1[10];

// affect global1 variableglobal1 = 45; int local2 = global1;for (int i = 0; i < 1000; i++)// affect local1 variablelocal1[i] = p6 + local2 + i;

// affect global2 variablereturn local1[5];

}

int rarely_executed_code (){

return 0;}

//define global variablesint global1 = 1;int global2 = 2;

int rarely_executed_code (){

//inject delay functionint pass = 20;global2 = func(pass);return 0;

}

Page 37: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

BranchTrap Hinders Coverage Management

37

• Fast execution

• Coverage-guidance

• Hybrid approach Symbolic

execution

Dynamic

taint

analysis

Queue

Parallel execution

Fork

server

Coverage

H/W

feature

Page 38: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

BranchTrap#1: Fabricates Input-sensitive Paths

38

1

3

2

“AAAA”

Coverage #1

Page 39: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

BranchTrap#1: Fabricates Input-sensitive Paths

39

1

3

2

“AAAA” “AAAB”

Coverage #1 Coverage #2

Page 40: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

BranchTrap#1: Fabricates Input-sensitive Paths

40

1

3

2

“AAAA” “AAAB”

Coverage #1 Coverage #2

1

3

2

“AAAA”

Coverage #1

BranchTrap

Page 41: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

BranchTrap#1: Fabricates Input-sensitive Paths

41

1

3

2

“AAAA” “AAAB”

Coverage #1 Coverage #2

1

3

2

“AAAA”

Coverage #1

“AAAB”

Coverage #2

BranchTrap

Page 42: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Func1 (arg1, arg2)

call Func1

next inst

Caller

Original

epilogue

pop rbp

pop r15

ret

42

BranchTrap#1: ROP-based Fake Paths Generation

Page 43: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

BranchTrap#1: ROP-based Fake Paths Generation

Code

snippet 1

pop rbp

pop r15

ret

Code

snippet 2

pop rbp

pop r15

ret

…

call Func1

next inst

43

Original

epilogue

pop rbp

pop r15

retCode

snippet N

…

Func1 (arg1, arg2)

Caller

Page 44: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

BranchTrap#1: ROP-based Fake Paths Generation

index = arg1 ^ arg2

Code

snippet 1

pop rbp

pop r15

ret

Code

snippet 2

pop rbp

pop r15

ret

Code

snippet N

…

…

call Func1

next inst

①②

44

Original

epilogue

pop rbp

pop r15

ret

Func1 (arg1, arg2)

Caller

Page 45: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

BranchTrap#1: ROP-based Fake Paths Generation

index = arg1 ^ arg2

Code

snippet 1

pop rbp

pop r15

ret

Code

snippet 2

pop rbp

pop r15

ret

…

jmp table [index]call Func1

next inst

①②

③ ④

45

Original

epilogue

pop rbp

pop r15

retCode

snippet N

…

Func1 (arg1, arg2)

Caller

Page 46: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Code

snippet 1

pop rbp

pop r15

ret

Code

snippet 2

pop rbp

pop r15

ret

…

Code

snippet N

…

BranchTrap#1: ROP-based Fake Paths Generation

index = arg1 ^ arg2

jmp table [index]call Func1

next inst

①②

③ ④

⑤

46

Original

epilogue

pop rbp

pop r15

ret

Func1 (arg1, arg2)

Caller

Page 47: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

BranchTrap#2: Saturate Feedback State

47

1

3

2

• One-time visit makes effect

• BranchTrap:

▫ Saturates bitmap data

▫ Prevents coverage recording

Page 48: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

AntiHybrid Hinders Hybrid Fuzzing

48

• Fast execution

• Coverage-guidance

• Hybrid approach Symbolic

execution

Dynamic

taint

analysis

Queue

Parallel execution

Fork

server

Coverage

H/W

feature

Page 49: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Challenge of Hybrid Fuzzing

49

• Dynamic taint analysis

▫ Expensive implicit flow

Transform explicit data-flow ➔ implicit data-flow

Page 50: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Challenge of Hybrid Fuzzing

50

• Dynamic taint analysis

▫ Expensive implicit flow

• Symbolic execution

▫ Path explosion

Transform explicit data-flow ➔ implicit data-flow

Introduce an arbitrary path explosions

Page 51: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

AntiHybrid Avoids Dynamic Taint Analysis

• Transform explicit data-flow to implicit data-flow

51

char input = ‘a’;

char anti_dta;if (input == 97)

anti_dta = ‘a’;

if (!strcmp(anti_dta, ‘a’)) { … }

char input = ‘a’;

if (!strcmp(input, ‘a’)) { … }

Unable to

taint

input

anti_dta

Page 52: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

AntiHybrid Incurs Path Explosions

52

• Inject hash calculations into branches

if(a == 30) { … }

if(Hash(a) == 0x300df11) { … }

Path Explosion

Page 53: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Fuzzification Work-flow

Profile

Binary

Source

①RunValid/invlid

inputs

53

Page 54: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Fuzzification Work-flow

Profile

Binary

Source

② Inject

component

LLVM

IR

SpeedBump

BranchTrap

AntiHybrid

①RunValid/invlid

inputs

54

Page 55: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Fuzzification Work-flow

Profile

Binary

Source

② Inject

component

LLVM

IR

SpeedBump

BranchTrap

AntiHybrid Test run

①RunValid/invlid

inputs

55③Measure Overhead & Inject More Component

Page 56: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Fuzzification Work-flow

Profile

Binary

Source

② Inject

component

LLVM

IR

SpeedBump

BranchTrap

AntiHybrid Test run④Release

fortified

binary

①RunValid/invlid

inputs

56③Measure Overhead & Inject More Component

Page 57: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Evaluation Summary

• Implementation

▫ 6,599 lines of Python and 758 lines of C++

• Evaluation questions:

▫ Effective in “Reducing discovered paths and bugs?”

▫ Effective on “Various fuzzers?

▫ Impose “Low overhead” to the normal user?

57

Page 58: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Reduced the Discovered Coverage By 71%

BranchTrap

58

No Fuzzification

All Fuzzifications

AntiHybrid

SpeedBump

Dis

covere

d P

ath

s

* Fuzzing result on AFL-QEMU

objdump (binutils)

Page 59: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Reduced the Discovered Coverage By 71%

59* Fuzzing result on AFL-QEMU

Other binaries

Page 60: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Fuzzification is Effective on Various Fuzzers

Fuzzer Result

AFL (QEMU) 74%

HonggFuzz (PT) 61%

QSym (AFL-QEMU) 80%

Average 71%

60

Reduced code coverage

Page 61: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Reduced the Discovered Bugs

Fuzzer Result

AFL (QEMU) 88%

HonggFuzz (PT) 98%

QSym (AFL-QEMU) 94%

Average 93%

61

Fuzzer Result

Vuzzer 56%

QSym (AFL-QEMU) 78%

Average 67%

binutils v2.3.0 LAVA-M dataset

Page 62: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

File size & CPU Overheads

Overhead Result

File Size 1.4MB (62.1%)

CPU Overhead 3.7%

* Both overheads are configurable

62

binutils v2.3.0

Overhead Result

File Size 1.3MB (5.4%)

CPU Overhead 0.73%

Real-world applications (e.g., GUI)

Page 63: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Discussion

• Best-effort protections against adversarial analysis

• Complementary to other defense techniques

▫ Not hiding all vulnerabilities

▫ But introducing significant cost on attacker

63

Page 64: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Comparison: Fuzzification vs. AntiFuzz

Component Fuzzification AntiFuzz

Delay execution ● (+ cold path) ●

Fake coverage ● (randomized return) ● (fake code)

Saturate coverage ● ○

Prevent crash ○ ●

Anti-hybrid ● (+ anti-DTA) ●

Countermeasures ◐ ○64

Page 65: FUZZIFICATION: Anti-Fuzzing Techniques · snippet 1 pop rbp pop r15 ret Code snippet 2 pop rbp pop r15 ret … call Func1 jmp table [index] next inst ① ② ③ ④ 45 Original epilogue

Conclusion

• SpeedBump: Inject delays and only affects attackers

• BranchTrap: Insert input-sensitive branches

• AntiHybrid: Hinder hybrid fuzzing techniques

65

Make the fuzzing only effective to the testers

https://github.com/sslab-gatech/fuzzification

https://github.com/sslab-gatech/fuzzification

Rich snippet extension

Rich snippet extension

RBP Philippine Market

RBP Philippine Market

RBP Philippines

RBP Philippines

Select Snippet Snapshots

Select Snippet Snapshots

Ryann C. Enriquez, RBP

Ryann C. Enriquez, RBP

Interiors Southeast—SNIPPET

Interiors Southeast—SNIPPET

M R Garg General Manager (Animal Nutrition) NDDB · RBP implementation RBP: Implementation Plan- issues RBP •Manpower identified for RBP are not exclusive & are transferred frequently.

M R Garg General Manager (Animal Nutrition) NDDB · RBP implementation RBP: Implementation Plan- issues RBP •Manpower identified for RBP are not exclusive & are transferred frequently.

rbp albert

rbp albert

FT800 Series Programmer Guide...CODE SNIPPET 8 GETTING STARTED ..... 21 CODE SNIPPET 9 DL FUNCTION DEFINITION ..... 27 CODE SNIPPET 10 COLOR AND CODE SNIPPET 11 NEGATIVE SCREEN COORDINATES

FT800 Series Programmer Guide...CODE SNIPPET 8 GETTING STARTED ..... 21 CODE SNIPPET 9 DL FUNCTION DEFINITION ..... 27 CODE SNIPPET 10 COLOR AND CODE SNIPPET 11 NEGATIVE SCREEN COORDINATES

Updated RBP

Updated RBP

RBP Singapore

RBP Singapore

Rbp felix baguyojr

Rbp felix baguyojr

Snippet jump

Snippet jump

Rbp by kukkong 2015

Rbp by kukkong 2015

ROP is Still Dangerous - USENIX · pop rbx pop rbp ret . Normal Execution and [rax],0xfd mov edx,0x768 mov esi,0x4ab632 mov rdi,rbx call 0x2b2130 test rbp,rbp cmov [rbp],0x0 add rsp,0x8

ROP is Still Dangerous - USENIX · pop rbx pop rbp ret . Normal Execution and [rax],0xfd mov edx,0x768 mov esi,0x4ab632 mov rdi,rbx call 0x2b2130 test rbp,rbp cmov [rbp],0x0 add rsp,0x8

Powerful hyper rbp amie

Powerful hyper rbp amie

Snippet of Work

Snippet of Work

Revista RBP Abril

Revista RBP Abril

Rbp for denmark market

Rbp for denmark market

Snippet Search

Snippet Search