ISSISP 2011

Courses

• Bjorn De Sutter: "Software Protection Techniques against Hardware-Based Attacks on Software"

Software Protection Techniques against Hardware-Based Attacks on Software

×

In this short course, we will study hardware-based attacks on software and software-based defense mechanisms against those attacks. A first category of attacks we will study are side-channel attacks. Such attacks observe hardware behavior (power consumption, execution time, cache behavior, ... ) of processors running sensitive software to extract sensitive information from that software. A second category are hardware tampering techniques, such as controlled power glitches or laser light attacks to modify the behavior of running software such that the software starts exposing sensitive information. For both types of attacks, software transformations will be discussed that mitigate the leaking of sensitive information.

Bjorn De Sutter, University of Ghent, Belgium



Bjorn De Sutter is associate professor in the Computer Systems Lab at the Faculty of Engineering and Architecture of Ghent University. He got both his MSc and his PhD from Ghent University in 1997 resp. 2002. Amongst others, he teaches courses on Compilers, and on Software Hacking and Protection, which are also his major research interests. The focus of his compiler technology research is on increasing the productivity of programmers by automating necessary tasks for non-functional requirements, incl. the protection of software against all kinds of attacks. His more than 80 peer-reviewed publications cover protections against fault injection attacks, against tampering attacks, against reverse engineering attacks, against memory exploit attacks, against patch-based attacks, and against timing side channel attacks. He coordinated the EU FP7 STREP ASPIRE (Advanced Software Protection: Integration, Research, and Exploitation), which was evaluated by the EC as excellent in Feb. 2017, and participated in numerous other national and international projects. He received the Annual FWO Barco Award in 1998 for his Master thesis, and is the recipient of a 2013 HiPEAC Technology Transfer Award.

• Christian Collberg: "Intellectual property protection of SW: The Practice and Theory of Software Protection"

Intellectual property protection of SW: The Practice and Theory of Software Protection

×

In this part of the course we will study ways to protect programs from software piracy, tampering, and reverse engineering. We will study practical software-based protection algorithms, the theoretical limits of such protection, as well has hardware-based solutions. In the course we will learn what methods bad guys use to extract secrets from programs and what methods good guys use to protect these secrets. The techniques studied in software protection are known as code obfuscation, software watermarking, tamperproofing, and birthmarking. Software watermarking is used to trace software pirates, code obfuscation is used to make it more difficult to reverse engineer a program, tamperproofing is used to make it harder to modify a program, and birthmarking is used to detect code theft. These techniques are commonly used to protect cryptographic primitives in digital rights management (DRM) software, to prevent the removal of license checks, to hide secret algorithms and protocols in programs such as Skype, and to detect cheating in computer science programming assignments.

In this class we will study parts of the book Surreptitious Software by Christian Collberg and Jasvir Nagra, pp 816, Addison-Wesley Professional, 2009.

Christian Collberg, University of Arizona, USA



Christian Collberg is a Professor at the Department of Computer Science at the University of Arizona. He got his PhD from Lund University, Sweden and taught at University of Auckland, New Zealand, before joining Arizona. His current research interests lie in the protection of software from reverse engineering and tampering, as well as in the reproducibility of computer science research (see FindResearch.org). He is the author of "Surreptitious Software, Obfuscation, Watermarking, and Tamperproofing for Software Protection".

• Jack Davidson: "Software Security via Lightweight Process Virtualization"

Software Security via Lightweight Process Virtualization

×

Computing is increasingly ubiquitous. It is used in many areas of daily life, from cellular telephones, managing health and financial records, e-commerce, and electronic voting, to name a few. Users of these various computing platforms demand high quality, undisrupted service, and privacy and security of their personal information. Beyond personal use, much of society’s critical infrastructure is also controlled by complex software systems. Unfortunately, because of its complexity, it is difficult to build software that is impervious from attack by malicious adversaries. Indeed, every day there are reports of intrusions and security breaches that result in financial loss and disclosure of confidential or proprietary information. A promising approach for providing protection of software from a wide variety of attacks is the use of lightweight process virtualization via software dynamic translation. This course will introduce students to the concept of software dynamic translation, discuss its efficient implementation, and describe its use to protect software from various types of attacks. To introduce students to the power and utility of software dynamic translation, the course will include several hands-on exercises where the student implements a protection scheme using software dynamic translation.

Jack Davidson, University of Virginia, USA



I am Professor of Computer Science at the University of Virginia. I received my Ph.D. from the University of Arizona in 1981 and joined the University of Virginia in 1982. Over the years, I have worked in many areas including compilers, embedded systems, high-performance computing, and computer security. My current research foci is on software protection and computer security. In the area of software security, my group has developed dynamic methods to prevent adversaries from compromising intellectual property. In the area of computer security, we have developed methods for "hardening" binaries to make them impervious to cyber attack. In 2014–2016, I lead a team at the University of Virginia that competed in the DARPA Cyber Grand Challenge (CGC)—a contest to build an autonomous supercomputer to automatically analyze vulnerable binaries and patch them—all without human intervention. Our entry, produced in collaboration with Grammatech, Inc., finished second winning a $1M prize. I am also leading a DARPA project, "Double Helix: High Assurance N-variant Systems." Double Helix is a binary analysis and transformation system that processes binary applications and produces variants with diverse binary structures that are intended to be deployed within a multi-variant system. A unique aspect of Double Helix is that it employs structured diversity to guarantee that variants behave differently yielding high-assurance systems. Both CGC and Double Helix rely on high-precision binary analysis and rewriting to reverse engineer and transform binaries.

• Roberto Giacobazzi: "Theory and practice of code attack: Semantics, analysis and code transformation"

Theory and practice of code attack: Semantics, analysis and code transformation

×

In this course we will study systematic and automatic methods for code attack and reverse engineering. We will introduce static and dynamic program analysis as basic tools for understanding what programs do and for making reverse engineering. Most known attack methods based on control/data-flow analysis, profiling, tracing, emulation, disassembly and decompilation will be presented as suitable abstractions of an interpreter. Obfuscation and watermarking will be then discussed as methods for making these abstract interpreters incomplete when acting on the modified (obfuscated or watermaked) code, i.e. failing to extract hidden information. Systematic methods for making abstract interpreters incomplete will be discussed together with concrete examples and challenging future research directions. The result is a unifying and comprehensive view of SW protection strategies which provides both a theoretical bases for most of the known attack and defense methods and a perspective for the design of new algorithm for surreptitious software. The class will consists of lectures and hands-on exercises. Slides will be distributed to the course attendees.

Roberto Giacobazzi, Università degli Studi di Verona, Italy



Roberto Giacobazzi was born in 1964 in Modena, Italy. He received the Laurea degree in Computer Science in 1988 from the University of Pisa, and in 1993 he received the Ph.D. in Computer Science from the same university. From 1993 to 1995 he had a Post Doctoral Research position at Laboratoire d'Informatique (LIX), Ecole Polytechnique (Paris) in the equipe Cousot. From 1995 to 1998 he was (tenured) Assistant Professor in Computer Science at the University of Pisa. From 1998 to 2000 he was Associate Professor at the University of Verona. From May 2000 until now he is Full Professor in Computer Science at the University of Verona. The research interests of Roberto Giacobazzi include abstract interpretation, static program analysis, semantics of programming languages, program verification, abstract model-checking, program transformation and optimization, digital asset protection, code obfuscation, software watermarking and lattice theory.

• Yuan Xiang Gu: "Software security patterns, direct attack analysis and protection techniques"

Software security patterns, direct attack analysis and protection techniques

×

The consumer electronics industry is entering a new age. The advanced technology and products, rapid demand on media digitalization, the continuously falling prices of consumer electronics together with increasing disposable income from emerging markets (such as China, India and other quick growth regions) are spurring growth in the consumer electronics market in a speed and the scope that has never been seen before. Many of consumer electronics products rely on software applications to function. Almost all consumer electronics devices require functioning in a non-protected environment. People can directly access these devices for different purposes that range from good (e.g., to get needed services) to bad (e.g., to hack the devices). As a result, computer applications increasingly execute in hostile environments. Hand-held devices (such as portable media players, smart phones), home networking (such as set-top boxes, media players, PCs) and web-based environments permit attackers to deploy substantial time and resources. Therefore, the protection of legitimate software against attacks is becoming an arms race. Moreover, increasing hardware performance and increasingly sophisticated attack tools favor illicit intruders. How can a distributor of software be sure that the software is robust and resistant to attack? Frequently, the platform and software are well known to an attacker who has time, resources, tools and all the experts on the web at his disposal. This attack landscape is often termed a white-box environment, where all the content is in plain sight - the opposite of a black-box environment (in the other words, a trusted and protected environment). Therefore, preventing or stopping direct and automated attacks to software systems is becoming one of the most demanding security challenges. This course describes and discusses direct software attack scenarios and security patterns that are abstracted from many application domains in terms of use cases, vulnerability and threat analysis, and security solutions. Also, we detail certain currently marketed software protection technologies as a guide to the state of the art.

Yuan Xiang Gu, Irdeto, Canada



Mr. Gu was the co-founder of Cloakware Corporation that. In 2007, Cloakware was acquired by Irdeto. Since then, as a chief architect and a senior research director of Irdeto, Mr. Gu is also leading the development of next generation Cloakware technology, and research collaboration with research communities worldwide. Mr. Gu has been invited and visited over 40 universities and research institutes in North American, Europe and Asia, and organizing international security forums (workshops, summer schools, and association) and becomes an active speaker at many international conferences and workshops to promote software security and protection. Mr. Gu was invited being a guest professor of Northwest University in China. As a native Chinese, Mr. Gu often represents Irdeto to involve many business development and research collaboration activities in China. Prior to joining Cloakware, Mr. Gu has worked as a senior scientist and architect at Nortel Networks. Previously, Mr. Gu was a visiting professor at the Computer Science School of McGill University at Montreal of Canada between 1988-1990. Before relocated to Canada, Mr. Gu was a professor in the Computer Science Department at Northwest University in China. Mr. Gu received the First Outstanding Young Scientists Foundation Award from the Chinese Academy of Sciences in 1985, and has about four decades of software research and development knowledge and expertise, and has published more than two dozens of patents and patent applications.