ISSISP 2014

Courses

• Arun Lakhotia: "Binary analysis in Polymorphic Malware Detection"

Binary analysis in Polymorphic Malware Detection

×

Analysis of malware introduces new challenges that are not present when analyzing programs in the normal context. Besides the fact that the programs are in a binary form, they are explicitly created to defeat analysis by hiding behind undecidability. Nonetheless, I will show that program analysis methods can indeed be used to answer a variety of questions related to malware. For instance, by relaxing the requirements of safety one can use program analysis to provide semantics based “features” to a machine learner. Similarity analysis is a key tool for understanding and querying big-data of code, in particular in the context of malware analysis and mitigation. We will provide an end-to-end experience in analyzing malware binaries, extracting semantics features, and using those in a machine learner to find similar malware in a repository. We will use these hands-on exercises to also highlight opportunities and challenges for further research, and introduce you to the state-of-the-art technologies to get started.

Arun Lakhotia, University of Louisiana



I am a full time Professor in the department of Computer Science, University at Louisiana, Lafayette, USA. I earned my Ph.D. degree in C omputer Science from the Case Western Reserve University in 199 0. My research interests are malware analysis and autonomous vehicles.

• Bjorn De Sutter: "Evaluating the strength of software protections"

Evaluating the strength of software protections

×

Determining the effectiveness of software protection techniques is one of the major open challenges in the domain of software protection. How to do so is largely an open question that absolutely needs to be answered if we ever want to be able to provide non-experts with tools that automatically apply the best combination of protections given an application, its assets to be protected and the business model of the vendor. In this lecture, we will explore theoretical and practical approaches and metrics for modeling and evaluating the effectiveness of software protection techniques in MATE attack scenarios. We will study the toolboxes available to attackers, and methods to model attacks and to model the effects of protections on the engineering and exploitation of attacks. Finally, we will discuss how to run experiments involving human subjects. Such experiments are needed to determine the relation between measurable properties of (protected) applications and the effort that human attackers will have to invest for engineering attacks.

Bjorn De Sutter, University of Ghent, Belgium



Bjorn De Sutter is associate professor in the Computer Systems Lab at the Faculty of Engineering and Architecture of Ghent University. He got both his MSc and his PhD from Ghent University in 1997 resp. 2002. Amongst others, he teaches courses on Compilers, and on Software Hacking and Protection, which are also his major research interests. The focus of his compiler technology research is on increasing the productivity of programmers by automating necessary tasks for non-functional requirements, incl. the protection of software against all kinds of attacks. His more than 80 peer-reviewed publications cover protections against fault injection attacks, against tampering attacks, against reverse engineering attacks, against memory exploit attacks, against patch-based attacks, and against timing side channel attacks. He coordinated the EU FP7 STREP ASPIRE (Advanced Software Protection: Integration, Research, and Exploitation), which was evaluated by the EC as excellent in Feb. 2017, and participated in numerous other national and international projects. He received the Annual FWO Barco Award in 1998 for his Master thesis, and is the recipient of a 2013 HiPEAC Technology Transfer Award.

• Brecht Wyseur: "White-box Cryptography"

White-box Cryptography

×

Software applications often rely on cryptographic algorithms to protect a given service that they support. Think of banking applications, DRM applications, cloud storage services, secure email and teleconferencing, games. Many of these examples will suffer severe consequences when secret key information leaks from the software application. This lecture will explore the challenges of mitigating such information leakage in use-cases where the software is executed on platforms that are completely under control of malicious users. This is the research field that is denoted as white-box cryptography. After an introduction on the threats and some examples, the audience will be guided through the state of the art in white-box cryptography, and we will discuss some challenges and opportunities.

Brecht Wyseur, Nagravision

• Christian Collberg: "Software Protection"

Software Protection

×

Software protection is the branch of computer security that studies techniques for protecting secrets contained in computer programs from being discovered, modified, or redistributed. In this introductory lecture we will show how an adversary can study a program under their control (using disassemblers, decompilers, etc.) in order to extract proprietary information or modify the program, for example in order to bypass a license check. We will discuss important basic software protection algorithms for obfuscation, tamper-proofing, and software watermarking, as well as basic reverse engineering techniques for attacking such protections.

Christian Collberg, University of Arizona, USA



Christian Collberg is a Professor at the Department of Computer Science at the University of Arizona. He got his PhD from Lund University, Sweden and taught at University of Auckland, New Zealand, before joining Arizona. His current research interests lie in the protection of software from reverse engineering and tampering, as well as in the reproducibility of computer science research (see FindResearch.org). He is the author of "Surreptitious Software, Obfuscation, Watermarking, and Tamperproofing for Software Protection".

• Jack Davidson: "Code protection by dynamic translation"

Code protection by dynamic translation

×

Computing is increasingly ubiquitous. It is used in many areas of daily life, from cellular telephones, managing health and financial records, e-commerce, and electronic voting, to name a few. Users of these various computing platforms demand high quality, undisrupted service, and privacy and security of their personal information. Beyond personal use, much of society’s critical infrastructure is also controlled by complex software systems. Unfortunately, because of its complexity, it is difficult to build software that is impervious from attack by malicious adversaries. Indeed, every day there are reports of intrusions and security breaches that result in financial loss and disclosure of confidential or proprietary information. A promising approach for providing protection of software from a wide variety of attacks is the use of lightweight process virtualization via software dynamic translation. This course will introduce students to the concept of software dynamic translation, discuss its efficient implementation, and describe its use to protect software from various types of attacks. To introduce students to the power and utility of software dynamic translation, the course will include several hands-on exercises where the student implements a protection scheme using software dynamic translation.

Jack Davidson, University of Virginia, USA



I am Professor of Computer Science at the University of Virginia. I received my Ph.D. from the University of Arizona in 1981 and joined the University of Virginia in 1982. Over the years, I have worked in many areas including compilers, embedded systems, high-performance computing, and computer security. My current research foci is on software protection and computer security. In the area of software security, my group has developed dynamic methods to prevent adversaries from compromising intellectual property. In the area of computer security, we have developed methods for "hardening" binaries to make them impervious to cyber attack. In 2014–2016, I lead a team at the University of Virginia that competed in the DARPA Cyber Grand Challenge (CGC)—a contest to build an autonomous supercomputer to automatically analyze vulnerable binaries and patch them—all without human intervention. Our entry, produced in collaboration with Grammatech, Inc., finished second winning a $1M prize. I am also leading a DARPA project, "Double Helix: High Assurance N-variant Systems." Double Helix is a binary analysis and transformation system that processes binary applications and produces variants with diverse binary structures that are intended to be deployed within a multi-variant system. A unique aspect of Double Helix is that it employs structured diversity to guarantee that variants behave differently yielding high-assurance systems. Both CGC and Double Helix rely on high-precision binary analysis and rewriting to reverse engineer and transform binaries.

• Yuan Xiang Gu: "The industrial challenge in Software and information protection"

The industrial challenge in Software and information protection

×

In nowadays life, no matter for business use or personal use, un-trusted environments are becoming more dominated in digital world from consumer devices to home networks, to the public Internet, to the cloud and web services, and to the Internet of Things, where traditional security models are inadequate to address emerging threat models and attacks. The wireless connectivity quickly gains in popularity in recent years and provides anything/anytime/anywhere connection to playing contents, e-mail, instant messaging, mobile banking, mobile payment, weather and travel information, and lots of other digital information services. All of these makes white-box security and digital asset protection much more challenging. This course describes and discusses white-box software attack scenarios and security patterns (that are abstracted from many application domains in terms of use cases, vulnerability and threat analysis, and security solutions), the security lifecycle of digital asset application mandating protection from creation, through distribution and then ultimately consumption from being deployed in the field. Also, we detail certain currently software protection technologies in markets as a guide to the state of the art.

This course is structured in two sessions: 1) a course lecture; 2) a panel to host a group of industrial experts to present, discuss and explore some most interesting software and information protection issues in emerging markets.

Yuan Xiang Gu, Irdeto, Canada



Mr. Gu was the co-founder of Cloakware Corporation that. In 2007, Cloakware was acquired by Irdeto. Since then, as a chief architect and a senior research director of Irdeto, Mr. Gu is also leading the development of next generation Cloakware technology, and research collaboration with research communities worldwide. Mr. Gu has been invited and visited over 40 universities and research institutes in North American, Europe and Asia, and organizing international security forums (workshops, summer schools, and association) and becomes an active speaker at many international conferences and workshops to promote software security and protection. Mr. Gu was invited being a guest professor of Northwest University in China. As a native Chinese, Mr. Gu often represents Irdeto to involve many business development and research collaboration activities in China. Prior to joining Cloakware, Mr. Gu has worked as a senior scientist and architect at Nortel Networks. Previously, Mr. Gu was a visiting professor at the Computer Science School of McGill University at Montreal of Canada between 1988-1990. Before relocated to Canada, Mr. Gu was a professor in the Computer Science Department at Northwest University in China. Mr. Gu received the First Outstanding Young Scientists Foundation Award from the Chinese Academy of Sciences in 1985, and has about four decades of software research and development knowledge and expertise, and has published more than two dozens of patents and patent applications.