ISSISP 2019

Courses

• Bjorn De Sutter: "1.Anti-deobfuscation Techniques；2.Protection Evaluation"

1.Anti-deobfuscation Techniques；2.Protection Evaluation

×

Bjorn De Sutter’s lectures focus on the protection of assets against expert man-at-the-end attackers. The first topic of the first lecture will be advanced, automated attacks on obfuscated code such as generic deobfuscation based on trace simplification, semantic analysis, fuzzing, and symbolic execution. Countermeasures will be discussed as well, some of which focus on lowering the effectiveness of the attacks, and others that focus on preventing the deployment of tools in the attackers’ toolbox, such as tracers and debuggers. The second lecture will focus on the evaluation of protection techniques in the face of basic and advanced techniques. Questions that will be addressed: How do attackers approach their task? How do we model the attackers’ behavior? How do we select the best combinations of protections given our knowledge of attackers? How do we then evaluate the strength of protections? What are the caveats that we should be aware of?

Bjorn De Sutter, University of Ghent, Belgium



Bjorn De Sutter is associate professor in the Computer Systems Lab at the Faculty of Engineering and Architecture of Ghent University. He got both his MSc and his PhD from Ghent University in 1997 resp. 2002. Amongst others, he teaches courses on Compilers, and on Software Hacking and Protection, which are also his major research interests. The focus of his compiler technology research is on increasing the productivity of programmers by automating necessary tasks for non-functional requirements, incl. the protection of software against all kinds of attacks. His more than 80 peer-reviewed publications cover protections against fault injection attacks, against tampering attacks, against reverse engineering attacks, against memory exploit attacks, against patch-based attacks, and against timing side channel attacks. He coordinated the EU FP7 STREP ASPIRE (Advanced Software Protection: Integration, Research, and Exploitation), which was evaluated by the EC as excellent in Feb. 2017, and participated in numerous other national and international projects. He received the Annual FWO Barco Award in 1998 for his Master thesis, and is the recipient of a 2013 HiPEAC Technology Transfer Award.

• Christian Collberg: "1.Basic obfuscation；2.Basic obfuscation；3.Watermarking & Fingerprinting"

1.Basic obfuscation；2.Basic obfuscation；3.Watermarking & Fingerprinting

×

Christian's lectures will focus on the basics of software protection. This includes an overview of applications that can be protected by obfuscation and tamper proofing, and elementary obfuscating transformations such as control flow flattening and virtualization. The lectures will have a practical component, where the participants will protect simple programs using code obfuscation tool.

Christian Collberg, University of Arizona, USA



Christian Collberg is a Professor at the Department of Computer Science at the University of Arizona. He got his PhD from Lund University, Sweden and taught at University of Auckland, New Zealand, before joining Arizona. His current research interests lie in the protection of software from reverse engineering and tampering, as well as in the reproducibility of computer science research (see FindResearch.org). He is the author of "Surreptitious Software, Obfuscation, Watermarking, and Tamperproofing for Software Protection".

• Feiyue Wang: "Security in CPSS"

Security in CPSS

×

Feiyue Wang, Institute of Automation, Chinese Academy of Sciences



Professor Wang is the director of the State Key Laboratory for Management and Control of Complex Systems, director of China Center for Economic and Social Security Studies, University of the Chinese Academy of Sciences, dean of Qingdao Academy of Intelligent Industries, vice President and Secretary of Chinese Association of Automation. He was deputy director of Institute of Automation，Chinese Academy of Sciences， Dean of School of Software at Xi'an Jiaotong University, director of the Robotics and Automation laboratory at University of Arizona, etc..

• Jack Davidson: "Advanced Software Protection"

Advanced Software Protection

×

Davidson's lectures will focus on the use of virtual machines (VMs) to provide software protection. The lectures will discuss various VM-based approaches including the use of Strata, a powerful software dynamic translator that supports application-specific protections. The lectures will also cover common attacks used against VM-based protections.

Jack Davidson, University of Virginia, USA



I am Professor of Computer Science at the University of Virginia. I received my Ph.D. from the University of Arizona in 1981 and joined the University of Virginia in 1982. Over the years, I have worked in many areas including compilers, embedded systems, high-performance computing, and computer security. My current research foci is on software protection and computer security. In the area of software security, my group has developed dynamic methods to prevent adversaries from compromising intellectual property. In the area of computer security, we have developed methods for "hardening" binaries to make them impervious to cyber attack. In 2014–2016, I lead a team at the University of Virginia that competed in the DARPA Cyber Grand Challenge (CGC)—a contest to build an autonomous supercomputer to automatically analyze vulnerable binaries and patch them—all without human intervention. Our entry, produced in collaboration with Grammatech, Inc., finished second winning a $1M prize. I am also leading a DARPA project, "Double Helix: High Assurance N-variant Systems." Double Helix is a binary analysis and transformation system that processes binary applications and produces variants with diverse binary structures that are intended to be deployed within a multi-variant system. A unique aspect of Double Helix is that it employs structured diversity to guarantee that variants behave differently yielding high-assurance systems. Both CGC and Double Helix rely on high-precision binary analysis and rewriting to reverse engineer and transform binaries.

• Roberto Giacobazzi: "1.Foundation of obfuscation; 2.Obfuscation & static semantic analyses"

1.Foundation of obfuscation; 2.Obfuscation & static semantic analyses

×

The module is intended to introduce the foundations and design principles of code protecting transformations for anti reverse engineering applications. This is a gentle introduction for non-specialists and students to some of the main results concerning both the limits and the possibilities of making code obscure and unlearnable. The battle scenario involves (automated) attackers intended to extract information by reverse engineering the code, and protecting code transformations modelled as distorted compilers devoted to inhibit these attacks. Attacks are inhibited by maximising imprecision in all attempts made by the attacker (which is an algorithm) to exploit control and data-flow of the obscured code. The module will introduce the main results on the impossibility of virtual black box obfuscation and the possibility results for weakened attack models. We show that protecting transformations can be systematically and formally derived as distorted compilers, obtained by virtualising the source code, i.e., by specialising a suitably distorted interpreter for the given programming language with respect to the source code to protect. The limits of these methods are shown in the context of computability theory. Interestingly, this distortion corresponds precisely to defeat the potency of the expected attacker, which is itself an interpreter and whose potency consists in its ability to extract a complete and precise view of the program's execution.

Roberto Giacobazzi, Università degli Studi di Verona, Italy



Roberto Giacobazzi was born in 1964 in Modena, Italy. He received the Laurea degree in Computer Science in 1988 from the University of Pisa, and in 1993 he received the Ph.D. in Computer Science from the same university. From 1993 to 1995 he had a Post Doctoral Research position at Laboratoire d'Informatique (LIX), Ecole Polytechnique (Paris) in the equipe Cousot. From 1995 to 1998 he was (tenured) Assistant Professor in Computer Science at the University of Pisa. From 1998 to 2000 he was Associate Professor at the University of Verona. From May 2000 until now he is Full Professor in Computer Science at the University of Verona. The research interests of Roberto Giacobazzi include abstract interpretation, static program analysis, semantics of programming languages, program verification, abstract model-checking, program transformation and optimization, digital asset protection, code obfuscation, software watermarking and lattice theory.

• Sébastien Bardin: "1.Practical formal methods: code protection; 2.Practical formal methods: vulnerability analysis"

1.Practical formal methods: code protection; 2.Practical formal methods: vulnerability analysis

×

Several major classes of security analysis have to be performed on raw executable files, such as vulnerability analysis of mobile code or commercial off-the-shelf, deobfuscation or malware inspection. These analysis are highly challenging, due to the very low-level and intricate nature of binary code, and there is a clear need for more sophisticated and automated tools than currently available syntactic and dynamic approaches. On the other hand, source-level program analysis and formal methods have made tremendous progress in the past decade, and they are now an industrial reality for safety-critical applications.

In these lectures, we present how and to which extent semantic analysis coming from source-level safety analysis can be fruitfully adapted to the context of binary-level security analysis -- with a special emphasis on Symbolic Execution and SMT solvers, together with an overview of their advantages & weaknesses as well as of the main challenges faced by such approaches.

We especially focus on automated deobfuscation and vulnerability analysis. In the first case we will review the latest advances in automatic analysis of adversarial codes (both attacks and defenses) as well as their strengths and limitations. In the second case, we will study the problem of automatic vulnerability discovery (at scale) as well as vulnerability assessment.

Sébastien Bardin, CEA LIST, France



Dr. Sébastien Bardin is a Researcher in the Department of Computer Science at CEA Paris-Saclay, where he leads the binary-level security group at CEA LIST, with a focus on program analysis, formal methods and automated reasoning. For a few years now, Sébastien has been interested in automating software-level security analysis by lifting formal methods developed for the safety-critical industry. In particular, he focuses on binary-level formal methods, vulnerability detection & assessment, and malware deobfuscation -- he is the main designer of the open-source BINSEC platform for binary-level code analysis. Sébastien regularly publishes articles in top-tier international conferences in Formal Methods, Software Engineering, and Security. He has served as a PI for several research projects on binary-level security analysis and he is regularly invited to international events and to security-related summer schools. Sébastien received his Ph.D. in Computer Science from École Normale Supérieure de Cachan in 2005.

• Yidong Li: "Data Privacy"

Data Privacy

×

Yidong Li, Beijing Jiaotong University



Professor Li Yidong is the deputy dean of the School of Computer and Information Technology in Beijing Jiaotong University, the executive director of the SAP University Competence Center (China), member and academic secertary of the YOCSEF Academic Committee of China Computer Federation, and member of NBDSC and CCF TCHPC, deputy secretary general of TCCT. His research interests involve big data analysis and security, privacy protection, data mining, cloud computing, high-performance computing, intelligent transportation, etc. He has hosted/participated in over 30 scientific research projects including National Natural Science Foundation Program, 863 Program, Program for Innovation Team of Ministry of Education, Australian National Natural Science Foundation Program, State Grid Corporation Program, and the China National Aviation Holding Corporation Program. Prof. Li will conduct course on data privacy protection.

• Yiping Lv: "Car Security"

Car Security

×

Yiping Lv, Tencent keen lab



Yiping lv joined Tencent in 2016 and has 18 years of experience in the information security industry。 Now he is primarily responsible for international and domestic industry security research and technical cooperation at Tencent Cohen Laboratories. He worked for Microsoft before joining Tencent.

Tencent Keen Security Lab is a world-class professional information security research team owned by Tencent. Between 2013 and 2017, Keen lab won 17 individual championships and three "World Crack Master" title in the International Hacker contest Pwn2Own. Keen won the Blackhat Pwnies Lifetime Achievement Award and the Best Award of the Year nomination 7 times between 2015 and 2017; released Google Android Universal ROOT Security Research for three years. The lab won third place in the global Defcon CTF competition in 2017, dominated by Tencent Security Cohen Laboratories. In 2018, Tencent EEE team, lead by Tencent Keen Security Lab, won the championship of on-line and off-line in the National Information Security Competition "Strong Net Cup" and won the Gold Award.

In recent years, Tencent Keen Security Lab focus on intelligent networking vehicle Information security, The lab achieved no physical contact with Tesla cars remote break for two consecutive years , won "Tesla Safety Research Hall of Fame" winner two times , between 2016 and 2017. In 2018, the lab completed the independent Safety project of BMW Series network and won the BMW Group's first "BMW Group Digital and IT Technology R & D Award."

• Yuan Xiang Gu: "1.The Industrial Challenges in Software and Information Protection; 2.Panel: Industrial Challenges"

1.The Industrial Challenges in Software and Information Protection; 2.Panel: Industrial Challenges

×

While the digital world connects devices, peoples and things in a speed beyond humans’ imagination, hostile digital environments have been becoming more dominated from consumer devices to home networks, to the public Internet, to the cloud and web services, and to the Internet of Things, where traditional security models are inadequate to address emerging threats and attacks. The anything/anytime/anywhere properties of modern connectivity make software security and digital asset protection much more challenging and critical. This lecture is to discuss trends in threats and security paint points, new challenges to information security, white-box software attack scenarios introduce software security immunity and security patterns (that are abstracted from many application domains in terms of use cases, vulnerability and threat analysis, and security solutions), and security life-cycle of digital applications mandating protection from creation and development, through distribution and then ultimately consumption from being deployed and maintained in the field. Moreover, we introduce homomorphic obfuscation technology and detail certain software protection technologies currently available in markets as a guide to the state of the art. Finally, we will brief AI and ML security problems and real challenges to cyber-security on connected and intelligent vehicles.

Yuan Xiang Gu, Irdeto, Canada



Mr. Gu was the co-founder of Cloakware Corporation that. In 2007, Cloakware was acquired by Irdeto. Since then, as a chief architect and a senior research director of Irdeto, Mr. Gu is also leading the development of next generation Cloakware technology, and research collaboration with research communities worldwide. Mr. Gu has been invited and visited over 40 universities and research institutes in North American, Europe and Asia, and organizing international security forums (workshops, summer schools, and association) and becomes an active speaker at many international conferences and workshops to promote software security and protection. Mr. Gu was invited being a guest professor of Northwest University in China. As a native Chinese, Mr. Gu often represents Irdeto to involve many business development and research collaboration activities in China. Prior to joining Cloakware, Mr. Gu has worked as a senior scientist and architect at Nortel Networks. Previously, Mr. Gu was a visiting professor at the Computer Science School of McGill University at Montreal of Canada between 1988-1990. Before relocated to Canada, Mr. Gu was a professor in the Computer Science Department at Northwest University in China. Mr. Gu received the First Outstanding Young Scientists Foundation Award from the Chinese Academy of Sciences in 1985, and has about four decades of software research and development knowledge and expertise, and has published more than two dozens of patents and patent applications.