IWSEC 2016

We will have keynote talks from following world-leading researchers.

angr - Finding vulnerabilities in embedded software

Abstract

Over the last few years, as the world has moved closer to realizing the idea of the Internet of Things, an increasing amount of the objects with which we interact every day have been replaced with embedded devices. These include previously non-electronic devices, such as locks, light switches, and utility meters (such as electric meters and water meters), as well as increasingly more complex and ubiquitous devices, such as network routers and printers. Other devices are becoming increasingly intelligent as well. Modern printers and cameras include complex social media functionality, smart televisions are increasingly including Internet-based entertainment options, and even previously-simple devices such as watches and glasses are being augmented with complex embedded components. These devices often receive privacy-sensitive information from their sensors (such as what a user is watching, or how much electricity they are using), or carry out a safety-critical function (such as actuators that lock the front door). As a result, errors in the devices' firmware, whether present due to an accidental mistake or purposeful malice, can have serious and varying implications in both the digital and physical world.
Firmware, like any piece of software, is susceptible to a wide range of software errors. These include memory corruption flaws, command injection vulnerabilities, and application logic flaws. Another common error seen in firmware is a logic flaw called an authentication bypass or, less formally, a backdoor. In this talk, we will look at the challenges of performing automated vulnerability analysis and backdoor finding in firmware. Then, we report on a binary static analysis system, called angr, that automates most of the process of searching firmware binaries for the presence of flaws. To the best of our knowledge, angr is the first firmware analysis system working at the binary level, in a scalable manner, and with no requirement to instrument code on the original device. To this end, angr utilizes advanced program analysis techniques to analyze binary code in complex firmware of diverse hardware platforms, and it automates much of the process of identifying occurrences of buffer overflow and authentication bypass vulnerabilities. The tool uses novel techniques to improve the scalability of the analysis, which we will explain during the presentation. This includes a combination of more traditional static program analysis, value set analysis (VSA), and symbolic execution. angr is also an integral component in the automated vulnerability finding, exploitation, and patching engine that participates in DARPA's Cyber Grand Challenge (CGC), the first competition where autonomous programs participate in a capture-the-flag competition.

Biography

Christopher Kruegel is a Professor of Computer Science at UC Santa Barbara. He is also a co-founder of Lastline, where he currently serves as the Chief Scientist. Christopher's research interests focus on computer and communications security, with an emphasis on malware analysis and detection, web security, and intrusion detection. He has published more than 100 peer-reviewed papers in top computer security conferences and has been the recipient of the NSF CAREER Award, MIT Technology Review TR35 Award for young innovators, IBM Faculty Award, and several best paper awards. He regularly serves on program committees of leading computer security conferences and speaks at industry events such as BlackHat and RSAC.

---

UNVEIL: A Large-Scale, Automated Approach to Detecting Ransomware

Abstract

Although the concept of ransomware is not new (i.e., such attacks date back at least as far as the 1980s), this type of malware has recently experienced a resurgence in popularity. In fact, in 2014 and 2015, a number of high-profile ransomware attacks were reported, such as the large-scale attack against Sony that prompted the company to delay the release of the film "The Interview". Ransomware typically operates by locking the desktop of the victim to render the system inaccessible to the user, or by encrypting, overwriting, or deleting the user's files. However, while many generic malware detection systems have been proposed, none of these systems have attempted to specifically address the ransomware detection problem.
In this talk, I talk about some of the trends we are seeing in ransomware. Then, I present a novel dynamic analysis system called UNVEIL that is specifically designed to detect ransomware. The key insight of the analysis is that in order to mount a successful attack, ransomware must tamper with a user's files or desktop. UNVEIL automatically generates an artificial user environment, and detects when ransomware interacts with user data. In parallel, the approach tracks changes to the system's desktop that indicate ransomware-like behavior. Our evaluation shows that UNVEIL significantly improves the state of the art, and is able to identify previously unknown evasive ransomware that was not detected by the anti-malware industry.

Biography

Engin Kirda is a Professor of Computer Science and Engineering at Northeastern University in Boston, and the director of the Northeastern Information Assurance Institute. He is also a co-founder and Chief Architect at Lastline, Inc -- a company specialized in advanced malware detection and defense. Before moving to the US, he held faculty positions at Institute Eurecom in the French Riviera and the Technical University of Vienna where he co-founded the Secure Systems Lab that is now distributed over five institutions in Europe and US. Engin's research has focused on malware analysis (e.g., Anubis, Exposure, Fire) and detection, web application security, and automated vulnerability discovery and mitigation. He co-authored more than 120 peer-reviewed scholarly publications and served on program committees of numerous international conferences and workshops. In 2009, Engin was the Program Chair of the International Symposium on Recent Advances in Intrusion Detection (RAID), in 2010/11, Program Chair of the European Workshop on Systems Security (Eurosec), in 2012 the Program Chair of the USENIX Workshop on Large Scale Exploits and Emergent Threats, and chaired the flagship security conference NDSS in 2015. Engin will be chairing USENIX Security in 2017.

---

Division Property: Efficient Method to Estimate the Algebraic Degree

Abstract

The algebraic degree is one of the most important factors for the security of ciphers. If the algebraic degree of ciphers is low in all secret keys, we can easily break the cipher. Assume that attackers can collect the sets of $2^d$ chosen plaintexts and corresponding ciphertexts. Then if the degree is lower bounded by $d-1$ in all secret keys, the sum of the ciphertexts is always zero. Therefore, it is necessary criteria to guarantee that the lower bound of the algebraic degree is high. The higher-order differential cryptanalysis is a cryptanalytic technique to exploit this property. Unfortunately, it is not easy to estimate the lower bound of the algebraic degree. The integral cryptanalysis, which was proposed by Knudsen and Wagner at FSE 2002, is another technique to exploit this property. They introduced the integral property. The integral property does not clearly exploit the algebraic degree, but efficiently evaluates the lower bound of the algebraic degree. On the other hand, the accuracy is not always good. The first part of my talk briefly explains the importance of the algebraic degree from the perspective of the security. I introduce two cryptanalytic techniques to exploit this property: the higher-order differential cryptanalysis and the integral cryptanalysis. Then, I introduce my recent work, called the division property. The division property is new method to evaluate the lower bound of the algebraic degree. The division property is the generalization of the integral property such that the algebraic degree is clearly exploited. I briefly explain the motivation of the division property and the extension. Finally, I introduce the cryptanalysis on full MISTY1, and the reason why MISTY1 is broken by using the division property.

Biography

Yosuke Todo received the B.E. and M.E. degrees from Kobe University in 2010 and 2012, respectively. Since 2012, he has been a researcher at NTT Secure Platform Laboratories, NTT Corporation. He was awarded one of best papers in SCIS 2015. He also received the best paper award and best young researcher award from CRYPTO 2015. His current research interest is cryptography.