Steganography for Executables and Code Transformation Signatures Bertrand Anckaert, Bjorn De Sutter, Dominique Chanet and Koen De Bosschere

2 Problem Alice Bob Wendy Embedder Extractor

3 Location of the Secret Message oMedia human senses redundant bits oExecutables processors single-bit failure NOISE ⇒ CHOICE

4 01 Embedding Bits in a Choice

5 Embedding Bits in a Choice alternatives bitsbits n=7 ⇒ 3 unused n=31 ⇒ 15 unused

Embedding Bits in a Choice

alternatives bitsbits

8 Instruction Selection Alice Bob Selection

9 Instruction Selection mov 0,reg sub reg,reg and 0,reg xor reg,reg lea 0,reg imul 0,reg operation: reg=0 sub -1,reg add 1,reg inc reg lea 1(reg),reg operation: reg=reg+1 … neg reg imul -1,reg,reg operation: reg=-reg

10 Alice Bob Scheduling Selection Scheduling Selection

11 Instruction Scheduling & Code Layout source sink oInstruction Scheduling oCode Layout pieces of code that can be placed in any order

12 Layout Interactions Alice Bob Scheduling Selection Layout Scheduling Selection Canonicalize

13 Evaluation: i386 (1) bzip2craftygapgzipmcfparsertwolfvortexvprtotal (1/200) (1/100) (1/50) (1/40) (1/25) instruction selection instruction scheduling code layout Benchmarks Embedding Rate Hydan

14 Layout Code Transformation Signatures Alice Bob Scheduling Selection Layout Scheduling Selection Wendy sub 0x8,ebp (3 byte) ⇒ lea -0x8(,ebp,1),ebp (7byte)

15 CTS: Instruction Selection mov 0,reg sub reg,reg and 0,reg xor reg,reg lea 0,reg imul 0,reg operation: reg=0 Wendy

16 oCTS: unusual code property introduced by the applied code transformation oDetection: 1.quantify property through metric 2.build statistical model of expected behavior 3.compare observed to expected behavior 4.classify code into clean and suspect Detection of CTSs

17 Layout Code Transformation Signatures Scheduling Selection Unusual Instructions Unusual Frequencies Diverse Schedules Suboptimal Schedules Unusual Jump Behaviour

18 Evaluation: i386 (2) instruction selection instruction scheduling code layout bzip2craftygapgzipmcfparsertwolfvortexvprtotal Benchmarks (1/200) (1/100) (1/50) (1/40) (1/25) Embedding Rate Hydan

Questions?