TaintScope Presented by: Hector M Lugo-Cordero, MS CAP 6135 April 12, 2011

2 Acknowledgements Authors: Tielei Wang, Tao Wei, Guofei Gu, Wei Zou Paper Title: TaintScope: A Checksum- Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection In Proceedings of the 31st IEEE Symposium on Security & Privacy, Oakland, CA, May Awarded Best Student Paper

3 Fuzz Testing TaintScope Performance Conclusions

4 Fuzz Testing TaintScope Performance Conclusions

5 Fuzz Testing Attempt to crash or hang a program by feeding it malformed inputs Blackbox fuzzing –Generational –Mutation

6 Fuzz Testing: Motivation Nobody is perfect Programs may be very large and dificult to test Find bugs to fix Exploit programs for malware

7 Fuzz Testing: Challenges Random fuzzing has to cover a huge sample space –E.g. audio signal of 4s, 32k bytes 2 256,000 possible values Symbolic fuzzing can’t bypass checksum instructions

8 Fuzz Testing TaintScope Performance Conclusions

9 TaintScope Fuzzer that can bypass checksum –independent of the algorithm Concentrates on data flow dependence Uses IDA Pro Disassembler Works like a classifier

10 TaintScope: How it Works Identify hot bytes in input –Bytes that affect API functions Memory management String operations –Input bytes are tainted with unique id Identify possible checksum points

11 TaintScope: How it Works Well-formed inputs take a true/false path Malformed inputs take a false/true path Intersection yields the check points TaintScope creates bypass rules

12 TaintScope: How it Works Fuzzer runs with bypass rules and mutates only hot bytes Crashes and hangs are recorded

13 TaintScope: How it Works Crashed samples are repaired for replay –C–Checksum are corrected Type of vulnerability can be analyzed

14 Fuzz Testing TaintScope Performance Conclusions

15 Performance: Hot Bytes

16 Performance: Checksum

17 Performance: Vulnerabilities

18 What is accomplished? TaintScope has found vulnerabilities in popular programs (e.g. MS Paint, Adobe Acrobat, and more) Vendors have patched the software Vulnerabilities have been published in –Secunia –Common Vulnerabilities and Exposure

19 MW Paint Search

20 Adobe Acrobat Search

21 Fuzz Testing TaintScope Performance Conclusions

22 Conclusions Fuzzer able to bypass checksum Works with Linux/Windows binaries 100% inputs cause crash or hang Low input samples Tested on many well-known applications and formats

23 Weakness Doesn’t talk about code coverage Needs to run the program several times to find information of interest Can’t detect correctly checksums where data is encrypted with key-based algorithm

24 Improvements Consider incorporating a tool like HyperNEAT –can learn search space patterns –work with encryption (e.g. DES S-Boxes) Dynamic update to reduce number of runs needed to build hot bytes/checksum information

25 References 1.Tielei Wang’s website: Month of Kernel Bugs: pull.com/mokb/ pull.com/mokb/ 3.Month Browsers Bug: 4.Secunia: 5.Comon Vulnerabilities and Exposure: IDA Disassembler: 7.Google Images:

26 QUESTIONS