I vincitori del Premio Tesi
15a Edizione - Tesi del 2019
Cristian Assaiante
tesi magistrale
Università degli Studi di Roma "La Sapienza"
Titolo della tesi
“A Micro-Architectural Red Pill”
Relatore
Daniele Cono D’Elia
Abstract
Malware analysis is one of the most important fields of the cyber security world. A malware analyst is constantly racing against malware writers in order to cut the spread of malicious software as soon as possible by understanding its behaviour, and then finding a way to detect it or make it harmless. The increasing diffusion of adversarial techniques however is making automatic dynamic analysis of malware in systems like sandboxes harder and slower. Malware that tries to withstand analysis systems by detecting their presence is called evasive. Samples of this kind are equipped with techniques to determine whether execution is taking place in a hostile analysis environment instead of a victim machine. There are an extremely large amount of so-called red pills to detect almost every execution technology and static or dynamic analysis tool an analyst could take advantage from. As introducing artifacts during dynamic analysis is inevitable, to reduce the time spent in the analysis process malware analysts and system architects ideally must know every technique a malware developer could possibly use, and how to neutralize their effects with proper countermeasures. In this thesis we propose an entirely new type of red pill designed to detect hypervisors using micro-architectural effects. Hypervisors are largely used in dynamic malware analysis to execute samples in a controlled, easy-to-restore environment without the risk of damaging the analyst machine irreparably. The idea behind our technique lies in artifacts of modern hypervisors that cause the eviction of some cache sets. In particular, transitions during the execution to the virtual machine monitor typically pollute the caches in a way that does not happen in bare-metal systems. In order to detect this phenomenon we use some of the most advanced techniques for cache side-channel attacks, which have been developed in recent years to exploit micro-architectural vulnerabilities such as Spectre. The tests we conducted on three of the most common hypervisors used in the malware analysis scene (VirtualBox, VMWare, Xen) show how our red pill is able to detect the presence of a virtualized environment with an extremely high success rate, by keeping track of how many cache sets get evicted during the normal operation of the virtual machine monitor. Due to the micro-architectural approach used and the simple nature of the computations that we perform, our attack is not only difficult to detect, but particularly hard, if not impossible, to mitigate or subvert for dynamic analysis systems.
Daniele Angioni
tesi magistrale
Università degli studi di Cagliari
Dipartimento di Ingegneria Elettrica ed Elettronica
Titolo della tesi
“Riconoscimento di impronte falsificate da cellulare”
Relatore
Gian Luca Marcialis
Abstract
Lo scopo di questa tesi è stato quello di valutare il livello di minaccia di una una tecnica di falsificazione delle impronte digitali contro dei sistemi di liveness detection allo stato dell’arte. Questa tecnica utilizza delle fotografie allo schermo del cellulare dove giace l’impronta latente. Da queste foto si possono ricavare delle repliche, tramite qualche processo di digital image processing, di alta qualità .Fare una fotografia è molto più semplice e veloce dei classici metodi di acquisizione dell’impronta latente, e può essere quindi utilizzata per ingannare la vittima. Per valutare fino a che punto questo metodo possa essere una minaccia è stato costruito un nuovo dataset di impronte vere e falsi realizzati con questo metodo, per fare dei test con i primi tre vincitori della competizione LivDet 2019. I risultati mettono in evidenza come il nuovo metodo presenti un livello di minaccia pari alle repliche realizzate con il completo consenso della vittima.
Stefano Berlato
tesi magistrale
Università di Trento
Dipartimento di Ingegneria e Scienze dell’Informazione
Titolo della tesi
“A Pragmatic Approach to Handle Honest But Curious Cloud Service Providers: Cryptographic Enforcement of Dynamic Access Control Policies”
Relatore
Silvio Ranise, Roberto Carbone
Abstract
Cryptographic Access Control is the natural solution to allow companies to store sensitive data in the Cloud while preserving confidentiality and the possibility to let employees share resources. While many researches focused on this topic, the vast majority proposed only abstract schemes. Few studies developed even a working prototype and none deeply studied a deployment in a realistic use case by considering concrete issues like keys management, robustness or scalability. In this thesis, we filled the gap between these abstract schemes and an actual deployment. We addressed real-world issues like keys management, robustness and scalability rather than focusing high-level issues only. Con- cretely, we chose a state-of-the-art cryptographic access control scheme and extended it to deliver a fully-working implementation. We formulated four high-level properties to derive low-level assump- tions and requirements. Furthermore, we formalized two degrees of freedom and presented twelve different architectures, explaining in detail advantages and drawbacks. To finalize to our discussion, we implemented a cryptographic access control scheme running in a Docker container and interacting with Amazon Web Services. To cover as many use cases as possible, we designed it so to interface with multiple Cloud Service Providers and support multiple architectures with a simple, if not com- pletely null, configuration effort. Summarizing, our work provided a detailed view of the challenges and conditions that can serve as guidelines also for other future implementations of cryptographic access control schemes.
Carlotta Tagliaro
tesi magistrale
Università degli Studi di Trento
Department of Information Engineering and Computer Science
Titolo della tesi
“Security and Performance tradeoffs in the Internet of Things”
Relatore
Prof. Silvio Ranise
Abstract
The use of Internet-connected devices is pervasive: according to Gartner, their number is estimated to reach 25 billion by 2021, from smart home assistants to industry- and military-oriented applications. Despite its widespread adoption, the well-known importance of securing the Internet of Things (IoT) devices and their machine-to-machine communication, and the many available guidelines and best practices, security is still not a primary concern in current IoT solutions. In my preliminary investigation over MQTT, one of the most widely used IoT messaging protocols, I was able to confirm the alarming trend highlighted by past and current literature: most of the deployments do not support the Transport Layer Security (TLS) protocol or implement inadequate security measures, typically due to strict delivery schedule or resource-constrained scenarios. A similar lack of awareness is present in CoAP, a UDP-based IoT messaging protocol developed for resource-constrained devices that supports the use of Datagram TLS (DTLS) to secure message exchanges. To address this problem I analyzed the main security threats to MQTT and CoAP, and the security properties of TLS and DTLS. Considering the widespread adoption of MQTT, I deployed and assessed an MQTT-based use case from the security and performance perspective: four different configurations with different levels of security (default configuration, password-based authentication, use of TLS with certificate-based authentication, and TLS-PSK) have been tested with two automated analysis tools: MQTT Security Assistant (MQTTSA) and TLS Assistant. The report of both tools have been used to investigate suggested vulnerabilities and advise adequate mitigations in the configuration of Mosquitto, the most widely adopted MQTT open-source broker. Since no support was found for TLS-PSK analysis, I created a Python script to perform brute-force attacks on PSK-based scenarios. A part of the thesis investigates the performance tradeoffs when supporting TLS in MQTT: this is fundamental to avoid data tampering and information disclosure even when adopting resource-constrained devices. The analysis focused on registering the overhead of different cipher-suites when devices connect and exchange messages. To foster the adoption of the most adequate security measures in Mosquitto, I developed web-based interface to assist developers in configuring the authentication and authorization mechanisms, together with the use of TLS and on-the-fly certificate generation based on Let’s Encrypt. Based on the configuration created by the user, the interface reports the overall level of security, security warnings and common vulnerabilities.
Andrea Salvati
tesi magistrale
Università La Sapienza di Roma
Dipartimento di Ingegneria Informatica
Titolo della tesi
“ROPDissector: An Analysis Framework for ROP Programs”
Relatore
Camil Demetrescu
Abstract
In spite of mitigations that modern operating systems put in place to avoid remote code injection attacks, memory corruption vulnerabilities remain a major source of concern. In particular, code reuse techniques get regularly used today to get around mechanisms such as code signing and data execution prevention. Return Oriented Programming (or ROP for short) is currently the most popular embodiment of the code reuse principle. The complexity of ROP payloads is on the rise as a response to ever growing mitigation mechanisms for exploitation in mainstream systems. Furthermore, several research works have hinted at ROP as a possibly effective code obfuscation technique. For how ROP code is structured, understanding its semantics at first glance is very hard. To get such information, a thorough analysis process is required: this task can be very time consuming to be performed manually, and usually hinges on dynamic analysis to capture all relevant details. Control flow operations such as branches are hard to spot even during such an analysis, as they rely on odd mechanisms for conditional manipulation of the CPU flags and stack pointer register. This thesis presents ROPDissector, a static analysis framework for ROP programs that can ease the analysis of complex ROP code by providing control flow identification, memory access tracing, system and library call detection, multi-path exploration, and semantic annotation of code through emulation of the x86 ISA in the Unicorn engine. The focus of the analysis are 32-bit payloads for Windows, which represent the most common instance of ROP code, while future improvements might include support for Linux exploits and the x64 architecture. ROPDissector requires forensic analysts to provide the ROP payload and the application component from which ROP gadgets (the computational components of a ROP payload) are borrowed. The thesis also discusses automatic techniques to guess such components from a database of plausible candidates by leveraging implementation characteristics of Address Space Layout Randomization in Windows with respect to relative distances of valid image bases for DLL code modules. Such techniques can be useful to automate the analysis of payloads observed over the network and most importantly in malicious PDF files. In particular, the latter typically contain ROP chains targeting the code of specific versions of PDF viewers like Adobe Reader: without this information a dynamic analysis would likely yield misleading results, missing a behavior that can kick in only in the right execution environment and configuration. The framework provides a good deal of flexibility that allows for building follow-up research on top of it, for instance not only to analyze existing payloads, but also to validate the correctness of ROP code when writing it. Compared to the state of the art for ROP code analysis in the literature, the ideas presented in this thesis reduce the burden on forensic analysis and reverse engineering actors, as they are no longer required to reproduce the activation context of the ROP payload, a step that was necessary for taking a full memory dump for subsequent analysis. Parts of this thesis appeared in the "Static analysis of ROP code" paper published within the 12th European Workshop on Systems Security (EUROSEC 2019) earlier this year.
Il video della premiazione può essere visto qui: https://securitysummit2020.clusit.it/11-11-2020_18-00_19-30_premio-tesi-innovare-la-sicurezza-delle-informazioni/
I premiati delle ultime 10 edizioni
Il Premio Tesi è realizzato in collaborazione e con il sostegno di:
