I vincitori del Premio Tesi
17a Edizione - Tesi del 2021
Damiano Melotti
tesi magistrale
Università di Trento
Dipartimento di Ingegneria e Scienze dell’Informazione
Titolo della tesi
“Reversing and Fuzzing the Google Titan M Chip”
Relatore
Andrea Continella
Abstract
Google recently introduced a secure chip called Titan M in its Pixel smartphones, enabling the implementation of a Trusted Execution Environment (TEE) in Tamper Resistant Hardware, mitigating hardware-level exploits, and providing several security sensitive backends. Such a trend, proposed also by other OEMs, will become increasingly popular in the near future of Android security. TEEs have been proven effective in reducing the attack surface exposed by smartphones, by protecting specific security-sensitive operations. However, studies have shown that TEE code and execution can also be targeted and exploited by attackers, therefore, studying their security lays the basis of the trust we have in their features. In this paper, we provide the first security analysis of Titan M. First, we reverse engineer the firmware and we review the open source code in the Android OS that is responsible for the communication with the chip. By exploiting a known vulnerability, we then dynamically examine the memory layout and the internals of the chip. Finally, leveraging the acquired knowledge, we design and implement a structure-aware black-box fuzzer. Using our fuzzer, we rediscover several known vulnerabilities after a few seconds of testing, proving the effectiveness of our solution. In addition, we identify and report a new vulnerability in the latest version of the firmware.
Lorenzo Invidia
tesi magistrale
Università degli Studi di Roma "La Sapienza"
Dip. Ingegneria dell’informazione, informatica e statistica
Titolo della tesi
“Rope: A New Flavor of Distributed Malware Execution”
Relatore
Daniele Cono D’Elia
Abstract
In the last few years, the spread of new heuristics in endpoint security products is leading attackers and security researchers to shift their focus to distributed malware execution as a means to avoid detection. This thesis advances academic research in offensive technology by presenting Rope, a novel distributed malware execution paradigm, intending to raise awareness on new attack surfaces that adversaries might exploit. The Rope design develops a distributed execution paradigm where processes can access a covert data and memory representation, and carry on the intended semantics through code reuse. We leverage the transactional interface of Windows to isolate suspicious code and hinder the inspection from security solutions. In this manner, executable code can be safely stored and injected in the context of multiple victim processes. The malware pattern is broken down into chunks, in the form of tiny chains assembled by code reuse means, concealed in a shared data channel. To this end, we provide a novel injection technique to quietly map and execute shellcode in the context of each victim. This specially crafted piece is responsible for the orchestration of chunk execution, faithfully reproducing the original pattern of the malware while maintaining a low profile to detectors. We deploy our concept in the latest builds of Windows by evaluating the validity against both consumer and enterprise-grade security products.
Antonella Gioia Rodio
tesi magistrale
Università degli Studi di Roma "La Sapienza"
Dipartimento di Ingegneria dell’informazione, informatica e statistica
Titolo della tesi
“Poking Hypervisors: A Tale of Evasions and Remediations for Transparent Monitoring”
Relatore
Daniele Cono D’Elia
Abstract
The advent of virtualization-based monitoring has significantly enhanced malware analysis techniques. A key factor for any security framework that uses virtualization is to monitor the state of a target environment through critical features. This thesis provides a glimpse into the inner workings of hypervisors, which enable the monitoring of a target from a safe vantage point, with higher accuracy than other state-of-the-art malware analysis platforms. Building on a set of features provided by CPU vendors, hypervisors may intercept a set of critical security-related events. Accordingly, a malware analyst may chiefly gather information of deemed importance. Throughout the thesis, we will notice how hypervisor-based monitoring is comparable to a “cat and mouse” game between miscreants and security analysts. Actually, the linchpin of the thesis is to assess how much an analysis technique can be transparent, i.e., the property of making virtual and native hardware indistinguishable even from a dedicated adversary. Primarily, we glance at how past hypervisor-based approaches addressed different stumbling blocks. Then, having identified a gap between survey literature and a panorama of cutting edge monitoring methodologies, the thesis provides a fine-grained assessment of available, state-of-the-art hypervisorbased security frameworks. Concisely, it distills the inner workings, the primitives, and the limitations exposed by the above-mentioned frameworks, to facilitate the identification of a usage scenario in a security context. Moreover, we also sketch the existing security caveats, advancing potential adversarial patterns. While the fidelity and non-intrusiveness of analysis frameworks continue to improve, malware writers attempt to poke tell-tale signs that are indicative of monitoring through discrepancies. Ongoing endeavors attempt to clobber this issue, ensuring that eminent characteristics of analysis environments are ousted with realistic ones and that any instrumentation artifacts remain cloaked. In this ongoing arms race, recent researches have demonstrated how side-channel attacks may enable adversaries to detect interception events. Accordingly, the thesis confers patterns, as both the increase in instruction execution time and subsequent cache artifacts, that shatter the illusion of transparency, providing overwhelming evidence of the instrumentation. Unprivileged side-channel attacks in virtualized environments are quickly evolving. The state of affairs is exacerbated by the advent of microarchitectural-based threats, which can circumvent current state-of-the-art defenses. Furthermore, the thesis showcases a case study against a reference hypervisorbased implementation of API hooking, a technique ordinarily employed by malware analysts to pinpoint possibly malicious features of a program from its externally observable behavior. The case study provides a practical demonstration on how to profitably evade this layer of defense, during potential Red Team operations. The thesis concludes leaving an open question on how the security research community should react and what direction to head in.
Matteo Rizzi
tesi triennale
Università di Trento
Dipartimento di Ingegneria e Scienze dell’Informazione
Titolo della tesi
“TLS Analyzers for Android Apps: State-of-the-art Analysis and Integration in TLSAssistant”
Relatore
Silvio Ranise
Abstract
In a world where interconnection between devices is a prerequisite for many applications, security in communications is critical. TLS (Transport Layer Security) is the foundation of communications encryption. Born as the successor of SSL (Secure Socket Layer created by Netscape), it allows information to be shared securely in a transmission channel from source to destination (end-to-end). TLS uses ciphers to make the connection reliable and secure. In some of them, as the technology progresses and computational power increases, new vulnerabilities are discovered. Once a cipher is vulnerable and an attack is feasible, the cipher is removed from the next version of the protocol and is considered deprecated. Unfortunately, upgrading the TLS protocol to the latest version could cause compatibility issues. Many times there is a compromise: use the most compatible version of TLS (for example TLS 1.2, even if it is not the most recent one) and configure it correctly by excluding vulnerable ciphers. To evaluate and manage the quality of a TLS configuration, there are specific tools such as TLSAssistant. TLSAssistant combines state-of-the-art TLS analyzer in the analysis phase and provides mitigations for the user to apply in his own system. What TLSAssistant needed was a modernization of the analyzer used for the vulnerability detection in Android applications. My contribution was to convert the mallodroid android app analyzer from the now deprecated Python 2 to the new Python 3. Then, to extend the coverage of the vulnerability detection in the app scenario, I compared various security tools for analyzing Android applications, I chose SUPERAnalyzer: an analyzer written in RUST that allows a decompilation and analysis of the APK file according to a system of regular expressions (regex) called rules. After using a parser that I have written in Python and correctly importing the rules to make SUPER contextual to TLS, I extensively tested its effectiveness on a dataset of 1169 APKs (chosen following the most used apps in the Google Play Store). To make sure that the integration of the new tools had not changed the already existing functionalities, I performed a regression test, which was successful. I detected a flaw unrelated to the integration of SUPERAnalyzer in the analysis of the SLOTH vulnerability: the first attack vector of SLOTH was partially implemented in TLSAssistant, while the second vector was completely missing. After an accurate simulation of a system vulnerable to SLOTH, I implemented the necessary checks to fix the bug in the first attack vector and completely implemented the check of the second attack vector in TLSAssistant. Finally, I tested the final version of TLSAssistant on a real use case: an online citizen authentication application using the Italian electronic identity card (CieID App). To mitigate the 3SHAKE and LUCKY13 attacks, it was necessary to upgrade the authentication server to OpenSSL v1.1.1. Updating the authentication server provided a TLS padding error. By properly analyzing the app I realized not only that the problem was related to the padding used in the digital ID card chip but also that the practical authentication flow (the TLS mutual authentication) between the app and the authentication server was not consistent with the theoretical flow. After reporting the issue to the Istituto Poligrafico e Zecca dello Stato the app flow was remodeled.
Alessandro Sanna
tesi magistrale
Università degli Studi di Cagliari
Dipartimento di Ingegneria Elettrica, Elettronica ed Informatica
Titolo della tesi
“Dynamic analysis and instrumentation of interaction-based Microsoft Office malware”
Relatore
Davide Maiorca, Giorgio Giacinto, Fabrizio Cara
Abstract
Microsoft Office has proven since its introduction in 1990 to be a formidable tool to enhance the productivity of its users. This was one of the critical factors that led it to become as omnipresent today. However, this popular toolbox owes its success to the variety of tools available to the user. One of them is the possibility to write custom programs in the form of macros written in Visual Basic Script, a proprietary scripting language owned by Microsoft. Since there are virtually no limits to the contents of said macros, any malicious agent could try to write its custom malware inside an Office document. Once this infectious file is sent to the victim and the victim opens it, the macro is likely to self execute and compromise them. The key objective of this work is to dissect these malicious macros. Operationally, we will avail of two procedures: dynamic analysis and instrumentation. The first will allow us to see what the malware could do if executed in a realistic environment; the second will be vital to understand the malware’s contents and logic, which is very likely to be obfuscated. Currently, there are many tools for the analysis of this type of malware, with multiple entries for both the static and the dynamic approaches. However, no tool available at the moment can bypass interaction-based malware automatically. Interaction-based Office macros are programs that require the user to take one or more actions for the execution to continue. Even if we are talking about trivial actions, e.g. clicking a button, this kind of obstacle becomes more obnoxious if our goal is to analyze thousands of files instead of only one dynamically. This work, then, will improve a research tool, Oblivion, with an additional feature that makes the program capable of simulating user interactions, allowing the researcher to automatically analyze a plethora of new files that before could not give them any information.
Il video della premiazione può essere visto qui: https://securitysummit-registrazioni.clusit.it/16-09-2022_10-00_12-00_premio-tesi-innovare-la-sicurezza-delle-informazioni-17a-edizione/index.php
I premiati delle ultime 10 edizioni
Il Premio Tesi è realizzato in collaborazione e con il sostegno di:
