I vincitori del Premio Tesi
19a Edizione - Tesi del 2023
Elia Boninsegna
tesi magistrale
Università La Sapienza di Roma
Dipartimento di Ingegneria Informatica
Titolo della tesi
“AVoiDER – AntiVirus and EDR Evasion Toolkit”
Relatore
Daniele Cono D’Elia
Abstract
In an ever evolving cybersecurity landscape, the efficacy of modern AntiVirus and Endpoint Detection and Response (EDR) solutions is crucial for safeguarding digital environments. This research delves into the complex interplay between these defense systems and sophisticated evasion techniques employed by threat actors. The study uncovers several limitations inherent in these solutions, underscoring the necessity of continuous adaptation and adherence to best practices. The developed AVoiDER toolkit emerges as a pivotal instrument for evaluating the responses of security systems within cyber environments. It integrates and extends “state-of-the-art” evasion and bypass techniques for the targeted defense systems, highlighting the potential vulnerabilities in existing detection methods. AVoiDER’s modular and expandable design positions it as a versatile research platform, enabling the implementation and experimentation of novel bypass techniques. This research demonstrates that successful execution of integrated bypass methods can lead to the execution of malicious code able to totally compromise the integrity of analyzed systems. AVoiDER contributes to the research landscape and also serves as a practical evaluation tool for existing cyber defense systems. Its value lies not only in its current capabilities but also in its potential for future advancements, making it a valuable asset in the realm of cybersecurity research.
Giacomo Borin
tesi magistrale
Università di Trento
Dipartimento di Matematica
Titolo della tesi
“Cryptographic Group Actions and Digital Signatures”
Relatore
Alessio Meneghetti, Edoardo Persichetti, Michele Battagliola
Abstract
In our every day more digital world, cryptographic signatures serve as a vital tool to ensure data integrity, authenticity, and non-repudiation. However, due to the recent advancement in the research of quantum computers, the possible implementation of quantum algorithms like Shor’s and Grover’s ones pose an existential threat to the classical public key schemes based on integers factorization and discrete logarithm, like RSA and ECDSA. To solve this, NIST opened a call for proposals of quantum resistant schemes, also called post-quantum cryptosystems. NIST’s standardization process has already given its first high quality schemes, but for signatures the results are not to be considered satisfactory. Thus, a new "on ramp"call specific for signatures not based on ideal lattices has been open. So, researchers are taking the opportunity to explore new possible mathematical tools and problems combining security, reliability and flexibility. To this end, recently Code Equivalence and other Isomorphism Problems have also been (re)discovered, emerging as an interesting assumption for new schemes. In particular Code Equivalence, i.e. the problem of finding the linear invertible isometry between two linear codes C, C1, combines the security of more established code-based cryptography, but can also be represented as a (non-abelian) group action, a fundamental mathematical tool, with a long history of use in cryptography, from the introduction of the discrete logarithm to isogenies between supersingular elliptic curves. From the problem it can naturally be defined a zero knowledge identification protocol that can be rendered to a signature with the Fiat-Shamir transform, in such a way that the security of the scheme is equivalent to the original problem. Choosing different metrics will lead to protocols that achieve different parameters: the LESS scheme uses the hamming metric, while MEDS one uses the rank metric one. This triggered the interest of the community in studying these general frameworks. Not only to improve current schemes and understand their limits, but also to get back functionalities missing in the post-quantum scenario, like ring signatures and, in particular, threshold signatures, that distribute the right to sign messages to any subset of at least T out of N key owners; then, any subset of malicious users of size up to the threshold T won’t be able to forge a valid signature alone. These constructions In this thesis we recall some results and reductions for signatures and zero knowledge proof pivotal for the current NIST post-quantum cryptography call, then we go through the recent literature on cryptographic group actions and code equivalence problems, tailoring the exposition to focus on schemes submitted to the aforementioned "on ramp" call: LESS, MEDS and partially ALTEQ. Then, we construct a full N-out-of-N threshold signature scheme, and discuss the efficiency issues arising from extending it to the generic T -out-of-N case using the Replicated Secret Sharing. For that, we generalize and improve some known constructions for abelian group actions, but unrelated to any scheme submitted to NIST. To illustrate the practicality of our designs, we subsequently implement them using two distinct varieties of code-based cryptographic group actions, namely LESS and MEDS signature schemes.
Elisa Braconaro
tesi magistrale
Università degli Studi di Padova
Dipartimento di Matematica
Titolo della tesi
“LLMs Evaluation for Android Vulnerability Repair”
Relatore
Eleonora Losiouk
Abstract
Automated Program Repair (APR) aims to automate the process of fixing software defects, including syntactic errors, semantic bugs, and vulnerabilities. Emergent studies have explored the use of Large Language Models (LLMs) for APR related tasks, such as code refinement and fault localisation, but they are mainly involved in the repair of syntax and semantic bugs. The specific focus on vulnerability repair, especially in the context of Android applications, remains limited. This project wants to take a step further in this direction, by contributing a new dataset of real-world Android vulnerabilities and corresponding fixes and by evaluating three prominent LLMs (ChatGPT-3.5, Google Bard, and Android Studio Bot) on such a dataset in a zero-shot scenario, to understand their actual abilities in repair Android vulnerabilities. Notably, although Android Studio Bot is strictly related to the Android Studio platform and should facilitate Android code generation, its performance for the specific vulnerability repair task is to be considered unsatisfactory, letting ChatGPT-3.5 and Google Bard stand out.
Roberta Cimorelli Belfiore
tesi magistrale
Università degli studi del Molise
Dipartimento di Bioscienze e Territorio
Titolo della tesi
“Identity-Based Matchmaking Encryption: A Generic Construction and Instantiations from Standard Lattice Assumptions”
Relatore
Anna Lisa Ferrara
Abstract
In an age where safeguarding data privacy is of utmost importance, there is a clear need for cryptographic solutions that can simultaneously ensure privacy and authenticity. Cryptography has played a central role in securing information throughout history, evolving to meet the challenges posed by advanced technology and the growing requirement for stronger security measures. From ancient symmetric key encryption to contemporary Identity-Based Matchmaking Encryption (IB-ME), this field has continuously adapted to our communication needs. Identity-Based Matchmaking Encryption (IB-ME), initially proposed by Ateniese et al. (Crypto 2019), is an extension of Identity-Based Encryption (IBE) that places a strong emphasis on ensuring privacy and authenticity, thereby enabling innovative applications in areas such as covert communication services, Internet of Things (IoT), and data sharing platforms. IB-ME ensures that the content of a message is only revealed when the recipient’s identity matches the intended recipient specified by the sender, and when the target sender’s identity, chosen by the receiver during decryption, matches the actual sender’s identity. Francati et al. (IndoCrypt 2021), however, identified a limitation in the privacy definition for IB-ME. It solely guarantees the concealment of the message and sender’s identity when the receiver’s identity does not match the intended recipient specified by the sender. It does not consider whether the target sender’s identity matches the actual sender’s identity. To overcome this limitation, they proposed an enhanced privacy notion and developed an IB-ME scheme that achieves it in the plain model, even though relying on non-standard assumptions. In this thesis, we tackle the challenge of constructing an IB-ME scheme that provides both enhanced privacy and anthenticity under standard assumptions, with a specific focus on post-quantum security. To achieve this, we first demonstrate how to create an IB-ME that fulfills the enhanced privacy notion by using as building blocks any anonymous IBE and any reusable computational extractors. Subsequently, we show how to build an IB-ME based on an IB-ME that satisfies enhanced privacy and a context-hiding homomorphic signature, thereby ensuring not only privacy but also authenticity. Importantly, the proposed framework allows for secure IB-ME schemes to be implemented in the standard model using lattice assumptions, thus providing post-quantum security as well. Looking ahead, as possible directions to explore, we discuss potential modifications to the proposed construction in order to enhance its efficiency. The results presented in this thesis will appear in the 22nd International Conference on Applied Cryptography and Network Security (ACNS 2024).
Samuele Doria
tesi magistrale
Università degli Studi di Padova
Dipartimento di Matematica
Titolo della tesi
“Control Flow Graph-based Path Reconstruction in Android applications”
Relatore
Eleonora Losiouk
Abstract
Android, developed by Google, has evolved into a dominant operating system in the mobile technology landscape, powering a myriad of devices from smartphones and tablets to various digital interfaces, including cars. Its open architecture has facilitated widespread adoption, making Android a crucial player in modern computing. This prominence has, however, brought about challenges, particularly in the realm of security. As the Android ecosystem encompasses diverse functionalities, including communication, gaming, and navigation, the need to fortify the platform against threats like malware, data breaches, and unauthorized access becomes paramount. Over the years, the Android security community has faced a notable gap concerning path reconstruction and precise automatic interaction. Recent works underscore the necessity of addressing this gap, especially in scenarios where reachability is a critical factor. This is particularly relevant in vulnerability analysis, exploitation, and testing, where intricate Android apps with large code bases pose challenges for reverse engineers. The current manual efforts required to prove the active exploitability of a vulnerability in such apps necessitate a systematic solution. This research introduces GAPS (Graph-based Automated Path Synthesizer), a prototype solution designed to systematically address the reachability problem in Android app analysis using a static approach. GAPS makes several key contributions to the field: Reliable and Scalable Control-Flow Graph Generation: GAPS provides a reliable and scalable method for generating Control-Flow Graphs (CFGs) of applications. The CFGs serve as a foundational element for subsequent path synthesis and validation. Static Reachability Validation: The tool statically validates the reachability of methods by constructing paths backward from a target method to an entry point, leveraging the information encoded in the CFG. Handling Conditional Statements: GAPS addresses paths with conditional statements by identifying and validating states in the app that satisfy the given circumstances. This is a crucial step in ensuring comprehensive path coverage. High-level Instruction Generation: The tool produces high-level instructions to guide interaction and replicate the execution of crafted paths. This feature enhances the reproducibility and comprehensibility of the generated paths. Autonomous Execution and Proof-of-Reachability (PoR): GAPS autonomously executes the extracted operations and verifies PoR upon successful contact with the target method. This automated validation significantly reduces the manual effort required in traditional approaches. The effectiveness of GAPS was evaluated using AndroTest, a widely recognized app dataset in the research community. Results indicate that GAPS successfully reconstructed 25% of paths leading to an entry point, and during automated testing, 33% of them produced a PoR. Additionally, the module addressing conditionally-satisfied paths achieved 60.71% reachable paths and 11.96% with PoR. This research contributes significantly to the Android security landscape by providing a systematic and automated approach to path reconstruction. By addressing the challenges posed by the growing intricacies of Android applications, GAPS enhances the robustness and trustworthiness of the Android platform. The findings underscore the potential of GAPS in improving the efficiency of vulnerability analysis and testing procedures, particularly in the face of evolving complexities in Android applications. The research bridges a critical gap in the Android security community and sets the stage for further advancements in securing the Android ecosystem against emerging threats.
Gianmarco Lusvaldi
tesi magistrale
Università degli studi di Modena e Reggio Emilia
Titolo della tesi
“Timing side-channel attacks against USB smartcards using eBPF”
Relatore
prof. Luca Ferretti e prof. Mirco Marchetti
Abstract
Timing side-channel attacks allow to infer information from the time taken for an algorithm to process it. In cryptography, especially with ECDSA digital signatures, these attacks can compromise the private key through the collection and analysis of the times taken to issue several signatures. The effectiveness of these attacks has been proved in several experimental scenarios, such as the compromise of private keys associated to certificates belonging to HTTPs services, both local and remote ones, and to digital signature systems running on smartcards. The purpose of this thesis is to show the feasibility of these attacks against a smartcard connected to a normal Personal Computer via USB, which is a scenario that has not been studied in detail in literature. In order to analyze the measurement noise due to the systems and their interaction, we compare the timing measurements made on the Personal Computer both in user space and in kernel space. To this end, we study the possibility of measuring signatures timings by using extended Berkeley Packet Filter (eBPF), a technology that allows to develop programs which are executed in kernel space and are typically associated to system events. Specifically, we develop a program that measures timings related to data exchanges between the host and an USB device, directly in kernel space. In order to show the effectiveness of the proposed methodology, we deploy an experimental testbed where the host is a GNU/Linux operating system without any particular precautions to reduce the noise generated by other running processes on the same system. The targeted smartcard is a USB Armory MK-II device flashed with a GoKey firmware, that we modified to be vulnerable against timing side-channel attacks that leak the value of the most significant bits of the signature nonce, and to provide additional information useful for analyzing the efficiency of the attack. We used the signature timings collected by using this testbed as inputs for known mathematical heuristics based on lattices that allow the retrieval of the private key.
La premiazione dei vincitori
Avvenuta in data: 5 settembre 2024
I premiati delle ultime 10 edizioni
Il Premio Tesi è realizzato in collaborazione e con il sostegno di:
