HI-CFG: Construction by binary analysis and application to attack polymorphism

Dan Caselden, Alex Bazhanyuk, Mathias Payer, Stephen McCamant, Dawn Song

Research output: Chapter in Book/Report/Conference proceedingConference contribution

23 Scopus citations

Abstract

Security analysis often requires understanding both the control and data-flow structure of a binary. We introduce a new program representation, a hybrid information- and control-flow graph (HI-CFG), and give algorithms to infer it from an instruction-level trace. As an application, we consider the task of generalizing an attack against a program whose inputs undergo complex transformations before reaching a vulnerability. We apply the HI-CFG to find the parts of the program that implement each transformation, and then generate new attack inputs under a user-specified combination of transformations. Structural knowledge allows our approach to scale to applications that are infeasible with monolithic symbolic execution. Such attack polymorphism shows the insufficiency of any filter that does not support all the same transformations as the vulnerable application. In case studies, we show this attack capability against a PDF viewer and a word processor.

Original languageEnglish (US)
Title of host publicationComputer Security, ESORICS 2013 - 18th European Symposium on Research in Computer Security, Proceedings
Pages164-181
Number of pages18
DOIs
StatePublished - 2013
Event18th European Symposium on Research in Computer Security, ESORICS 2013 - Egham, United Kingdom
Duration: Sep 9 2013Sep 13 2013

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume8134 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Other

Other18th European Symposium on Research in Computer Security, ESORICS 2013
CountryUnited Kingdom
CityEgham
Period9/9/139/13/13

Fingerprint Dive into the research topics of 'HI-CFG: Construction by binary analysis and application to attack polymorphism'. Together they form a unique fingerprint.

  • Cite this

    Caselden, D., Bazhanyuk, A., Payer, M., McCamant, S., & Song, D. (2013). HI-CFG: Construction by binary analysis and application to attack polymorphism. In Computer Security, ESORICS 2013 - 18th European Symposium on Research in Computer Security, Proceedings (pp. 164-181). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 8134 LNCS). https://doi.org/10.1007/978-3-642-40203-6_10