Natch: Определение поверхности атаки программ с помощью отслеживания помеченных данных и интроспекции виртуальных машин

Natch – это инструмент для получения поверхности атаки, то есть поиска исполняемых файлов, динамических библиотек, функций, отвечающих за обработку входных данных (файлов, сетевых пакетов) во время выполнения задачи. Функции из поверхности атаки могут быть причиной уязвимостей, поэтому им следует уделять повышенное внимание. В основе инструмента Natch лежат доработанные методы отслеживания помеченных данных и интроспекции виртуальных машин. Natch построен на базе полносистемного эмулятора QEMU, поэтому позволяет анализировать все компоненты системы, включая ядро ОС и драйверы. Собранные данные визуализируются в графическом интерфейсе SNatch, входящем в поставку инструмента. Построение поверхности атаки может быть встроено в CI/CD для интеграционного и системного тестирования. Уточненная поверхность атаки позволит поднять эффективность технологий функционального тестирования и фаззинга в жизненном цикле безопасного ПО.

1. Климушенкова М.А., Бакулин М.Г. и др. О некоторых ограничениях полносистемного анализа помеченных данных. Труды ИСП РАН, том 28, вып. 6, 2016 г., стр. 11-26 / Klimushenkova M.A., Bakulin M.G. et al. On Some Limitations of Information Flow Tracking in Full-system Emulators. Trudy ISP RAN/Proc. ISP RAS, vol. 28, issue 6, 2016, pp. 11-26 (in Russian). DOI: 10.15514/ISPRAS-2016-28(6)-1.

2. Фурсова Н.И., Довгалюк П.М. и др. Легковесный метод интроспекции виртуальных машин. Программирование, том. 43, вып. 5, 2017 г., стр. 39-47 / Fursova N.I., Dovgalyuk P.M. et al. A lightweight method for virtual machine introspection. Programming and Computer Software, vol. 43, issue 5, 2017, pp. 307–313.

3. Davanian A., Qi Z. et al. DECAF++: Elastic Whole-System Dynamic Taint Analysis. In Proc. of the 22nd International Symposium on Research in Attacks, Intrusions and Defenses (RAID), 2019, pp. 31-45.

4. Dolan-Gavitt B., Leek T. et al. Tappan Zee (North) Bridge: Mining Memory Accesses for Introspection. In Proc. of the 20th ACM Conference on Computer and Communications Security (CCS), 2013, pp. 839-850.

5. Qemu. A generic and open source machine emulator and virtualizer. URL: https://www.qemu.org/.

6. Васильев И.А., Фурсова Н.И. и др. Модули для инструментирования исполняемого кода в симуляторе qemu. Проблемы информационной безопасности. Компьютерные системы, 2015 г., вып. 4, стр. 195-203 / Vasilev I., Fursova N. et al. Modules for instrumenting the executable code in QEMU simulator. Information Security Problems. Computer System, 2015, pp. 195-203 (in Russian).

7. Dovgalyuk P. Deterministic Replay of System's Execution with Multi-target QEMU Simulator for Dynamic Analysis and Reverse Debugging. In Proc. of the 2012 16th European Conference on Software Maintenance and Reengineering, 2012, pp. 553-556.

8. More A., Tapaswi S. Virtual machine introspection: towards bridging the semantic gap. Journal of Cloud Computing, vol. 3, 2014, article no. 16.

9. Dovgalyuk P., Fursova N. et al. QEMU-based Framework for Non-Intrusive Virtual Machine Instrumentation and Introspection. In Proc. of the 11th Joint Meeting on Foundations of Software Engineering, 2017, pp. 944-948.

10. Henderson A., Prakash A. et al. Make It Work, Make It Right, Make It Fast: Building a Platform-neutral Whole-system Dynamic Binary Analysis Platform. In Proc. of the 2014 International Symposium on Software Testing and Analysis, 2014, pp. 248-258.

11. Hizver J., Chiueh T.-C. Real-Time Deep Virtual Machine Introspection and Its Applications. ACM SIGPLAN Notices vol. 49, issue 7, 2014, pp. 3-14

12. Dovgalyuk P., Vasiliev I. et al. Non-intrusive Virtual Machine Analysis and Reverse Debugging with SWAT. In Proc. of the IEEE 20th International Conference on Software Quality, Reliability and Security (QRS), 2020, pp. 196-203.

13. Lin Z., Rhee J. et al. SigGraph: Brute Force Scanning of Kernel Data Structure Instances Using Graph-based Signatures. In Proc. of the Network and Distributed System Security Symposium (NDSS), 2011, 18 p.

14. Schneider C., Pfoh J., Eckert C. Bridging the semantic gap through static code analysis. In Proc. of the 5th European Workshop on Systems Security (EuroSec), 2012, 6 p.

15. Volatility 3: The volatile memory extraction framework. Available at: https://github.com/volatilityfoundation/volatility3, accessed 06.12.2022.

16. LibVMI. Available at: https://libvmi.com/, accessed 06.12.2022.

17. Fu Y., Lin Z. Space traveling across VM: Automatically bridging the semantic gap in virtual machine introspection via online kernel data redirection. In Proc. of the IEEE Symposium on Security and Privacy. 2012, pp. 586-600.

18. Saberi A., Fu Y., Lin Z. Hybrid-bridge: Efficiently bridging the semantic gap in virtual machine introspection via decoupled execution and training memorization. In Proc. of the 21st Annual Network and Distributed System Security Symposium (NDSS’14), 2014, 15 p.

19. Franzen F., Holl T. et al. Katana: Robust, Automated, Binary-Only Forensic Analysis of Linux Memory Snapshots. In Proc. of the 25th International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2022), 2022, 18 p.

20. Zhang S., Meng X., Wang L. An adaptive approach for Linux memory analysis based on kernel code reconstruction. EURASIP Journal on Information Security, 2016, article no. 14, 13 p.

21. Diaphora: A Free and Open Source Program Diffing Tool. Available at: http://diaphora.re/, accessed 06.12.2022.

22. Feng Q., Prakash A. et al. Origen: Automatic extraction of offset-revealing instructions for crossversion memory analysis. In Proc. of the 11th ACM Asia Conference on Computer and Communications Security, 2016, pp. 11-22.

23. Jiang X., Wang X. “Out-of-the-box” Monitoring of VM-based High-Interaction Honeypots. Lecture Notes in Computer Science, vol. 4637, 2007, pp. 198-218.

24. Dolan-Gavitt B., Srivastava A. et al. Robust signatures for kernel data structures. In Proc. of the 16th ACM Conference on Computer and Communications Security, 2009, pp. 566-577.

25. Schwartz E.J., Avgerinos T., Brumley D. All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask). In Proc. of the IEEE Symposium on Security and Privacy, 2010, pp. 317-331.

26. Bakulin M., Klimushenkova M., Egorov D. Dynamic Diluted Taint Analysis for Evaluating Detected Policy Violations. In Proc. of the 2017 Ivannikov ISPRAS Open Conference (ISPRAS), 2017, pp. 22-26.

27. Luk C.-K., Cohn R. et al. Pin: building customized program analysis tools with dynamic instrumentation. ACM SIGPLAN Notices, vol. 40, issue 6, 2005, pp. 190-200.

28. Nethercote N., Seward J. Valgrind: a framework for heavyweight dynamic binary instrumentation. In Proc. of the 28th ACM SIGPLAN Conference on Programming Language Design and Implementation, 2007, pp. 89-100

29. Bruening D., Duesterwald E., Amarasinghe S. Design and implementation of a dynamic optimization framework for Windows. In Proc. of the 4th ACM Workshop on Feedback-Directed and Dynamic Optimization (FDDO-4), 2001, 12 p.

30. Song D., Brumley D. et al. BitBlaze: A new approach to computer security via binary analysis. Lecture Notes in Computer Science, vol. 5352, 2008, pp. 1-25.

31. Henderson A., Lok Y. et al. DECAF: A Platform-Neutral Whole-System Dynamic Binary Analysis Platform. IEEE Transactions on Software Engineering, vol. 43, issue 2, 2017, pp. 164-184.

32. Python scriptable Reverse Engineering Sandbox, a Virtual Machine instrumentation and inspection framework based on QEMU. Available at: https://github.com/Cisco-Talos/pyrebox, accessed 03.11.2022.

33. Zeng J., Fu Y., Lin Z. PEMU: A Pin Highly Compatible Out-of-VM Dynamic Binary Instrumentation Framework. ACM SIGPLAN Notices, vol. 50, issue 7, 2015, pp 147-160.

34. Stallman R.M. and the GCC Developer Community. Using the GNU Compiler Collection (GCC). Available at: https://gcc.gnu.org/onlinedocs/gcc-9.2.0/gcc.pdf, accessed 03.11.2022.

35. Lighthouse - A Coverage Explorer for Reverse Engineers. Available at: https://github.com/gaasedelen/lighthouse/, accessed 03.11.2022

36. Blasum H., Görgen F., Urban J. Gcov on an embedded system. In Proc. of the International Workshop on GCC for Research in Embedded and Parallel Systems (GREPS'07), 2007, 4 p.

37. Husain A. Un-bee-lievable Performance: Fast Coverage-guided Fuzzing with Honeybee and Intel Processor Trace. Available at: https://blog.trailofbits.com/2021/03/19/un-bee-lievable-performance-fast-coverage-guided-fuzzing-with-honeybee-and-intel-processor-trace/, accessed 03.11.2022.

38. IDA Pro, Available at: https://www.hexrays.com/ida-pro/, accessed 03.11.2022

39. Yin H., Song D. et al. Panorama: capturing system-wide information flow for malware detection and analysis. In Proc. of the 14th ACM conference on Computer and communications security (CCS '07), 2007. Pp. 116-127.

40. King S.T., Chen P.M. Backtracking intrusions. In Proc. of the 19th ACM Symposium on Operating Systems Principles, 2003, pp. 223–236.

41. Goel A., Po K. et al. The taser intrusion recovery system. In Proc. of the 20th ACM Symposium on Operating Systems Principles, 2005, pp. 163-176.

42. Ma S., Zhang X., Xu D. Protracer: Towards practical provenance tracing by alternating between logging and tainting. In Proc. of the Network and Distributed System Security Symposium, 2016, 15 p.

43. Ji Y., Lee S. et al. RAIN: Refinable attack investigation with on-demand inter-process information flow tracking. In Proc. of the ACM SIGSAC Conference on Computer and Communications Security, 2017, pp. 377–390.