Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/590 Thanks!
OK, Rod, so
these are Antonio, Jacobo
and Andrew from the shellfish
team, which is from
the UC Santa Barbara,
and they will
talk to you today about
a dozen of years of shellfish.
And I have to read that subtable from
DEFCON to Darbar Cyber Grand Challenge
and how they automatically
exploit stuff.
So if you give a warm applause.
All right, thanks a lot for the intro.
So I'd like to continue
with saying, who the hell is shellfish?
So shellfish is a team of
security enthusiasts that
has has started in UC Santa
Barbara some time ago.
Now, the original version of these lide
actually said that shellfish is a hacking
team and there are lots of Italian
indebt. But then my colleague Antonio
pointed out that putting hacking team in
Italian could have maybe they should
also do something bad.
So we are not related to that hacking
team. We actually most of us
do research in system security.
What it means is that they are we
are based many of our team members are
based in research labs and they
publish papers that try to improve the
state of the art of what is known in
computer security.
But we also play as team shellfish.
Many capture the flag competitions.
As a matter of fact, we have even
released a couple of the tools
that we use, both in system
security and in capsid flag competitions.
Some of you may may have used in the past
the publicly available Anubis and we
it so you could submit a
binary to our website and see how they
worked. And today we're also going
to speak in a little bit more detail
of anger, a tool that
we have released that team
members in the lab that I've worked on it
have released recently.
So just to brag a little more, who
is shellfish? Qaddafi's was born in that
little building in the UC
Santa Barbara, well known as
the only university that owns a private
beach and that has has
a reputation as a party school.
I actually got this comment from a flight
attendant on a flight.
So it definitely has some bad reputation.
But believe it or not, it's actually a
very good research university that has
employed several Nobel prizes, none
of which are in this room.
And the self-esteem
has also expanded through its
alumni to other
research labs, such as people in Boston
who never see the Sun and UNIKOM
in France, in Europe.
And as you can see, we are relatively
international team.
We have the majority of players are
originally from Europe.
Of course, we have a good representative
of people from the U.S., some very
great hackers from China and Asia,
Brazil, Senegal.
And unfortunately, we have no one from
Oceania, if you want to.
We are very open to recruit people.
Join one of our research labs
as a team. As I was saying, we play
CTF. So I'm sure
many of you have already played capture
the flag competition.
So I'm just going to give out very
minimal primer. It is going to be useful
for us later.
CTF is a security competition in which
you do you are presented
with a challenge, can be a binary
program, a service, a website, sometimes
even a harder device.
And there are many variations.
But the basic idea is that you
understand how that works.
You find where the secret is.
You steal from the other guys or from the
challenge. You submit it to the
organizers and you get points.
And
this has participated in many
cities have to you that yes,
it has even one that can finance.
In 2006.
None of us were actually on the team at
the time, but it's
in a sense good memory.
But we do
not only play Stiff's,
if you you may be familiar with the UCSB
ETF, ETF is
an attack defense ETF in which you not
only crack
programs to steal the secrets from
Otter's, you also have to defend
yourself and patch the binaries
that other teams cannot steal
secrets from you. But the service is
still functional.
And
Jovani was
the originator of the ETF.
It used to be, as a matter of fact, the
final of the security class of
Giovannoni, and it has
evolved many, many times over the years.
The ETF has in many ways
tried to innovate with a different style
every year.
Some years have been very
well, have worked very well, some other
years have not worked out well.
We have in a sense, we have had many,
many discussions even internally, I can
assure you of that.
But we have, in a sense, embraced the
nickname of Carlotti shitstorm.
And we have gone with the very,
in my opinion, very brave and very good
attempts to innovate.
I have played in the last year, for
instance, you know, we have tried to give
higher importance to emphasize the
importance of network defense, for
instance, or try to see what
teams would do if presented with a huge
number of 42 services and to
see what they try to sort of defend
all of them with the same approach,
attack all of them with the same
approach. And in the latest year, we've
even gone with the.
Football player versus players,
player versus player, even the
programs themselves were written by the
players of the competition itself.
So if you want to hear more about the
ISEF, our base
framework is the
base framework that we use for the
competition has been released in open
source. We are in the process of
preparing the new version.
And you can also read
our paper of 10 years of ISEF
to see to get a little glimpse of what
has been done over the years.
But let's get back to the juicy stuff.
So why the hell are we here?
Why should we be listening to us?
Basically, we want to show essentially
how you can go from this
to this.
And we've been told this is
a very American the idea and say,
you know, you guys have really gone
America. And if you're showing these.
But I'd like to to have you know,
that most of these notes are actually one
dollar and five.
I think there's a five dollar a year
that's down there. So it's not actually
that much money.
But she it on
a more serious note, she's actually has
won some money by participating
to the Diaper
Grivna Grant Cyber Grand Challenge.
And we're going to explain a little bit
to you what that is, what it involves.
And then we're going to do go a little
bit more in detail and give you an idea
of how we decided to play the
competition.
And we're going to give not all the
components of the public for obvious
reasons. We don't want to make the life
too easy for our competitors.
But we're going to do give you an idea of
some ways that you can use to
automatically discover vulnerabilities.
And in particular, we're going to give
you a live example.
Using anger.
Anger is an open source,
binary analysis framework that can do
many things even more than we have used
for the CDC and obviously many
more than we are going to show you in the
live demo.
And it's an open source framework that
you can use yourself, as a matter
of fact, if you're interested in anger.
And so also becoming very rich,
you can join us
later. After this talk, we are going to
organize a workshop and jury is going to
be in charge in all
13 one three.
It's on the first floor.
So if you want, you can join us later.
We'll give you more details about that
later.
And finally, we're going to give you a
hint of what are the next steps
that we're going to take that teams are
going to take to participate
to the finals of the cyber grandstand
at Cyber Grand Challenge.
As you can see, we're also very fond
of acronyms like DOGPILE,
so.
Let's start with the basic idea, so I
think most of you guys have heard of
Dorper, a research
agency by a
part of the Department of Defense of the
United States of America.
If many of you may be familiar with the
role that it has played in the
creation and evolution of the Internet.
And DARPA's mission
is, in a sense, to,
among other things, push
forward research in
approaching interesting problems.
And occasionally the
probably the most famous one that you may
have even heard in the press is
that in 2004, they started
a grand challenge.
No one was able to do it before,
make a car that can start at a certain
point and alone, completely
alone, autonomously drive from
point A to point B.
And, you know, nowadays we here
there are many very good
products on making self-driving vehicles,
many of which are actually realized in
2004, believe it was not easy
at all.
As a matter of fact, in this 2004
grand challenge, none of the vehicles
actually reached the finish line.
So in a sense that as
in a way found a problem
that no one was solved and tried to push
forward to see. I challenge you.
Can you show me show me what you can do
to face this challenge?
But now, as I was saying, there are there
are cars that do that.
So now in 2014, Diba
is decided to start a cyber grand
challenge.
And once again, it is
completely autonomous, completely
autonomous exploitation
and patching other programs.
And yes, what you see right there is a
competitor. So as a team,
you have these array of servers
free to do whatever you want with them,
but you have to play a game
and the game is what we're going to talk
in this little next slide.
But first, let's just give you an idea
of the current progress of the
competition.
And the qualification has already
taken place.
It was in June this year.
Seven teams originally
joined the challenge
and seven teams have been selected
as qualifiers after this,
after the qualification event, the finals
will be August next
year and will take place at Def Con
in Vegas the day before the
finals. And as a matter of fact,
the winning system
will play against
the humans. And let's hope for the best
that the humans still win, because
otherwise we're going to have quite a bit
of problem and
we're going to go a little more into
details. But if you want
an intro, in a sense, a more usable
into that prize, a very nice website,
very flashy in the sense at
Cyber Grand Challenge dot com.
So let's talk about a moment, more
about what is
the CDC, so no
surprises and a top defense, ATF
explosive patch.
And again, you probably, as you can
probably imagine, the way you participate
as a team is not that you're giving
a program. You look at the program and
you exploited.
And it's not even that you look at that
program. You right.
The program that exploits
that guy that you've read, the Python
script that exploits the specific
problem, what you need to do
is you need to develop a system
that is going to be fed some
programs and automatically without
human intervention, will find
vulnerabilities, exploit
and patch them.
OK.
Sounds simple, easy.
It's not that much it's
actually interesting, I like
to take a moment and how would you play?
What would you do?
It's an interesting it's an interesting
question. And it's what in part
led us to to work
on this. But I would like also you to
reflect for a moment that this is also
not that trivial to organize.
And I think Dadfar, in a sense,
mattered some phrase in the sense that
they have had to take some interesting
choices. For instance, how will you prove
that the
binary was exploited?
Now, as you were saying before, you know,
classics said, yes, you're even a binary
and, you know, maybe the binary.
There's a flat there's a file called
flag. You need to read the flag or you
examine the thing. You see orders, a
winning message and there's a losing
message. I need to make the program the
winning message, or maybe it's
a storage server.
And the secrets are secrets
that are stored in these files that have
certain names and so on and so on and so
forth.
As you can imagine, this is a
lot more complication for our program
to analyze is useless complication
in a sense, so that
if I introduced for the calls for the
qualification round a very simple
way to define what is an exploit.
You have exploited a program and you
demonstrate that you have exploited it by
giving an input that will crash
the program, segmentation fault,
whatever, if you the benign
program will not crash.
If you make the program crash good,
you find you found an exploit and
you're going to get the points for the
exploit.
Easy, is it easy?
Well, don't forget that the competition
also includes a defense component,
so.
What are you going to what do you think
is going to be the defense, which is just
going to be that, you know, the problem
just needs to run until the end?
I mean, if it if it doesn't crash and it
doesn't time out, it's good.
I mean, obviously, you could say, well,
yeah, that would work. But then I can
just submit this as a patch program
and believe, you know, this
is the what is usually if you have placed
on these steps, you may have heard a
term, the SUPAMAN defense.
Usually in this competition you want
to avoid organizers and even players,
of course, want to avoid
defense systems that work every
time. No, no skill
required or very little skill required or
in a sense of working every binary.
So how do you prevent this
from happening? Well,
this one is relatively easy.
Basically, you need to put in some
functionality checks.
So that means that whoever writes
the program, not only
you write the code of the program, not
only you put in a vulnerability in the
program, you also need to put
in a
some scripts that will check the
functionality of the service.
For instance, if the service is a
palindrome finder, you need to write
some scripts that send words and
see if the program correctly says
palindrome, not a palindrome
and goes on and on.
And of course, you also want
to make sure that these checks are
in a way meaningful and not
easily patched.
For instance, the program just admits
to good value of
inputs and to easy answers to
those two or even complicated answer.
Then you want to avoid that.
You know, the team can
pad just by thinking.
And if these
input, then these output, if these are
important, these outputs, otherwise exit
zero. So, again,
this takes a little bit more skill then
than it sounds.
This was a secret.
No, what
is another way that you can be the
supermen defense?
Another way is that you could have
what is called a
out-of-band error handling.
So you're running the service.
You're running the program.
The program, for instance,
tries to use a
unmapped address
and the program is going to get the
segmentation fault.
And ordinarily, this would be considered
a crash. But if I can install
a signal handler, then I can turn all
these crashes into benign
exits. And since I know that
for benign inputs, the program will never
do a zigzag, I'm sure
that I can do exit zero without
compromising the functionality check.
So once again, Superman defends
my program cannot be exploited.
And the solution for this is that in
a sense, or at least the solution to
diaper for this is that
there is no out of then error handling.
There's no at least no easy way to do
out of an exception handling
error handling.
But as many of you may be
familiar with terms such as liberty
or an emulator or like Mommy,
for instance, the emulator for consoles,
what would prevent me from writing
an interpreter so
I don't actually run the electronics
instructions, you understand?
Like I can run these instructions in
my little VM, my little VMware
or Virtual Box or mommy.
And whenever I detect
that the CPU would raise
an exception, for instance, because it's
again, segmentation for the
out of accessing a map
memory division by zero, whatever.
Again, I'm going to exit zero
now. Please take a moment.
How would you prevent me from doing this?
It's not as easy as it sounds
and in my opinion, took the elegant
and also very correct solution,
you don't this is perfectly
allowed in Davos.
Did you see there the
the point is that you pay for that.
So sure, you can do
whatever you want. You can even write an
entire
binary translation platform.
In fact, one
of the qualifying teams
non-qualified been sorry, trail of tweets
actually did something close
to this. We obviously don't know the full
details, but they did a
translation and LVM intermediate
and they went back. And I encourage you
to read the blog post from them because
they know it,
not because it's a stupid way.
It's actually a very good way.
And you will see that in a sense, you
run into a risk that
you need to make a very good estimate
of what's the cost of the defense
that you're putting in.
If the defense that you're putting in
ends up consuming too much CPU or maybe
too much memory, then
you may lose points in your ad.
Even if your defense is perfect in
itself, you may lose you may have
lost points in this.
And I'm just going to give you a couple
of extra ideas of the competition.
Obviously, you want the competition to
work on real
estate programs.
You want programs that can do more
or less what the programs have run on
our laptops can do.
So know a little world
already, but we also don't want
extra complication.
And what do I mean by
this? It's a little fuzzy as a term, but
basically you need to think of this, that
the advantage,
the work that the teams are going to put
and the advantage that you're going to
take by looking at how they do things,
things have a limited amount of time.
So do you really want to modeling
the team to spend a ton
of time modeling the entire,
you know, horrible things like
interruptible Ciscos or
an entire model of filesystem
and so on and so forth?
So usually not
you need to find some sort of compromise.
And again, I think Dorper found
a good compromise here.
The architecture that is being used is
regular Intel execs,
all, of course, all usual, and
of course, at the very least are fair
game. So all the problems
that I'm sure you're familiar with, such
as problems in disassembly and so on and
so forth, are all there.
So it's very realistic.
But the OS is
somewhat limited form of a
Linux like Unix like operating
system. As you can see, you have some
basic Cisco transmit and receive
there, basically read and write
from from the standard even
started out and sockets
that connect programs together.
You also have a form of select that also
allows you to sleep.
Wait, you have some form
of mallock and
and unmap so to speak.
But these can even allow you to write
to map executable code
pages. So if you want, you can even write
a Just-In-Time compiler in these,
in these, in these architecture,
you have randomness.
You have the way obviously to exit
the program.
Probably the biggest
simplification with respect to
the capabilities of a Fool
Real World Linux program is that there's
no shared memory, no threats with shared
memory.
A particularly interesting,
at least to me, is that I took
to bring your own defense approach really
to the to the maximum extent.
So you do not even
have by default, the
usual, so to speak, the defenses that are
common nowadays. So the standard is
executable like it was ages ago.
There's no way you Selli, there's no
nothing. You want this stuff.
You have to bring it.
You have to patch your program,
modify your program so that it has them.
I, I think it was an interesting,
interesting idea from Dorper.
And as we have seen in the case, in the
trial of each case, this brings with
itself some non-trivial choices
on the on the team side.
So now we're going to give you I'm going
to pass the torch to my colleague
Antonio and who's going to introduce
a little bit our cyber reasoning
system. So our the way we
play the game.
So, so
so I'm going to introduce the cyber
reasoning system we developed that what
is a cyber reasoning system is just the
way to define the system.
We have we had to develop to participate
to to CDC.
And so as Akobo introduced
as an input, we have a list of binaries
and four for each one of these binary
we need to produce and exploit.
That is an input that is going to make
this a binary crash and
a patch version of this binary that is
immune to these exploits, but
still preserve at least some
functionality.
And so let's see our system a little
bit more in detail.
So we have
basically the the vulnerable binaries
are passed to an automatic vulnerability
finding component.
That is of that is, as the name
says, trying to automatically
find vulnerabilities
into these binaries.
And then both the exploits generated
by the system and the vulnerable.
Binary binaries are passed
to an automatic PATCHIN component that
is trying to generate the
patched version of these binaries.
And, of course, and some of the
strategies actually require
exploits to generate a
patched version of a binary that immune
against this specific exploit.
So that's the reason that herel
and the both proposed exploit
and proposed patches are evaluated by
another component that is
evaluating them in terms of how
how good a patch version is, is it
preserving functionalities is crashin
because there was some bog in our system.
So we are evaluating this.
And of course, the best exploit and the
best patches and the best patch
we have for a specific binary is
finally some meta data
to support for for their evaluation.
So that's the general idea of
our system.
And for the next of the presentation,
we are going to focus on the automated
vulnerability component.
And so let's see
what we do. So
so, yeah, for for the qualification,
remember that an exploit is
just a program that is making is just
an input that is making your binary
Kresh. So
that that's the question we want to
answer. I'll do a crash, a binary.
But this question is somehow
a subset of of a bigger question,
of a much more difficult question.
It is how do I reach a specific
state within the execution
of a binary?
So this is a undecidable
problem in the in the general sense.
But there are some approaches that can
solve this problem in
a good amount of cases.
And so and
these are the two approaches we we we
used. So one is a fazing
and the other one is a symbolic
execution.
So let's see for
ourselves how these two approaches
work in general and then how
we we use them.
So about fazing.
So the question there.
So as I say, the question
we want to answer in January is how do I
reach a state within a program?
And if you see at these A that
I put in the in the slide, we have
a very simple problem program that is
getting an input from the user,
putting in a variable hex.
Then it does two different checks
and then you can either print, you win or
lose. So suppose that we want to
understand how the text you
win is printed, which is
which is the input we need to provide to
to reach that state.
So, of course, the easiest thing we can
do is just to test a lot of inputs
so we can try with one.
And you lose this print that we can try
to steal.
You lose. But when you try
when we try, we then we will reach
that extraction. So our
we will reach the state we were looking
for. So fazing
is in the in the simple way is just
trying a lot of different inputs.
But specifically for for
you see we used
we use fazing and we use a way
of a method called
coverage guided fazing.
That means that the execution
of the program, the program
was executed in a instrumenting
environment environment that was taking
track of how much a
given input.
It was a covering of the
entire code base of the binary.
And this system was focusing
on basically on those
inputs that were more promising.
So those inputs that were increasing the
most the general coverage of the of
the program. So our system was based
on an. Already existing system called AFL
that the link to the original version
of AFL and
this season was really was effective.
But there are also
there are specific cases in which this
system cannot work or at
least cannot work efficiently.
So let's see an example.
So, yeah, we have the same code as
before.
But there is one difference
in the second in the second condition,
destruction. So, yeah, X is
the square of X needs to be
equal to to that big
constant value.
So of course it's really unlikely that
just by trying a lot
of different inputs, we will actually
find Baylock or by
any method, the
specific solution of that
equation.
So as a possible
solution, we can use a
symbolic execution.
So let's go back for a second to the four
to the original example.
So the general idea of symbolic execution
is to interpret the binary code
and replace user input with symbolic
variables. So the first distraction
is getting some input from the user.
We don't know what the user is
putting here as a as in the general
case. And so our symbolic
execution engine will just keep track of
these by putting a variable X
within the current state of the
execution.
So then we go on executing the program
normally.
And but of course, if we if we
if we reach a conditional
extraction like this, we don't know which
kind which of the two branches we
need to take because we don't know the
value of of of X..
So what we do here is that we take both
branches, we take both branches,
but we we keep track of the constrain
that a branch is
is is putting on a specific
path. So in the part in which
in the in the first branch
of these conditional instruction, of
course, if we take it hex needs
to be bigger or equal, then 10
and in the other X needs to be less
than 10. So
the execution goes on keeping track
of these constraints.
So suppose that now we symbolically
execute starting from the state
on the left. So now we encounter
a second and second conditional
structure.
And as before we generate
two different states in one X,
we have an additional constraints.
We have an additional constraint.
The size X needs to be less than one
hundred. And in the other state we have a
constraint that says X
needs to be bigger or equal than 100.
So but now we reach actually the
condition we were looking for that is in
this case, the text you win is
printed. So when we reach a condition
that we were looking for, we can ask to
the symbolic execution engine to actually
to to concretize this input.
That is to give us a name,
to give us a a concrete value
to satisfy both constraints in
this case. Ninety nine.
And if you in fact put ninety nine
as an input, you will reach that
condition.
And of course if we go to the more
complicated example for the symbolic
execution is not hengjun is not that
complicated to deal with this, that we
just have a different constraint.
But still any symbolic
software can still solve these equations
and give the correct answer.
That is one, two, three, four, five.
So we use a symbolic execution
for Kgosi. In particular, we use the
symbolic execution, energy of
anger that is the binary platform,
develop the binary platform,
develop at UCSB.
And in particular we were looking for to
for two different conditions.
So one is memory accesses
outside the allocated regions
and the other was unconstrained
extraction point.
So unconstrained instruction pointer
means you have, for instance, in jump
instruction that is jumping to the
value of a register.
By the way, of that register is
coming from the user input.
So the symbolic execution engine doesn't
know where to jump.
So why we are looking for these two
conditions? Well, because if you reach
one of these two conditions, it means
that you also found a crash
in input that will make the program
crash, either because the program,
given that input, will access and
not allocate the memory or will just
jump to nonexisting
code.
And so as a as in a
general idea, so we we for
for the final we are exploring the idea
of combining the two approaches.
And in particular, repaper paper has been
has been accepted at the ENDS conference
and it will be published in February
and it will be presented in February.
At the end, you assess just to give you a
preview of the results of that paper.
So if these are the entire binaries
we had to solve for for Kgosi
before the qualification, these are
in scale, more or less.
So these are the amount of buys we
found we can
find a saw, an exploit
using fazing these the amount of binary
we can find
and exploit using symbolic execution.
But combining the two, we can
find even more binaries, even
more exploits.
And so the bigger circle
is the amount of binary of
binary that we were able to exploit using
these new approach. So I suggest you to
to read the paper as soon as it will be
published.
So, OK, now
Andrew will introduce Sangar and
he will give us a live demo.
Hello, I'm audible good,
I'm going to talk about anger, I'm angry
one anger is a
pretty to
the Python library.
You use it, it has code, you
can run the code and it does binary
analysis.
It does all the things that AntÃ´nio just
finished talking about and more.
It's open source because we believe in
that sort of thing.
And it's interesting
to note that the anger started because of
one of the other graduate students in our
lab wanted to do a project on firmware
analysis and got carried away.
And since then, that project has grown
and become adapted to CJC
and Linux binaries and all those
different architectures. So it's had its
the multi-platform is baked in
from the beginning.
And as I said, and it is written in
Python, this is just because we're a
research lab. We need to move fast and
break things.
We don't really have
the luxury to program in something like
C++ or Cambell, not that we never want
to.
And because of the magic of Linux
and the Python package index, you two can
have it with those one and maybe two
commands. One is if you're willing to
forgo the support
we were providing you.
So what I'm going to do here is I'm going
to demonstrate using
anger to automatically find
vulnerabilities. The automatic part
is we'll see.
So we're going to show off the finding
the the grub back.
Twenty eight vulnerability, which you may
have seen recently.
There's been a lot of news coverage about
a vulnerability in the grand unified
bootloader versions, one point nine eight
through 2.0 to that.
If you press backspace twenty
eight times and then return on
the grab password username
prompt, you will get a rescue shell,
which is an interesting vulnerability and
it is due to an unchecked integer
underflow in the username
and password input function.
So as you can see on the screen,
there's a link to the actual write up of
this vulnerability, which we
copied a lot of stuff from for the
explanation and the specific
vulnerable part of the code doesn't
change flows instead of simply decrements
the index into the current
input buffer.
So then later in the function.
And what it does is it clears the
unused parts of the buffer with
this memo set command.
And the problem
is that is that you can make
the current length negative.
So if you make the length negative, all
of a sudden the it's
it's meme's setting other parts
of the stack like the return address.
So if it's someone that sets that all the
zero, then it's
the program is going to jump to zero
and crash, except that
this is an X eighty-six six, very
low level stuff.
And somehow this is possible.
The explanation of why this is this can
be exploited successfully as well outside
the scope of this talk.
But please read that right up.
It's very nice.
So finding this automatically
is going to be very difficult because
you see on there on the screen is a
control flow graph with the vulnerable
function in the grubbed binaries.
And as you can see, it's got a big loop
with a whole bunch of paths.
And if you take a symbolic executer
and throw it at this problem and say,
find me a crashing input, the universe
is going to grow old and die for anything
interesting happens.
It's too much state.
You're going to go through the loop once
you're going to produce ten successor
states, each one of which has gone
through the loop, then each of those ten
needs to be put through the loop again.
They will all each generate ten children
and you're going to have an exponential
state explosion and
your computer is going to run out of RAM
realistically.
So I have a demonstration
here of
the naive approach of symbolic execution
of the grubbed naive Greb naive script,
which is just a using anger as a
naive, symbolic executer.
So most of this
most of this is simply setting up the
grubstake, because we are we
realistically cannot execute
symbolically grubbed from the very
beginning of the program.
So we we choose to
start our execution in the program.
This is something the anger can do.
You can construct a
you can construct your own state,
which is the land that does the state
construction.
It's down here.
It just constructs a blank, a blank
slate blank state
that you can use to simply symbolically
execute as as symbolically
as you like, and then simply
simply
steps the path group until
it finds until it
finds something that has jumped
to zero.
And as we see here.
I've also said it to print out its
current internal anger state at
every step, we can see
that very quickly.
It's starting up.
Its executing lots and
lots of symbolic states.
You can see that the active number is
becoming larger and larger as the program
slows down more and more.
And if we look at my memory consumption
and can see that it's slowly going up and
it's going to run out eventually, we're
not going to let it get there because I
like this computer.
Enjoy. So in general, the security
community has attempted to solve
this kind of state explosion problem
in Loop's with a technique called verra
testing. That's from Carnegie Mellon
University paper.
Angry implements this.
I tried it. It doesn't work because.
If it simply generates too much
complexity for the constraint solver to
handle, it's a bit more of a technical
discussion that we can have later in the
workshop.
However, anger
does let you solve this problem
because because
symbolic execution is powerful, but it's
really dumb.
It's going to take
spend all this time computing things that
don't need to be computed.
But and and so
you on the other hand, you are very
clever and you know how to smartly
navigate the state space of this program
in order to not waste your effort.
But there is no way that you could
realistically do that with the precision
and care of a symbolic
executer. So the solution is anger.
Anger provides an interface for you to
channel your anger, effectively,
express your feelings, you know, to be
true.
So what you can do in order to solve
this vulnerability, this is what I did
last night to prepare for this demo is
to to manually examine all
of the surplus of
symbolic states that anger produces
and figure out what's going
wrong. And you can see that it's doing
all sorts of things that you would never
do if you were personally exploring
the state of space program, like entering
several letters in a row and then doing
and pressing the home button multiple
times. And you don't need to do that.
Yes.
So what you can do
is you can just tell anger, to not do
these things in anger provides
the power of anger, that it provides
reasonable interfaces for you to do this
more easily. I took my previous example,
the naive approach added 10
lines of code and
it finds the bugs were going to
demonstrate.
So we say grab
a bug and it still
prints out. But now you can see that it's
finding a whole bunch of not unique parts
of it's discarding. Now, the computation
load is very easy for the
symbolic executer process, and
it finds the crashing input, which is
twenty eight backspaces and a return.
So that's a laugh, the demo, just a
couple of side notes that
this is I am
you, if you look at the
if you look at the script itself, you can
see at the top it's straight up loading
the graph executable out of my operating
system. I have an upgraded system
upgrade in several months. I'm still
vulnerable. Please don't hack me.
But what about I was previously
doing as I was previously using trying to
exploit the 64 bit version and it didn't
work because this exploit doesn't work on
64 bit systems because of the way the
compiler uses R, X, X and it's
a mess. But I didn't know this until I
had written the entire exploit and
found that it didn't work.
So after a little bit of manual and also
I realized this was the reason, so I just
switched over to the 32 bit version
and all I had to do in the anger script
was change the word sizes and
the program address.
Anger is incredibly versatile and it can
handle all different kinds of programs
and handle binary blobs.
It can handle firmware images, it can
handle P and Elf and
maybe Marco files.
And I don't know, there's
my opinion is the power of anger in the
in the interface.
And I recognize that this is a very
dissonant message from what we were
talking about earlier with the automated
hacking stuff.
But the point is that this
is why the cyber grand challenge is
hard. The secret sauce in our series
is not something that we can talk about
under penalty from my
professor can't do it.
And that's so.
So I'm emphasizing how
user how user friendly anger is,
because that's the way that you're going
to be using it. We're going to be using
it as an automated system,
which is a lot of really complicated
algorithms.
That's all I have to send back to
one of the two I forget which to talk
about the finals of the cybercrime
challenge.
So let's go back to something
a little bit less technical.
So
we so we play the qualification
seven times best as the actual state
championship was one of them.
In particular, we exploited forty four
binaries out of the one hundred thirty
one provided by dorper
and every qualified team receive
seven hundred fifty thousand dollars as a
prize. So that is a good thing to have
and.
OK, so for
the finals, this top of the competition
will be different, in particular,
many different, many things will be
different. So the the finals
will be around this attack defense staff.
So for the qualification, we just receive
all the binaries.
And then we had 24 hours to automatically
find exploits, patch them and
submit these these patches and these
exploits to ta ta da.
Instead, here, it's a round base attack
defense in which at every round we
receive new attacks from other teams
and we can submit new patches.
So the date is not
100 percent finalized right now, but
they will probably be no possibility of
human intervention or very limited
possibility of human intervention,
whereas during the qualification phase
it was at least possible to fix
bugs. For instance, if you forget to
put the file as executable
because you didn't leave for the previous
week. So something like that.
And maybe there may be some possibility
of back fixing even during the finals,
because, of course, everyone wants to
avoid that. You work for two years
on something, then you forgot you forget
some a semicolon and all
your work is pointless since
something like this happened for the for
the grand challenge with cars.
So they may want to avoid this
and somehow but they don't want you to
adapt to exploit sand
by the other teams. So you need to
balance these two things.
So another interesting point
is that data about previous rounds is
available. So first of all,
you submit exploits and patch in
patch version of binaries and you can
get from the system the performance
they are the they have.
So you can adapt based on that,
but also anonymized traffic
sent by other teams against you.
You can receive it and you can analyze it
and you can even receive at everything
patches that other teams patch
at version of binaries that other teams
submitted. So this brings to
a lot of interesting scenarios
in which you may be able to still patch
binaries from other teams you made me
even able to still exploit.
So there is some probably some meta
gaming you may want to do about deciding
how to patch, what to patch.
Maybe you can just steal a patch or and
and wait before
the before deploying your patch.
We don't we don't know yet, but there
may be some meta gaming we need
to reason about it.
And yes,
also these important exploits are going
to be different.
So for the qualification in it
was just an input that was making your
program crash for the finals.
There would be two different types of
exploits.
So the pipeline is basically
in this. Pleitez is a
is some code that receive
a specific location and specific
register and the specific value from the
organizer. And then this code generates
an input for a binary that is making
the binary crash at that specific
location and also setting a
register to a specific value.
So this is somehow a way to the
DA has to check that you can
reach a state in which you
you actually exploited the binary.
So the binary is under
your almost full control.
Also, another kind of exploit is a
type to exploit in which you have to
leak data from a specific memory
page provided by the organizer.
And so for this, we we
will need some more realistic supplied
generation.
And we are working on using HANGA
to do something different, that is to
automatically generate a chain
as a part of the exploit.
Also, as in addition to all of this,
there will be the possibility to deploy
network level filtering rules.
So during the competition, there will be
an intrusion detection system from
for which you can provide rules that
prevent traffic to reach your services.
And for instance, a rule can be if
a packet says the string, just
block it. But of course, you want to
deploy these rules, but in a way that
you are not impacting the functionality
of your services.
So it is a completely new area we
have to explore.
So every team has access to a class
on one thousand two hundred eighty cores,
sixteen terabyte of RAM and 128
terabyte of storage.
It is a picture of one of it.
And so right now we can access to this
through S.H.
But for the finance, they will bring
seven of these to two,
one for each team to the
hotel where that is.
And so it seems that we also bring
a halfa megawatt generator to
power all these things and cool them
and.
And so, of course, the first thing we did
when we we got access was to run
a stop and then we spent
another two hours trying to run a stop on
all of them at the same time.
Using using Terminator.
Yes, that's a huge screen shot of like
5000 pixels, something like that.
So, OK, so finance
will be it will take place in August
2016 at Def Con, Las Vegas.
That would be money prizes.
So the first place is two million
dollars. Second place, one million
dollars to a surplus is a seven
hundred fifty thousand dollars.
And as Yakupov say, the winning team will
compete against human teams at Def
Con City finals.
And it seems that the winning team will
have access to the entire seven clusters.
So the winning team will have access to
something about 100 terabytes of
RAM, something like that.
So and it will try to compete
against humans. So we don't know.
So because of this, because of this,
it seems that next year
going to finance all the binaries
for for the finals will follow
the CDC format so
that humans and
these automatic systems can play
against each other.
And so I just want to conclude with
a picture with all of the
whole of shellfish
persons that contributed for the
qualification.
You can also see my Photoshop
skills.
And and
so then since the qualification
either to members
started working on this and
as you can see, we are from all over
the world and Italians, the number
of Italians surpassed the number of
Americans and
OK.
And so we will have a
workshop after this talk
in all 13.
And so let's bring your laptop
and we will show you a lot of things so
ultrathin. I have a map, but
it's really hard to find rooms here.
So just follow us.
I think that's the easiest way.
And yes, really not that hard.
Yeah, yeah, yeah, yes.
Elevator and go across the hall.
It says there's a way.
Good. And we are going to show probably
some easy example that you can you
can just do it by yourself and then
probably you are going to maybe show more
details. What anger, what
Andrew showed us during
the demo.
And with this, I put some references
in the presentation at Def
Con. It's on YouTube.
That's pretty interesting.
If you are interested on the side, you
see, I put our emails, some
websites, and so we are ready to answer
to your questions.
Thank you. Thank you very much.
That is a good thing you can leave
if you absolutely need to.
Please be quiet while doing so
and only do it with these stage
exits. So
keep the voices down.
You don't need your voices to leave
the room so that
people who want to ask questions can ask
questions.
So if
there's a bit of turmoil
now, we wait a few seconds
until that clears up.
Seemed just for the info,
there are how many questions from the
Internet? OK, I get that.
OK, so do not waste any
time for the Q&A, we will just start.
So let's have the first
question from the front microphone
on the right side, please.
Hi. I'm from one of the other
teams who have previously participated
in DEFCON.
My question is, previously
it has been kind of hard to get
to get funding for
security research, at least
at least if you're doing CGF like stuff.
Why do you think DARPA has
put this huge amount of money into
into this type of challenge?
Is what do you think their motivation for
doing that is
to have NASA?
Well, I mean, on one side, I guess you
could say that maybe the situation has
evolved enough.
And I mean, if you follow, for instance,
the
AFL has definitely proven that it can
find many, many bugs almost
automatically.
If you follow the conferences,
you see that static analysis
has made
many, many improvements or maybe deeper
thought that, you know,
it's ripe enough to start challenging
people. But I guess ultimately
it's a question for Dr..
OK, so let's have the
next question from the Internet signator.
Question from the Internet is
what kind of answer you got for your
Freedom of Information Act request?
So so can you.
Can you repeat the then
one of the last slides we saw an
example of a Freedom of Information Act
request and the
Internet was asking if you got an answer
on that or what? What kind of answer?
You got
a Freedom of Information request.
That's what the Internet is asking.
I don't know what is wrong.
We think it's a
good OK.
What can I say is that I think
after the competition, I think we are
going to release most of the code, if not
all the code.
So but I don't understand
the question.
And also another thing, so all the
submitted binary, all the binders
and be submitted for the qualification
and all the so all the patch binders, all
the exploits, they are available
on the website.
So if you even want to understand what
team all the teams did, you can
just get those binaries, reversed them
and you can have an idea what teams are
doing.
And that's all I can say.
Yes. And also has
men, not all, but most of
DARPA's code, such as the Linux
modification and so and so forth.
All of that is public, is public.
And yes.
So if you want to take a look, I believe
at the moment you you can get a good
look. And certainly after the final,
this would probably improve a lot more.
So I think there is a
good amount of release of information,
obviously.
I mean, we don't control everything.
So and the competition is still ongoing,
so.
OK, is that a question on
my right side, on your left side?
No, that's no question.
Uh, do you have a question?
You're standing. People are just saying,
OK, is there another question
from the Internet?
There's no question from the Internet.
That's what be then the perfect
point to wrap up and.
Oh, there's that's one one microphone
question or that.
One last question, do you think two
million is a fair price
for an automatic exploitation to
do more?
Do you want. Do you think we should get
more? I think you should give more.
Yes, it's this is very
difficult. And it's this is
it's consuming the time of
base. It could consume the time of all
of our research because it cannot consume
the time of all of our research, because
there are other projects our lab must be
doing. But it's an incredibly
difficult program. It is tantamount to
creating the
first AI.
It's not quite the first step to it, like
a Terminator esque dystopian hacking
robot future.
But it's
a very good inroads if you're into that
sort of thing.
I mean, you're giving them a tool
to get
some improvements.
Exploited almost every
binary program for
only two million.
Well, if
if anybody in this room would like to
talk about extending the grand prize,
I would be happy to help them with that.
But at the moment that even the seven
hundred and fifty thousand dollars is
going to fund shellfish, going
to Def Con and eating pizza for the next
20 years.
OK, then wrap
up.
So thank you,
Antonio, Jacobo and Andrew, for this
very nice talk and be
sure to join them on that workshop.