Fuzzing everything in 2014

Июль 23, 2022

Главная
Разное
Fuzzing everything in 2014

Содержание

2. About me Hacking binary since 15 Left my first=last employer in 2004, independent ever since Done:
3. A BIT AWAY FROM A 0-DAY… Section 1: hacker’s
4. Microsoft Word 2007/2010 E
5. THE IDEAL FUZZER Section 2: engineer’s
6. Problems with fuzzers Too specialized. E.g. fuzz only browsers, or only files Not suitable for fuzzing
7. What I want (from a fuzzer) Omnivore. Target invariant: software type, data type, platform, architecture Omnipresent.
8. What I want, cont’d Autonomous. Can leave it for a week? Just runs Unlimited, native scaling.
9. Key design decisions Network client-server architecture Build upon isolated, generic tools Native automation bash, cmd/PowerShell, cscript/wscript,
10. Done
11. Results
12. THE MAGIC Section 3: director’s
13. Fuzzing in 2014 “Shellcoder’s Handbook”: 10 years ago “Fuzzing: Brute Force Vulnerability Discovery”: 7 years ago
14. The beginner’s delusion “Success in fuzzing is defined by speed & scale” Not exactly ClusterFuzz is
15. Thinking One only needs millions of test cases, if majority of those test cases are bad
16. Problem No algorithm to discover “fresh” code paths Code coverage can only measure the already reached
17. Where is the “new” code? Code unobviously triggered or reached Presumably effortful input generation Presumably constrained
18. Unobvious Examples CVE-2013-3906: TIFF 0’day Ogl.dll=gdiplus.dll alternative only in Office 2007 CVE-2014-0315: Insecure Library Loading with
19. Presumably Effortful Examples CVE-2013-1296: MS RDP ActiveX Use-after-Free No public ActiveX tools can target UaFs Strict
20. Presumably Constrained Example Standard ActiveX in Windows Requires user interaction in IE But IE is not
21. RESULTS Section 4: sponsor’s ☺
22. Microsoft Word
23. Microsoft XML
24. Reporting & Bounty Today: 22.05.2014 + Money arrived: 2014-05-07 ($2000)
25. “Critical infrastracture attack” contest @ PHDays: my 5 cents ☺
26. Lessons Learnt Research! Primary target: code bases Not data formats or data input interfaces or fuzzing
28. Скачать презентацию

Слайд 2

About me
Hacking binary since 15
Left my first=last employer in 2004, independent

ever since
Done: binary reversing to malware analysis to cyber investigation, pentesting to blackbox auditing to vulnerability discovery to exploitation…
Founded: Esage Lab => Neuronspace, Malwas, TZOR

Слайд 3

A BIT AWAY FROM A 0-DAY…
Section 1: hacker’s

Слайд 4

Microsoft Word 2007/2010 E

Слайд 5

THE IDEAL FUZZER
Section 2: engineer’s

Слайд 6

Problems with fuzzers
Too specialized.
E.g. fuzz only browsers, or only files
Not suitable

for fuzzing everything by design
2. Enforce unnecessary constraints.
E.g. glue mutation with automation with crash monitoring
Kills flexibility => not suitable for fuzzing everything
3. Steep learning curve.
E.g. templates & configs
Is it worthy to learn a system which is constrained anyway?

Слайд 7

What I want (from a fuzzer)
Omnivore.
Target invariant: software type, data type,

platform, architecture
Omnipresent.
Hosting platform invariant: VM/hardware/laptop/localnet/clouds...
“LEGO”
Mix & match components
Rapid support for new targets
Hot patching for tweaking

Слайд 8

What I want, cont’d
Autonomous.
Can leave it for a week?
Just runs
Unlimited, native

scaling.
Any number of fuzzers running at the same time
0 time to set up new targets
Right now.
No time for development

Слайд 9

Key design decisions
Network client-server architecture
Build upon isolated, generic tools
Native automation
bash, cmd/PowerShell,

cscript/wscript, AppleScript…
Native instrumentation
DebugAPI, CrashWrangler, cdb postmortem scripts…
Highly generic mutators
Home-made bitflipping tools, grep/sed/urandom, radamsa…

Слайд 10

Done

Слайд 11

Results

Слайд 12

THE MAGIC
Section 3: director’s

Слайд 13

Fuzzing in 2014
“Shellcoder’s Handbook”: 10 years ago
“Fuzzing: Brute Force Vulnerability Discovery”:

7 years ago
Dozens of publications, hundreds of tools, thousands of vulns found (=> code audited)
Driven by market and the competition

Слайд 14

The beginner’s delusion
“Success in fuzzing is defined by speed & scale”

Not exactly
ClusterFuzz is still beaten by standalone researchers
My results: ~1 night per fuzzer

Слайд 15

Thinking
One only needs millions of test cases, if majority of those

test cases are bad
Rejected by the validator or not reaching or not triggering vulnerable code paths
Cornerstone: bug-rich branches of code

Слайд 16

Problem
No algorithm to discover “fresh” code paths
Code coverage can only measure

the already reached paths
Evolutionary input generation is tiny (think Word with embeddings)

Слайд 17

Where is the “new” code?
Code unobviously triggered or reached
Presumably effortful input

generation
Presumably constrained exploit

Слайд 18

Unobvious Examples
CVE-2013-3906: TIFF 0’day
Ogl.dll=gdiplus.dll alternative only in Office 2007
CVE-2014-0315: Insecure Library

Loading with .cmd and .bat
CVE-2013-1324: Microsoft Word WPD stack based buffer overflow

Слайд 19

Presumably Effortful Examples
CVE-2013-1296: MS RDP ActiveX Use-after-Free
No public ActiveX tools can

target UaFs
Strict syntax-based and/or layered formats
My experience: the better the generator, and the deeper the targeted data layer, the more bugs found
Microsoft DKOM/RPC
Did you know one can send a DKOM/RPC request to the port mapper (135) to enable RDP?

Слайд 20

Presumably Constrained Example
Standard ActiveX in Windows
Requires user interaction in IE
But IE

is not the only wide-spread software capable of loading ActiveX…

Слайд 21

RESULTS
Section 4: sponsor’s ☺

Слайд 22

Microsoft Word

Слайд 23

Microsoft XML

Слайд 24

Reporting & Bounty
Today: 22.05.2014
+ Money arrived: 2014-05-07 ($2000)

Слайд 25

“Critical infrastracture attack” contest @ PHDays: my 5 cents ☺

Слайд 26

Lessons Learnt
Research! Primary target: code bases
Not data formats or data input

interfaces or fuzzing automation technology
Yes: Ancient code, hidden/unobvious functionality etc.
Bet on complex data formats
For complex data, code paths exist which are not reachable automatically, which means probably never audited code base and zero competition.
Craft complex fuzzing seeds manually
The rule of “minimal size sample”, as stated in the book “Fuzzing: Brute Force Vulnerability Discovery” is obsolete 2014.
Remove 1-2 data format layers before injecting malformed data
Deep parsers are less audited (researchers are lazy?)
Deep parsers tend to contain more bugs (programmers are lazy?)
Estimate potency of a new vector by dumbest fuzzing prior to investing in smart fuzzing
Criteria: Bugs crowd
Bugs crowd in direction of “less audited” code base
Tweak a lot to get a “feeling” for the particular target
Keep the fuzzing setting dirty
Fuzzing is dirty by design
Pretty lying it into a well-designed system kills flexibility necessary for tweaking & rapid prototyping.
Research, again

Fuzzing everything in 2014

Содержание

About meHacking binary since 15Left my first=last employer in 2004, independent

A BIT AWAY FROM A 0-DAY…Section 1: hacker’s

Microsoft Word 2007/2010 E

THE IDEAL FUZZERSection 2: engineer’s

Problems with fuzzersToo specialized.E.g. fuzz only browsers, or only filesNot suitable

What I want (from a fuzzer)Omnivore.Target invariant: software type, data type,

What I want, cont’dAutonomous.Can leave it for a week?Just runsUnlimited, native

Key design decisionsNetwork client-server architectureBuild upon isolated, generic toolsNative automationbash, cmd/PowerShell,

Done

Results

THE MAGICSection 3: director’s

Fuzzing in 2014“Shellcoder’s Handbook”: 10 years ago“Fuzzing: Brute Force Vulnerability Discovery”:

The beginner’s delusion“Success in fuzzing is defined by speed & scale”

ThinkingOne only needs millions of test cases, if majority of those

ProblemNo algorithm to discover “fresh” code pathsCode coverage can only measure

Where is the “new” code?Code unobviously triggered or reachedPresumably effortful input

Unobvious ExamplesCVE-2013-3906: TIFF 0’dayOgl.dll=gdiplus.dll alternative only in Office 2007CVE-2014-0315: Insecure Library

Presumably Effortful ExamplesCVE-2013-1296: MS RDP ActiveX Use-after-FreeNo public ActiveX tools can

Presumably Constrained ExampleStandard ActiveX in WindowsRequires user interaction in IEBut IE

RESULTSSection 4: sponsor’s ☺