TY - GEN
T1 - HI-CFG
T2 - 18th European Symposium on Research in Computer Security, ESORICS 2013
AU - Caselden, Dan
AU - Bazhanyuk, Alex
AU - Payer, Mathias
AU - McCamant, Stephen
AU - Song, Dawn
PY - 2013
Y1 - 2013
N2 - Security analysis often requires understanding both the control and data-flow structure of a binary. We introduce a new program representation, a hybrid information- and control-flow graph (HI-CFG), and give algorithms to infer it from an instruction-level trace. As an application, we consider the task of generalizing an attack against a program whose inputs undergo complex transformations before reaching a vulnerability. We apply the HI-CFG to find the parts of the program that implement each transformation, and then generate new attack inputs under a user-specified combination of transformations. Structural knowledge allows our approach to scale to applications that are infeasible with monolithic symbolic execution. Such attack polymorphism shows the insufficiency of any filter that does not support all the same transformations as the vulnerable application. In case studies, we show this attack capability against a PDF viewer and a word processor.
AB - Security analysis often requires understanding both the control and data-flow structure of a binary. We introduce a new program representation, a hybrid information- and control-flow graph (HI-CFG), and give algorithms to infer it from an instruction-level trace. As an application, we consider the task of generalizing an attack against a program whose inputs undergo complex transformations before reaching a vulnerability. We apply the HI-CFG to find the parts of the program that implement each transformation, and then generate new attack inputs under a user-specified combination of transformations. Structural knowledge allows our approach to scale to applications that are infeasible with monolithic symbolic execution. Such attack polymorphism shows the insufficiency of any filter that does not support all the same transformations as the vulnerable application. In case studies, we show this attack capability against a PDF viewer and a word processor.
UR - http://www.scopus.com/inward/record.url?scp=84884780814&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=84884780814&partnerID=8YFLogxK
U2 - 10.1007/978-3-642-40203-6_10
DO - 10.1007/978-3-642-40203-6_10
M3 - Conference contribution
AN - SCOPUS:84884780814
SN - 9783642402029
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 164
EP - 181
BT - Computer Security, ESORICS 2013 - 18th European Symposium on Research in Computer Security, Proceedings
Y2 - 9 September 2013 through 13 September 2013
ER -