skip to main content
research-article

Code Renewability for Native Software Protection

Published:25 August 2020Publication History
Skip Abstract Section

Abstract

Software protection aims at safeguarding assets embedded in software by preventing and delaying reverse engineering and tampering attacks. This article presents an architecture and supporting tool flow to renew parts of native applications dynamically. Renewed and diversified code and data belonging to either the original application or to linked-in protections are delivered from a secure server to a client on demand. This results in frequent changes to the software components when they are under attack, thus making attacks harder. By supporting various forms of diversification and renewability, novel protection combinations become available and existing combinations become stronger. The prototype implementation is evaluated on several industrial use cases.

References

  1. Sourceware.org. n.d. GNU gprof. Retrieved July 18, 2020 from https://sourceware.org/binutils/docs/gprof/.Google ScholarGoogle Scholar
  2. CryptoExperts. n.d. The WhibOx Contest, an ECRYPT White-Box Cryptography Competition. Retrieved July 19, 2020 from https://whibox.cr.yp.to/.Google ScholarGoogle Scholar
  3. Bert Abrath, Bart Coppens, Stijn Volckaert, Joris Wijnant, and Bjorn De Sutter. 2016. Tightly-coupled self-debugging software protection. In Proceedings of the 6th Workshop on Software Security, Protection, and Reverse Engineering. Article 7, 10 pages.Google ScholarGoogle ScholarDigital LibraryDigital Library
  4. ARM. 2005--2009. ARM Security Technology—Building a Secure System Using TrustZone® Technology. Retrieved July 18, 2020 from http://infocenter.arm.com.Google ScholarGoogle Scholar
  5. Cyrille Artho. 2011. Iterative delta debugging. International Journal on Software Tools for Technology Transfer 13, 3 (2011), 223--246.Google ScholarGoogle ScholarDigital LibraryDigital Library
  6. Arxan. n.d. State of Application Security. Retrieved July 18, 2020 from https://www.arxan.com/resources/state-of-application-security/.Google ScholarGoogle Scholar
  7. Cataldo Basile (Ed.). 2016. ASPIRE Framework Report. Deliverable D5.11 v1.0. ASPIRE.Google ScholarGoogle Scholar
  8. Olivier Billet and Henri Gilbert. 2003. A traceable block cipher. In Advances in Cryptology—ASIACRYPT 2003. Lecture Notes in Computer Science, Vol. 2894. Springer, 331--346.Google ScholarGoogle ScholarCross RefCross Ref
  9. Sourceware.org. 2016. Documentation for Binutils 2.27. Retrieved July 18, 2020 from https://sourceware.org/binutils/docs-2.27/.Google ScholarGoogle Scholar
  10. Dan Bornstein. 2008. Dalvik VM internals. In Proceedings of the Google I/O Developer Conference, Vol. 23. 17--30.Google ScholarGoogle Scholar
  11. Ferdinand Brasser, Urs Muller, Alexandra Dmitrienko, Kari Kostiainen, Srdjan Capkun, and Ahmad-Reza Sadeghi. 2017. Software grand exposure: SGX cache attacks are practical. In Proceedings of the WOOT ’17 Workshop Program Colocated with the 26th USENIX Security Symposium.Google ScholarGoogle Scholar
  12. Brecht Wyseur. 2016. Let’s get real! We need WBC and Io. In Proceedings of the WhibOx 2016 Workshop on White-Box Cryptography and Obfuscation.Google ScholarGoogle Scholar
  13. Julien Bringer, Herve Chabanne, and Emmanuelle Dottax. 2006. White Box Cryptography: Another Attempt. Report 2006/468. Cryptology ePrint Archive.Google ScholarGoogle Scholar
  14. BSA. 2018. 2018 BSA Global Software Piracy Survey. Retrieved July 18, 2020 from https://gss.bsa.org/.Google ScholarGoogle Scholar
  15. Alessandro Cabutto, Paolo Falcarin, Bert Abrath, Bart Coppens, and Bjorn De Sutter. 2015. Software protection with code mobility. In Proceedings of the ACM Workshop on Moving Target Defense. 95--103.Google ScholarGoogle ScholarDigital LibraryDigital Library
  16. Mariano Ceccato, Mila Dalla Preda, Jasvir Nagra, and Christian S. Collberg. 2007. Barrier slicing for remote software trusting. In Proceedings of the International Working Conference on Source Code Analysis and Manipulation. 27--36.Google ScholarGoogle Scholar
  17. Mariano Ceccato, Paolo Tonella, Cataldo Basile, Paolo Falcarin, Marco Torchiano, Bart Coppens, and Bjorn De Sutter. 2019. Understanding the behaviour of hackers while performing attack tasks in a professional setting and in a public challenge. Empirical Software Engineering 24, 1 (2019), 240--286.Google ScholarGoogle ScholarDigital LibraryDigital Library
  18. Stanley Chow, Philip A. Eisen, Harold Johnson, and Paul C. van Oorschot. 2002. White-box cryptography and an AES implementation. In Proceedings of the 9th International Workshop on Selected Areas in Cryptography. 250--270.Google ScholarGoogle Scholar
  19. Frederick B. Cohen. 1993. Operating system protection through program evolution. Computers 8 Security 12, 6 (1993), 565--584.Google ScholarGoogle Scholar
  20. Christian Collberg, Sam Martin, Jonathan Myers, and Jasvir Nagra. 2012. Distributed application tamper detection via continuous software updates. In Proceedings of the 28th Annual Computer Security Applications Conference. 319--328.Google ScholarGoogle ScholarDigital LibraryDigital Library
  21. Christian Collberg and Jasvir Nagra. 2009. Surreptitious Software: Obfuscation, Watermarking, and Tamperproofing for Software Protection. Addison-Wesley Professional.Google ScholarGoogle ScholarDigital LibraryDigital Library
  22. Bart Coppens, Bjorn De Sutter, and Koen De Bosschere. 2013. Protecting your software updates. IEEE Security 8 Privacy 11, 2 (2013), 47--54.Google ScholarGoogle Scholar
  23. Stephen Crane, Andrei Homescu, Stefan Brunthaler, Per Larsen, and Michael Franz. 2015. Thwarting cache side-channel attacks through dynamic software diversity. In Proceedings of the 2015 Network and Distributed System Security Symposium (NDSS ’15). 8--11.Google ScholarGoogle ScholarCross RefCross Ref
  24. Lucas Davi, Alexandra Dmitrienko, Stefan Nurnberger, and Ahmad-Reza Sadeghi. 2012. XIFER: A software diversity tool against code-reuse attacks. In Proceedings of the 4th ACM International Workshop on Wireless of the Students, by the Students, for the Students.Google ScholarGoogle Scholar
  25. Bjorn De Sutter, Bruno De Bus, Koen De Bosschere, and Saumya Debray. 2001. Combining global code and data compaction. In Proceedings of the ACM SIGPLAN Workshop on Languages, Compilers, and Tools for Embedded Systems. 29--38.Google ScholarGoogle ScholarDigital LibraryDigital Library
  26. Bjorn De Sutter (Ed.). 2016. ASPIRE Validation Report. Deliverable D1.06. ASPIRE EU FP7 Project. ASPIRE. https://aspire-fp7.eu.Google ScholarGoogle Scholar
  27. Bjorn De Sutter, Paolo Falcarin, Brecht Wyseur, Cataldo Basile, Mariano Ceccato, Jerome d’Annoville, and Michael Zunke. 2016. A reference architecture for software protection. In Proceedings of the 13th Working IEEE/IFIP Conference on Software Architecture. 291--294.Google ScholarGoogle ScholarCross RefCross Ref
  28. Saumya Debray, Robert Muth, and Matthew Weippert. 1998. Alias analysis of executable code. In Proceedings of the 25th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages. 12--24.Google ScholarGoogle ScholarDigital LibraryDigital Library
  29. Paolo Falcarin, Christian S. Collberg, Mikhail J. Atallah, and Mariusz H. Jakubowski. 2011. Guest editors’ introduction: Software protection. IEEE Software 28, 2 (2011), 24--27. DOI:https://doi.org/10.1109/MS.2011.34Google ScholarGoogle ScholarDigital LibraryDigital Library
  30. Paolo Falcarin, Stefano Di Carlo, Alessandro Cabutto, Nicola Garazzino, and Davide Barberis. 2011. Exploiting code mobility for dynamic binary obfuscation. In Proceedings of the IEEE World Congress on Internet Security. 114--120.Google ScholarGoogle ScholarCross RefCross Ref
  31. S. Forrest, A. Somayaji, and D. H. Ackley. 1997. Building diverse computer systems. In Proceedings of the 1997 6th Workshop on Hot Topics in Operating Systems. 67--72. DOI:https://doi.org/10.1109/HOTOS.1997.595185Google ScholarGoogle Scholar
  32. Michael Franz. 2010. E unibus pluram: Massive-scale software diversity as a defense mechanism. In Proceedings of the Workshop on New Security Paradigms. 7--16.Google ScholarGoogle ScholarDigital LibraryDigital Library
  33. Juan A. Garay and Lorenz Huelsbergen. 2006. Software integrity protection using timed executable agents. In Proceedings of the ACM Symposium on Information, Computer, and Communications Security. 189--200.Google ScholarGoogle Scholar
  34. Cristiano Giuffrida, Anton Kuijsten, and Andrew S. Tanenbaum. 2012. Enhanced operating system security through efficient and fine-grained address space randomization. In Proceedings of the USENIX Security Symposium. 475--490.Google ScholarGoogle Scholar
  35. Y. X. Gu, B. Wyseur, and B. Preneel. 2011. Point/counterpoint. IEEE Software 28, 2 (March/April 2011), 56--59.Google ScholarGoogle ScholarDigital LibraryDigital Library
  36. Aditi Gupta, Sam Kerr, Michael S. Kirkpatrick, and Elisa Bertino. 2013. Marlin: A fine grained randomization approach to defend against ROP attacks. In Proceedings of the 7th International Conference on Network and System Security. 293--306.Google ScholarGoogle ScholarCross RefCross Ref
  37. David A. Holland, Ada T. Lim, and Margo I. Seltzer. 2005. An architecture a day keeps the hacker away. ACM SIGARCH Computer Architecture News 33, 1 (2005), 34--41.Google ScholarGoogle ScholarDigital LibraryDigital Library
  38. Andrei Homescu, Per Larsen, Stefan Brunthaler, and Michael Franz. 2013. Librando: Transparent code randomization for just-in-time compilers. In Proceedings of the ACM Conference on Computer and Communications Security. 993--1004.Google ScholarGoogle ScholarDigital LibraryDigital Library
  39. Internet Engineering Task Force (IETF). 2011. The WebSocket Protocol. Retrieved July 18, 2020 from http://tools.ietf.org/html/rfc6455.Google ScholarGoogle Scholar
  40. Todd Jackson, Babak Salamat, Andrei Homescu, Karthikeyan Manivannan, Gregor Wagner, Andreas Gal, Stefan Brunthaler, Christian Wimmer, and Michael Franz. 2011. Compiler-generated software diversity. In Moving Target Defense. Advances in Information Security, Vol. 54. Springer, 77--98.Google ScholarGoogle Scholar
  41. Pascal Junod, Julien Rinaldini, Johan Wehrli, and Julie Michielin. 2015. Obfuscator-LLVM--Software protection for the masses. In Proceedings of the IEEE/ACM 1st International Workshop on Software Protection (SPRO’15). IEEE, Los Alamitos, CA, 3--9.Google ScholarGoogle ScholarDigital LibraryDigital Library
  42. James E. Just and Mark Cornwell. 2004. Review and analysis of synthetic diversity for breaking monocultures. In Proceedings of the 2004 ACM Workshop on Rapid Malcode. ACM, New York, NY, 23--32.Google ScholarGoogle Scholar
  43. Chongkyung Kil, Jinsuk Jun, Christopher Bookholt, Jun Xu, and Peng Ning. 2006. Address space layout permutation (ASLP): Towards fine-grained randomization of commodity software. In Proceedings of the IEEE Computer Security Applications Conference. 339--348.Google ScholarGoogle ScholarDigital LibraryDigital Library
  44. Per Larsen, Stefan Brunthaler, and Michael Franz. 2014. Security through diversity: Are we there yet? IEEE Security 8 Privacy 12, 2 (2014), 28--35. DOI:https://doi.org/10.1109/MSP.2013.129Google ScholarGoogle Scholar
  45. Per Larsen, Andrei Homescu, Stefan Brunthaler, and Michael Franz. 2014. SoK: Automated software diversity. In Proceedings of the IEEE Symposium on Security and Privacy. IEEE, Los Alamitos, CA, 276--291.Google ScholarGoogle ScholarDigital LibraryDigital Library
  46. Sangho Lee, Ming-Wei Shih, Prasun Gera, Taesoo Kim, Hyesoon Kim, and Marcus Peinado. 2017. Inferring fine-grained control flow inside SGX enclaves with branch shadowing. In Proceedings of the 2017 USENIX Security Symposium. 557--574.Google ScholarGoogle Scholar
  47. GitHub. n.d. The UCI Multicompiler. Retrieved July 18, 2020 from https://github.com/securesystemslab/multicompiler.Google ScholarGoogle Scholar
  48. Oreans Technologies. n.d. Code Virtualizer Overview: Total Obfuscation Against Reverse Engineering. Retrieved July 18, 2020 from https://www.oreans.com/codevirtualizer.php.Google ScholarGoogle Scholar
  49. Oreans Technologies. [n.d.]. Themida Overview: Advanced Windows Software Protection System. Retrieved July 18, 2020 from https://www.oreans.com/themida.php.Google ScholarGoogle Scholar
  50. Riccardo Scandariato, Yoram Ofek, Paolo Falcarin, and Mario Baldi. 2008. Application-oriented trust in distributed computing. In Proceedings of the 3rd International Conference on Availability, Reliability, and Security (ARES ’08). 434--439.Google ScholarGoogle ScholarDigital LibraryDigital Library
  51. Arvind Seshadri, Mark Luk, Adrian Perrig, Leendert Doom, and Pradeep Khosla. 2007. Pioneer: Verifying code integrity and enforcing untampered code execution on legacy systems. In Malware Detection. Advances in Information Security, Vol. 27. Springer, 253--289.Google ScholarGoogle Scholar
  52. Eitaro Shioji, Yuhei Kawakoya, Makoto Iwamura, and Takeo Hariu. 2012. Code shredding: Byte-granular randomization of program layout for detecting code-reuse attacks. In Proceedings of the 28th Annual Computer Security Applications Conference. 309--318.Google ScholarGoogle ScholarDigital LibraryDigital Library
  53. Michael Sutton, Adam Greene, and Pedram Amini. 2007. Fuzzing: Brute Force Vulnerability Discovery. Pearson Education.Google ScholarGoogle Scholar
  54. Symantec Enterprise. 2018. Internet Security Threat Report 2018. Mountain View, CA, USA (2018).Google ScholarGoogle Scholar
  55. M. van der Ende, M. Hageraats, J. Poort, J. Quintais, and A. Yagafarova. 2018. Global Online Piracy Study 2018. Retrieved July 18, 2020 from https://www.ivir.nl/projects/global-online-piracy-study/.Google ScholarGoogle Scholar
  56. Ludo Van Put, Dominique Chanet, Bruno De Bus, Bjorn De Sutter, and Koen De Bosschere. 2005. Diablo: A reliable, retargetable and extensible link-time rewriting framework. In Proceedings of the International Symposium on Signal Processing and Information Technology. 7--12.Google ScholarGoogle Scholar
  57. Alessio Viticchié, Cataldo Basile, Andrea Avancini, Mariano Ceccato, Bert Abrath, and Bart Coppens. 2016. Reactive attestation: Automatic detection and reaction to software tampering attacks. In Proceedings of the ACM Workshop on Software PROtection (SPRO’16). 73--84.Google ScholarGoogle ScholarDigital LibraryDigital Library
  58. VMProtect Software. n.d. VMProtect New-Generation Software Protection. Retrieved July 18, 2020 from https://vmpsoft.com/.Google ScholarGoogle Scholar
  59. Daniel Williams, Wei Hu, Jack W. Davidson, Jason D. Hiser, John C. Knight, and Anh Nguyen-Tuong. 2009. Security through diversity: Leveraging virtual machine technology. IEEE Security 8 Privacy 7, 1 (Jan. 2009), 26--33. DOI:https://doi.org/10.1109/MSP.2009.18Google ScholarGoogle Scholar
  60. Brecht Wyseur. 2009. White-Box Cryptography. Ph.D. Dissertation. Katholieke Universiteit Leuven.Google ScholarGoogle Scholar
  61. Brecht Wyseur and Bjorn De Sutter (Eds.). 2016. ASPIRE Reference Architecture. Deliverable D1.04 v2.1. ASPIRE.Google ScholarGoogle Scholar
  62. Jun Xu, Zbigniew Kalbarczyk, and Ravishankar K. Iyer. 2003. Transparent runtime randomization for security. In Proceedings of the 2003 22nd International Symposium on Reliable Distributed Systems. IEEE, Los Alamitos, CA, 260--269.Google ScholarGoogle Scholar
  63. Dionisio Zumerle and Manjunath Bhat. 2017. Gartner: Market Guide for Application Shielding. Retrieved July 18, 2020 from https://www.gartner.com/en/documents/3747622/market-guide-for-application-shielding.Google ScholarGoogle Scholar

Index Terms

  1. Code Renewability for Native Software Protection

      Recommendations

      Comments

      Login options

      Check if you have access through your login credentials or your institution to get full access on this article.

      Sign in

      Full Access

      PDF Format

      View or Download as a PDF file.

      PDF

      eReader

      View online with eReader.

      eReader

      HTML Format

      View this article in HTML Format .

      View HTML Format
      About Cookies On This Site

      We use cookies to ensure that we give you the best experience on our website.

      Learn more

      Got it!