Abstract
Software protection aims at safeguarding assets embedded in software by preventing and delaying reverse engineering and tampering attacks. This article presents an architecture and supporting tool flow to renew parts of native applications dynamically. Renewed and diversified code and data belonging to either the original application or to linked-in protections are delivered from a secure server to a client on demand. This results in frequent changes to the software components when they are under attack, thus making attacks harder. By supporting various forms of diversification and renewability, novel protection combinations become available and existing combinations become stronger. The prototype implementation is evaluated on several industrial use cases.
- Sourceware.org. n.d. GNU gprof. Retrieved July 18, 2020 from https://sourceware.org/binutils/docs/gprof/.Google Scholar
- CryptoExperts. n.d. The WhibOx Contest, an ECRYPT White-Box Cryptography Competition. Retrieved July 19, 2020 from https://whibox.cr.yp.to/.Google Scholar
- Bert Abrath, Bart Coppens, Stijn Volckaert, Joris Wijnant, and Bjorn De Sutter. 2016. Tightly-coupled self-debugging software protection. In Proceedings of the 6th Workshop on Software Security, Protection, and Reverse Engineering. Article 7, 10 pages.Google Scholar
Digital Library
- ARM. 2005--2009. ARM Security Technology—Building a Secure System Using TrustZone® Technology. Retrieved July 18, 2020 from http://infocenter.arm.com.Google Scholar
- Cyrille Artho. 2011. Iterative delta debugging. International Journal on Software Tools for Technology Transfer 13, 3 (2011), 223--246.Google Scholar
Digital Library
- Arxan. n.d. State of Application Security. Retrieved July 18, 2020 from https://www.arxan.com/resources/state-of-application-security/.Google Scholar
- Cataldo Basile (Ed.). 2016. ASPIRE Framework Report. Deliverable D5.11 v1.0. ASPIRE.Google Scholar
- Olivier Billet and Henri Gilbert. 2003. A traceable block cipher. In Advances in Cryptology—ASIACRYPT 2003. Lecture Notes in Computer Science, Vol. 2894. Springer, 331--346.Google Scholar
Cross Ref
- Sourceware.org. 2016. Documentation for Binutils 2.27. Retrieved July 18, 2020 from https://sourceware.org/binutils/docs-2.27/.Google Scholar
- Dan Bornstein. 2008. Dalvik VM internals. In Proceedings of the Google I/O Developer Conference, Vol. 23. 17--30.Google Scholar
- Ferdinand Brasser, Urs Muller, Alexandra Dmitrienko, Kari Kostiainen, Srdjan Capkun, and Ahmad-Reza Sadeghi. 2017. Software grand exposure: SGX cache attacks are practical. In Proceedings of the WOOT ’17 Workshop Program Colocated with the 26th USENIX Security Symposium.Google Scholar
- Brecht Wyseur. 2016. Let’s get real! We need WBC and Io. In Proceedings of the WhibOx 2016 Workshop on White-Box Cryptography and Obfuscation.Google Scholar
- Julien Bringer, Herve Chabanne, and Emmanuelle Dottax. 2006. White Box Cryptography: Another Attempt. Report 2006/468. Cryptology ePrint Archive.Google Scholar
- BSA. 2018. 2018 BSA Global Software Piracy Survey. Retrieved July 18, 2020 from https://gss.bsa.org/.Google Scholar
- Alessandro Cabutto, Paolo Falcarin, Bert Abrath, Bart Coppens, and Bjorn De Sutter. 2015. Software protection with code mobility. In Proceedings of the ACM Workshop on Moving Target Defense. 95--103.Google Scholar
Digital Library
- Mariano Ceccato, Mila Dalla Preda, Jasvir Nagra, and Christian S. Collberg. 2007. Barrier slicing for remote software trusting. In Proceedings of the International Working Conference on Source Code Analysis and Manipulation. 27--36.Google Scholar
- Mariano Ceccato, Paolo Tonella, Cataldo Basile, Paolo Falcarin, Marco Torchiano, Bart Coppens, and Bjorn De Sutter. 2019. Understanding the behaviour of hackers while performing attack tasks in a professional setting and in a public challenge. Empirical Software Engineering 24, 1 (2019), 240--286.Google Scholar
Digital Library
- Stanley Chow, Philip A. Eisen, Harold Johnson, and Paul C. van Oorschot. 2002. White-box cryptography and an AES implementation. In Proceedings of the 9th International Workshop on Selected Areas in Cryptography. 250--270.Google Scholar
- Frederick B. Cohen. 1993. Operating system protection through program evolution. Computers 8 Security 12, 6 (1993), 565--584.Google Scholar
- Christian Collberg, Sam Martin, Jonathan Myers, and Jasvir Nagra. 2012. Distributed application tamper detection via continuous software updates. In Proceedings of the 28th Annual Computer Security Applications Conference. 319--328.Google Scholar
Digital Library
- Christian Collberg and Jasvir Nagra. 2009. Surreptitious Software: Obfuscation, Watermarking, and Tamperproofing for Software Protection. Addison-Wesley Professional.Google Scholar
Digital Library
- Bart Coppens, Bjorn De Sutter, and Koen De Bosschere. 2013. Protecting your software updates. IEEE Security 8 Privacy 11, 2 (2013), 47--54.Google Scholar
- Stephen Crane, Andrei Homescu, Stefan Brunthaler, Per Larsen, and Michael Franz. 2015. Thwarting cache side-channel attacks through dynamic software diversity. In Proceedings of the 2015 Network and Distributed System Security Symposium (NDSS ’15). 8--11.Google Scholar
Cross Ref
- Lucas Davi, Alexandra Dmitrienko, Stefan Nurnberger, and Ahmad-Reza Sadeghi. 2012. XIFER: A software diversity tool against code-reuse attacks. In Proceedings of the 4th ACM International Workshop on Wireless of the Students, by the Students, for the Students.Google Scholar
- Bjorn De Sutter, Bruno De Bus, Koen De Bosschere, and Saumya Debray. 2001. Combining global code and data compaction. In Proceedings of the ACM SIGPLAN Workshop on Languages, Compilers, and Tools for Embedded Systems. 29--38.Google Scholar
Digital Library
- Bjorn De Sutter (Ed.). 2016. ASPIRE Validation Report. Deliverable D1.06. ASPIRE EU FP7 Project. ASPIRE. https://aspire-fp7.eu.Google Scholar
- Bjorn De Sutter, Paolo Falcarin, Brecht Wyseur, Cataldo Basile, Mariano Ceccato, Jerome d’Annoville, and Michael Zunke. 2016. A reference architecture for software protection. In Proceedings of the 13th Working IEEE/IFIP Conference on Software Architecture. 291--294.Google Scholar
Cross Ref
- Saumya Debray, Robert Muth, and Matthew Weippert. 1998. Alias analysis of executable code. In Proceedings of the 25th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages. 12--24.Google Scholar
Digital Library
- Paolo Falcarin, Christian S. Collberg, Mikhail J. Atallah, and Mariusz H. Jakubowski. 2011. Guest editors’ introduction: Software protection. IEEE Software 28, 2 (2011), 24--27. DOI:https://doi.org/10.1109/MS.2011.34Google Scholar
Digital Library
- Paolo Falcarin, Stefano Di Carlo, Alessandro Cabutto, Nicola Garazzino, and Davide Barberis. 2011. Exploiting code mobility for dynamic binary obfuscation. In Proceedings of the IEEE World Congress on Internet Security. 114--120.Google Scholar
Cross Ref
- S. Forrest, A. Somayaji, and D. H. Ackley. 1997. Building diverse computer systems. In Proceedings of the 1997 6th Workshop on Hot Topics in Operating Systems. 67--72. DOI:https://doi.org/10.1109/HOTOS.1997.595185Google Scholar
- Michael Franz. 2010. E unibus pluram: Massive-scale software diversity as a defense mechanism. In Proceedings of the Workshop on New Security Paradigms. 7--16.Google Scholar
Digital Library
- Juan A. Garay and Lorenz Huelsbergen. 2006. Software integrity protection using timed executable agents. In Proceedings of the ACM Symposium on Information, Computer, and Communications Security. 189--200.Google Scholar
- Cristiano Giuffrida, Anton Kuijsten, and Andrew S. Tanenbaum. 2012. Enhanced operating system security through efficient and fine-grained address space randomization. In Proceedings of the USENIX Security Symposium. 475--490.Google Scholar
- Y. X. Gu, B. Wyseur, and B. Preneel. 2011. Point/counterpoint. IEEE Software 28, 2 (March/April 2011), 56--59.Google Scholar
Digital Library
- Aditi Gupta, Sam Kerr, Michael S. Kirkpatrick, and Elisa Bertino. 2013. Marlin: A fine grained randomization approach to defend against ROP attacks. In Proceedings of the 7th International Conference on Network and System Security. 293--306.Google Scholar
Cross Ref
- David A. Holland, Ada T. Lim, and Margo I. Seltzer. 2005. An architecture a day keeps the hacker away. ACM SIGARCH Computer Architecture News 33, 1 (2005), 34--41.Google Scholar
Digital Library
- Andrei Homescu, Per Larsen, Stefan Brunthaler, and Michael Franz. 2013. Librando: Transparent code randomization for just-in-time compilers. In Proceedings of the ACM Conference on Computer and Communications Security. 993--1004.Google Scholar
Digital Library
- Internet Engineering Task Force (IETF). 2011. The WebSocket Protocol. Retrieved July 18, 2020 from http://tools.ietf.org/html/rfc6455.Google Scholar
- Todd Jackson, Babak Salamat, Andrei Homescu, Karthikeyan Manivannan, Gregor Wagner, Andreas Gal, Stefan Brunthaler, Christian Wimmer, and Michael Franz. 2011. Compiler-generated software diversity. In Moving Target Defense. Advances in Information Security, Vol. 54. Springer, 77--98.Google Scholar
- Pascal Junod, Julien Rinaldini, Johan Wehrli, and Julie Michielin. 2015. Obfuscator-LLVM--Software protection for the masses. In Proceedings of the IEEE/ACM 1st International Workshop on Software Protection (SPRO’15). IEEE, Los Alamitos, CA, 3--9.Google Scholar
Digital Library
- James E. Just and Mark Cornwell. 2004. Review and analysis of synthetic diversity for breaking monocultures. In Proceedings of the 2004 ACM Workshop on Rapid Malcode. ACM, New York, NY, 23--32.Google Scholar
- Chongkyung Kil, Jinsuk Jun, Christopher Bookholt, Jun Xu, and Peng Ning. 2006. Address space layout permutation (ASLP): Towards fine-grained randomization of commodity software. In Proceedings of the IEEE Computer Security Applications Conference. 339--348.Google Scholar
Digital Library
- Per Larsen, Stefan Brunthaler, and Michael Franz. 2014. Security through diversity: Are we there yet? IEEE Security 8 Privacy 12, 2 (2014), 28--35. DOI:https://doi.org/10.1109/MSP.2013.129Google Scholar
- Per Larsen, Andrei Homescu, Stefan Brunthaler, and Michael Franz. 2014. SoK: Automated software diversity. In Proceedings of the IEEE Symposium on Security and Privacy. IEEE, Los Alamitos, CA, 276--291.Google Scholar
Digital Library
- Sangho Lee, Ming-Wei Shih, Prasun Gera, Taesoo Kim, Hyesoon Kim, and Marcus Peinado. 2017. Inferring fine-grained control flow inside SGX enclaves with branch shadowing. In Proceedings of the 2017 USENIX Security Symposium. 557--574.Google Scholar
- GitHub. n.d. The UCI Multicompiler. Retrieved July 18, 2020 from https://github.com/securesystemslab/multicompiler.Google Scholar
- Oreans Technologies. n.d. Code Virtualizer Overview: Total Obfuscation Against Reverse Engineering. Retrieved July 18, 2020 from https://www.oreans.com/codevirtualizer.php.Google Scholar
- Oreans Technologies. [n.d.]. Themida Overview: Advanced Windows Software Protection System. Retrieved July 18, 2020 from https://www.oreans.com/themida.php.Google Scholar
- Riccardo Scandariato, Yoram Ofek, Paolo Falcarin, and Mario Baldi. 2008. Application-oriented trust in distributed computing. In Proceedings of the 3rd International Conference on Availability, Reliability, and Security (ARES ’08). 434--439.Google Scholar
Digital Library
- Arvind Seshadri, Mark Luk, Adrian Perrig, Leendert Doom, and Pradeep Khosla. 2007. Pioneer: Verifying code integrity and enforcing untampered code execution on legacy systems. In Malware Detection. Advances in Information Security, Vol. 27. Springer, 253--289.Google Scholar
- Eitaro Shioji, Yuhei Kawakoya, Makoto Iwamura, and Takeo Hariu. 2012. Code shredding: Byte-granular randomization of program layout for detecting code-reuse attacks. In Proceedings of the 28th Annual Computer Security Applications Conference. 309--318.Google Scholar
Digital Library
- Michael Sutton, Adam Greene, and Pedram Amini. 2007. Fuzzing: Brute Force Vulnerability Discovery. Pearson Education.Google Scholar
- Symantec Enterprise. 2018. Internet Security Threat Report 2018. Mountain View, CA, USA (2018).Google Scholar
- M. van der Ende, M. Hageraats, J. Poort, J. Quintais, and A. Yagafarova. 2018. Global Online Piracy Study 2018. Retrieved July 18, 2020 from https://www.ivir.nl/projects/global-online-piracy-study/.Google Scholar
- Ludo Van Put, Dominique Chanet, Bruno De Bus, Bjorn De Sutter, and Koen De Bosschere. 2005. Diablo: A reliable, retargetable and extensible link-time rewriting framework. In Proceedings of the International Symposium on Signal Processing and Information Technology. 7--12.Google Scholar
- Alessio Viticchié, Cataldo Basile, Andrea Avancini, Mariano Ceccato, Bert Abrath, and Bart Coppens. 2016. Reactive attestation: Automatic detection and reaction to software tampering attacks. In Proceedings of the ACM Workshop on Software PROtection (SPRO’16). 73--84.Google Scholar
Digital Library
- VMProtect Software. n.d. VMProtect New-Generation Software Protection. Retrieved July 18, 2020 from https://vmpsoft.com/.Google Scholar
- Daniel Williams, Wei Hu, Jack W. Davidson, Jason D. Hiser, John C. Knight, and Anh Nguyen-Tuong. 2009. Security through diversity: Leveraging virtual machine technology. IEEE Security 8 Privacy 7, 1 (Jan. 2009), 26--33. DOI:https://doi.org/10.1109/MSP.2009.18Google Scholar
- Brecht Wyseur. 2009. White-Box Cryptography. Ph.D. Dissertation. Katholieke Universiteit Leuven.Google Scholar
- Brecht Wyseur and Bjorn De Sutter (Eds.). 2016. ASPIRE Reference Architecture. Deliverable D1.04 v2.1. ASPIRE.Google Scholar
- Jun Xu, Zbigniew Kalbarczyk, and Ravishankar K. Iyer. 2003. Transparent runtime randomization for security. In Proceedings of the 2003 22nd International Symposium on Reliable Distributed Systems. IEEE, Los Alamitos, CA, 260--269.Google Scholar
- Dionisio Zumerle and Manjunath Bhat. 2017. Gartner: Market Guide for Application Shielding. Retrieved July 18, 2020 from https://www.gartner.com/en/documents/3747622/market-guide-for-application-shielding.Google Scholar
Index Terms
Code Renewability for Native Software Protection
Recommendations
3rd International Workshop on Software Protection (SPRO 2019)
CCS '19: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications SecuritySoftware Protection techniques aim to defend the confidentiality and integrity of software applications that are exposed to an adversary that shares the execution host and access privileges of the application. This scenario is often denoted as ...
2nd International Workshop on Software Protection: SPRO 2016
CCS '16: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications SecuritySoftware Protection techniques aim to defend the confidentiality and integrity of software applications that are exposed to an adversary that shares the execution host and access privileges of the application. This scenario is often denoted as ...
The ASPIRE Framework for Software Protection
SPRO '16: Proceedings of the 2016 ACM Workshop on Software PROtectionIn the ASPIRE research project, a software protection tool flow was designed and prototyped that targets native ARM Android code. This tool flow supports the deployment of a number of protections against man-at-the-end attacks. In this tutorial, an ...






Comments