Dynamic binary instrumentation (DBI) techniques allow for monitoring and possibly altering the execution of a running program up to the instruction level granularity. The ease of use and flexibility of DBI primitives has made them popular in a large body of research in different domains, including software security. Lately, the suitability of DBI for security has been questioned in light of transparency concerns from artifacts that popular frameworks introduce in the execution: while they do not perturb benign programs, a dedicated adversary may detect their presence and defeat the analysis. The contributions we provide are two-fold. We first present the abstraction and inner workings of DBI frameworks, how DBI assisted prominent security research works, and alternative solutions. We then dive into the DBI evasion and escape problems, discussing attack surfaces, transparency concerns, and possible mitigations. We make available to the community a library of detection patterns and stopgap measures that could be of interest to DBI users.

SoK: Using Dynamic Binary Instrumentation for Security (And How You May Get Caught Red Handed) / Cono D'Elia, Daniele; Coppa, Emilio; Nicchi, Simone; Palmaro, Federico; Cavallaro, Lorenzo. - Asia CCS '19: Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security, (2019), pp. 15-27. (Asia CCS '19: ACM Asia Conference on Computer and Communications Security, Auckland, New Zealand, 7-12 Luglio 2019). [10.1145/3321705.3329819].

SoK: Using Dynamic Binary Instrumentation for Security (And How You May Get Caught Red Handed)

Emilio Coppa;
2019

Abstract

Dynamic binary instrumentation (DBI) techniques allow for monitoring and possibly altering the execution of a running program up to the instruction level granularity. The ease of use and flexibility of DBI primitives has made them popular in a large body of research in different domains, including software security. Lately, the suitability of DBI for security has been questioned in light of transparency concerns from artifacts that popular frameworks introduce in the execution: while they do not perturb benign programs, a dedicated adversary may detect their presence and defeat the analysis. The contributions we provide are two-fold. We first present the abstraction and inner workings of DBI frameworks, how DBI assisted prominent security research works, and alternative solutions. We then dive into the DBI evasion and escape problems, discussing attack surfaces, transparency concerns, and possible mitigations. We make available to the community a library of detection patterns and stopgap measures that could be of interest to DBI users.
2019
9781450367523
Dynamic binary instrumentation, dynamic binary translation, interposition, transparent monitoring, evasion, escape
File in questo prodotto:
File Dimensione Formato  
DElia_SoK_2019.pdf

Solo gestori archivio

Tipologia: Versione dell'editore
Licenza: Tutti i diritti riservati
Dimensione 1.04 MB
Formato Adobe PDF
1.04 MB Adobe PDF   Visualizza/Apri
Pubblicazioni consigliate

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificativo per citare o creare un link a questo documento: https://hdl.handle.net/11385/236281
Citazioni
  • Scopus 41
  • ???jsp.display-item.citation.isi??? 26
social impact