Hybrid static-dynamic attacks against software protection mechanisms

ABSTRACT

Advances in reverse engineering and program analyses have made software extremely vulnerable to malicious host attacks. These attacks typically take the form of intellectual property violations, against which the software needs to be protected. The intellectual property that needs to be protected can take on different forms. The software might, e.g., consist itself of proprietary algorithms and datastructures or it could provide controlled access to copyrighted material. Therefore, in recent years, a number of techniques have been explored to protect software. Many of these techniques provide a reasonable level of security against static-only attacks. Many of them however fail to address the problem of dynamic or hybrid static-dynamic attacks. While this type of attack is already commonly used by black-hats, this is one of the first scientific papers to discuss the potential of these attacks through which an attacker can analyze, control and modify a program extensively. The concepts are illustrated through a case study of a recently proposed algorithm for software watermarking [6].

REFERENCES

• 1: Atari Games Corp. vs. Nintendo of America Inc., U.S. Court of Appeals, Federal Circuit, September 10,1992.
• 2: Hoi Chang , Mikhail J. Atallah, Protecting Software Code by Guards, Revised Papers from the ACM CCS-8 Workshop on Security and Privacy in Digital Rights Management, p.160-175, November 05, 2001
• 3: Yuqun Chen , Ramarathnam Venkatesan , Matthew Cary , Ruoming Pang , Saurabh Sinha , Mariusz H. Jakubowski, Oblivious Hashing: A Stealthy Software Integrity Verification Primitive, Revised Papers from the 5th International Workshop on Information Hiding, p.400-414, October 07-09, 2002
• 4: Cristina Cifuentes , K. John Gough, Decompilation of binary programs, Software—Practice & Experience, v.25 n.7, p.811-829, July 1995 [doi>10.1002/spe.4380250706]
• 5: F. Cohen. Operating system evolution through program evolution, 1992.
• 6: C. Collberg , E. Carter , S. Debray , A. Huntwork , J. Kececioglu , C. Linn , M. Stepp, Dynamic path-based software watermarking, Proceedings of the ACM SIGPLAN 2004 conference on Programming language design and implementation, June 09-11, 2004, Washington DC, USA
• 7: C. Collberg, A. Huntwork, E. Carter, and G. Townsend. Graph theoretic software watermarks: Implementation, analysis, and attacks. In Proceedings of the 6th Workshop on Information Hiding, pages 192--207, 2004.
• 8: Christian Collberg , Clark Thomborson, Software watermarking: models and dynamic embeddings, Proceedings of the 26th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, p.311-324, January 20-22, 1999, San Antonio, Texas, United States [doi>10.1145/292540.292569]
• 9: Christian S. Collberg , Clark Thomborson, Watermarking, tamper-proffing, and obfuscation: tools for software protection, IEEE Transactions on Software Engineering, v.28 n.8, p.735-746, August 2002 [doi>10.1109/TSE.2002.1027797]
• 10: Christian Collberg , Clark Thomborson , Douglas Low, Manufacturing cheap, resilient, and stealthy opaque constructs, Proceedings of the 25th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, p.184-196, January 19-21, 1998, San Diego, California, United States [doi>10.1145/268946.268962]
• 11: S. Cornett. Code coverage analysis, 2004. http://www.bullseye.com/coverage.html.
• 12: C. Corporation. SoftICE. http://www.compuware.com/.
• 13: Datarescue. IDAPro. http://www.datarescue.com/.
• 14: Bruno De Bus , Bjorn De Sutter , Ludo Van Put , Dominique Chanet , Koen De Bosschere, Link-time optimization of ARM binaries, ACM SIGPLAN Notices, v.39 n.7, July 2004
• 15: M. Ernst. Static and dynamic analysis: synergy and duality. In ICSE Workshop on Dynamic Analysis, pages 24--27, 2003.
• 16: Bill Horne , Lesley R. Matheson , Casey Sheehan , Robert Endre Tarjan, Dynamic Self-Checking Techniques for Improved Tamper Resistance, Revised Papers from the ACM CCS-8 Workshop on Security and Privacy in Digital Rights Management, p.141-159, November 05, 2001
• 17: R. Horspool and N. Marovac. An approach to the problem of detranslation of computer programs. The Computer Journal, 23(3):223--229, 1980.
• 18: International Planning and Research Corporation. First Annual BSAand IDCGlobal Software Piracy Study, 2004.
• 19: C. Kruegel, W. Robertson, F. Valeur, and G. Vigna. Static disassembly of obfuscated binaries. In Proceedings of the 13the USENIX Security Symposium, pages 255--270, 2004.
• 20: James R. Larus , Eric Schnarr, EEL: machine-independent executable editing, Proceedings of the ACM SIGPLAN 1995 conference on Programming language design and implementation, p.291-300, June 18-21, 1995, La Jolla, California, United States
• 21: Cullen Linn , Saumya Debray, Obfuscation of executable code to improve resistance to static disassembly, Proceedings of the 10th ACM conference on Computer and communications security, October 27-30, 2003, Washington D.C., USA [doi>10.1145/948109.948149]
• 22: M. Madou, B. Anckaert, P. Moseley, S. Debray, B. De Sutter, and K. De Bosschere. Software protection through dynamic code mutation. In Proceedings of the 6th International Workshop on Information Security Applications, pages 371--385, 2005.
• 23: J. Maebe, M. Ronsse, and K. De Bosschere. DIOTA: Dynamic instrumentation, optimization and transformation of applications. In Proceedings of the 4th Workshop on Binary Translation, 2002.
• 24: Steven S. Muchnick, Advanced compiler design and implementation, Morgan Kaufmann Publishers Inc., San Francisco, CA, 1998
• 25: G. Myles and C. Collberg. Software watermarking via opaque predicates: Implementation, analysis, and attacks. In Proceedings of the 7th International Conference on Electronic Commerce Research, 2004.
• 26: Gleb Naumovich , Nasir Memon, Preventing Piracy, Reverse Engineering, and Tampering, Computer, v.36 n.7, p.64-71, July 2003 [doi>10.1109/MC.2003.1212692]
• 27: T. Sahoo and C. Collberg. Software watermarking in the frequency domain: Implementation, analysis, and attacks. Technical Report TR04-07, Dept. of Computer Science, Univ. of Arizona, 2004.
• 28: B. Schwarz, G. Andrews, M. Legendre, and S. Debray. PLTO: A link-time optimizer for the intel ia-32 architecture. In Proceedings of the 3rd Workshop on Binary Rewriting, 2001.
• 29: B. Schwarz , S. Debray , G. Andrews, Disassembly of Executable Code Revisited, Proceedings of the Ninth Working Conference on Reverse Engineering (WCRE'02), p.45, October 29-November 01, 2002
• 30: Julien P. Stern , Gaël Hachez , François Koeune , Jean-Jacques Quisquater, Robust Object Watermarking: Application to Code, Proceedings of the Third International Workshop on Information Hiding, p.368-378, September 29-October 01, 1999
• 31: Sharath K. Udupa , Saumya K. Debray , Matias Madou, Deobfuscation: Reverse Engineering Obfuscated Code, Proceedings of the 12th Working Conference on Reverse Engineering, p.45-54, November 07-11, 2005 [doi>10.1109/WCRE.2005.13]
• 32: P. van Oorschot. Revisiting software protection. In Proceedings of the 6th International Information Security Conference, pages 1--13, 2003.
• 33: Ramarathnam Venkatesan , Vijay V. Vazirani , Saurabh Sinha, A Graph Theoretic Approach to Software Watermarking, Proceedings of the 4th International Workshop on Information Hiding, p.157-168, April 25-27, 2001
• 34: Chenxi Wang , Jonathan Hill , John Knight , Jack Davidson, Software Tamper Resistance: Obstructing Static Analysis of Programs, University of Virginia, Charlottesville, VA, 2000
• 35: Chenxi Wang , Jonathan Hill , John C. Knight , Jack W. Davidson, Protection of Software-Based Survivability Mechanisms, Proceedings of the 2001 International Conference on Dependable Systems and Networks (formerly: FTCS), p.193-202, July 01-04, 2001
• 36: Glenn Wurster , P. C. van Oorschot , Anil Somayaji, A Generic Attack on Checksumming-Based Software Tamper Resistance, Proceedings of the 2005 IEEE Symposium on Security and Privacy, p.127-138, May 08-11, 2005 [doi>10.1109/SP.2005.2]
• 37: C. Xiao. Delayed secure data retrieval, May 2003. International Business Machines Corporation, US Patent 6571337.

INDEX TERMS

Primary Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.0 General
          Subjects: Protection mechanisms

Additional Classification:
  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.1 Public Policy Issues
          Subjects: Intellectual property rights
      K.4.4 Electronic Commerce
          Subjects: Intellectual property; Security
  K.5 LEGAL ASPECTS OF COMPUTING
      K.5.1 Hardware/Software Protection
          Subjects: Copyrights; Proprietary rights

Keywords:
attacks, intellectual property, obfuscation, software protection, tamper-resistance, watermarking