How Professional Hackers Understand Protected Code while Performing Attack Tasks

Abstract

Code protections aim at blocking (or at least delaying) reverse engineering and tampering attacks to critical assets within programs. Knowing the way hackers understand protected code and perform attacks is important to achieve a stronger protection of the software assets, based on realistic assumptions about the hackers' behaviour. However, building such knowledge is difficult because hackers can hardly be involved in controlled experiments and empirical studies.The FP7 European project Aspire has given the authors of this paper the unique opportunity to have access to the professional penetration testers employed by the three industrial partners. In particular, we have been able to perform a qualitative analysis of three reports of professional penetration test performed on protected industrial code.Our qualitative analysis of the reports consists of open coding, carried out by 7 annotators and resulting in 459 annotations, followed by concept extraction and model inference. We identified the main activities: understanding, building attack, choosing and customizing tools, and working around or defeating protections. We built a model of how such activities take place. We used such models to identify a set of research directions for the creation of stronger code protections.2 https://aspire-fp7.eu

An Observational Investigation of Reverse Engineers' Process and Mental Models

“…To measure intercoder reliability, we used Krippendorff's Alpha (α), as it accounts for chance agreements [67]. 2 After each round, the coders resolved any differences, updated the codebook as necessary, and re-coded previously coded interviews. The coders repeated this process four times until they achieved an α of 0.8, which is above the recommended level for exploratory studies [67,69].…”

Analysis of Obfuscated Code with Program Slicing

“…Different metrics are used to measure various security requirements [22], and similarly code metrics have also been a common approach to measure obfuscation strength [23] or by calculating their potency [3]. Other approaches have been proposed to measure the attacker effort increased by obfuscation by means of controlled experiments with students [23], penetration testers [24] or public challenges [25], while other works tried to represent the attacker effort with modelling approaches based on Petri nets [26] [27], or an ontology of attacks and protections [28].…”

[Research Paper] Obfuscating Java Programs by Translating Selected Portions of Bytecode to Native Libraries

“…Other properties of translated/obfuscated code, such us how harder it is to understand and to attack, are out of the scope of the present paper. To investigate these properties, human studies and controlled experiment are required, and we are planning and conducting them as part of our research activity [5], [24], [6] A. Case Studies…”