PwIN – Pwning Intel piN: Why DBI is Unsuitable for Security Applications

Kirsch, Julian; Zhechev, Zhechko; Bierbaumer, Bruno; Kittel, Thomas

doi:10.1007/978-3-319-99073-6_18

Cited by 14 publications

(32 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Supporting the first property in the presence of a dedicated adversary seems instead hard for a DBI engine: as the runtime shares the same address space of the code under analysis, the possibility of covert channels is real. Actually, by subverting isolation an attacker might in turn also foil the inspection and interposition capabilities of a DBI system [28].…”

Section: Desired Transparency Propertiesmentioning

confidence: 99%

“…There are peculiarities of DBI that could be exploited as well: for instance, the time required to dynamically load a library from user code can be two orders of magnitude larger [17] under DBI due to the image loading process. Similarly, effects of the trace compilation process can be exploited by observing fluctuations in the time required to take a branch in the program from the first time it is observed in the execution [28].…”

Section: Artifacts In Current Dbi Embodimentsmentioning

confidence: 99%

“…For instance, Pin and DynamoRIO miss permission violations when the virtual IP falls into code pages for which access has been disabled (PAGE_NOACCESS) or guarded (PAGE_GUARD) by the application [24]. Similarly, an engine may erroneously process and execute code from pages that were not granted execution permissions [28].…”

Section: Artifacts In Current Dbi Embodimentsmentioning

confidence: 99%

“…Analysis systems that base their working on binary translation are subject to implementation defects and limitations: this is true for DBI but also for full system emulators like QEMU. A popular example is the enter instruction that is not implemented in Valgrind [28]. DBI architects may decide to not support rarely used instructions; however, some instructions are intrinsically challenging for DBI systems: consider for instance far returns, which in Pin are allowed only when within the same code segment.…”

Section: Artifacts In Current Dbi Embodimentsmentioning

confidence: 99%

“…Among academic works, Polino et al [46] proposed countermeasures for anti-instrumentation strategies found in packers, some of which are specific to DBI. One year later Kirsch et al [28] presented a research that instead deems DBI unsuitable for security applications, presenting a case study on its most popular framework.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

SoK

D’Elia

Coppa

Nicchi

et al. 2019

Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security

View full text Add to dashboard Cite

Dynamic binary instrumentation (DBI) techniques allow for monitoring and possibly altering the execution of a running program up to the instruction level granularity. The ease of use and flexibility of DBI primitives has made them popular in a large body of research in different domains, including software security. Lately, the suitability of DBI for security has been questioned in light of transparency concerns from artifacts that popular frameworks introduce in the execution: while they do not perturb benign programs, a dedicated adversary may detect their presence and defeat the analysis. The contributions we provide are twofold. We first present the abstraction and inner workings of DBI frameworks, how DBI assisted prominent security research works, and alternative solutions. We then dive into the DBI evasion and escape problems, discussing attack surfaces, transparency concerns, and possible mitigations. We make available to the community a library of detection patterns and stopgap measures that could be of interest to DBI users. CCS CONCEPTS • Security and privacy → Systems security; Intrusion/anomaly detection and malware mitigation; Software reverse engineering; Software security engineering.

show abstract

Section: Desired Transparency Propertiesmentioning

confidence: 99%

Section: Artifacts In Current Dbi Embodimentsmentioning

confidence: 99%

Section: Artifacts In Current Dbi Embodimentsmentioning

confidence: 99%

Section: Artifacts In Current Dbi Embodimentsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations