Program Analysis for Cybersecurity
This post contains the materials for the Program Analysis for Cybersecurity (PAC) training I’ll be teaching at the 2017-2019 US Cyber Challenge security boot camps. The training is aimed at audiences with little or no experience in program analysis.
Materials
Note: These materials have been replaced by a new set of heavily revised materials available here. This page is provided now only for posterity..
Please use the links below to download the training materials.
Virtual Machines
The course materials include details on building the virtual machines at home from scratch, but to save time at the USCC camps we will be providing pre-made virtual machines with temporary software licenses. The labs requiring Microsoft Windows can be run in the evaluation mode of Windows. A free academic, community, or trial license of Atlas can be requested directly from EnSoft Corp. All other software is free or open source.
The following virtual machines are a mix of Virtual Box and VMware appliances.
| Virtual Machine | Role | Credentials | VM Modifications | Additional Resources |
|---|---|---|---|---|
| Kali 2019.2 (VMWare) | Attacker Machine | root:toor | None. | All Kali Linux Downloads |
| Hacking Live (VirtualBox) | Local Victim Machine | pac:badpass | Updated repository sources, installed hexedit tool, console color preferences, added course materials | Hacking Live ISO, Hacking Live ISO (mirror) |
| Windows XP SP3 x86 Victim (VMWare) | Remote Victim Machine | XPVictim:WilEXamixt | MiniShare server scheduled to run on computer start | WinXPSP3 ISO |
| Windows 7 x64 (VMWare) | Analysis Machine, Optional Victim Machine | Victim:badpass | GNU C++ Compiler, Java 8, Eclipse, Atlas, Android Developer Toolkit, JReFrameworker, registry edits to enable remote login, EMET, added course materials | Win7SP1 ISO |
Note: The files above are mirrored online at: https://drive.google.com/drive/folders/16dylIqc0jtaocmpAZC66UCOeBv6zhWUE.
Note: When using the VirtualBox player the mouse integration feature is turned on be default. If the feature is not working properly (particularly in the HackingLive VM) you can disable it my navigating to Input > Mouse Integration and toggle it on and off.
Note: Virtual Box and VMware players are available free.
Learning Objectives
By the end of this course you should be able to:
- Demonstrate basic bug hunting, exploitation, evasion, and post-exploitation skills
- Describe commonalities between vulnerability analysis and malware detection
- Describe fundamental limits in program analysis
- Challenge conventional viewpoints of security
- Confidently approach large third party software
- Critically evaluate software security products
- Locate additional relevant resources
Learning Modules
The course material is broken into 6 modules that cover both defensive and offensive materials.
Exploit Development
First we will become intimately familiar with one particular type of bug, a buffer overflow. We will iteratively develop exploits for a simple Linux program with a buffer overflow before we move on to developing an exploit for a Windows web server called MiniShare.
Fundamentals of Program Analysis
Next we will discuss program analysis and how it can be used to analyze programs to detect bugs and malware. We will also consider some fundamental challenges and even limitations of what is possible in program analysis. This module discusses relationships between bugs and malware, as well as strategies for integrating human intelligence in automatic program analysis. Later you will be presented with an enormous task of quickly locating malware in a large Android application (several thousand lines of code). Through this activity you will be challenged to develop strategies for auditing something that is too big to personally comprehend. As a class we will collectively develop strategies to audit the application, we will use those strategies to develop automated techniques for detecting malware.
Bug Hunting
In this module we will examine strategies for hunting for unknown bugs in software. We will revisit our buffer overflow vulnerabilities and consider what is involved to automatically detect the vulnerability for various programs while considering the limitations of program analysis. We will develop a tool to automatically locate the line number of the code that was exploited in the MiniShare web server.
Antivirus Evasion
Since antivirus is used to actively thwart exploitation attempts, we will take a detour to examine techniques to bypass and evade antivirus. Specifically we will examine what is necessary to manually modify a year 2012 browser drive by attack to become undetectable by all modern antivirus. We will also build a tool to automatically obfuscate and pack our exploit.
Post Exploitation
In this module we will develop a Managed Code Rootkit (MCR) and deploy the rootkit on the victim machine using our previous exploit against MiniShare.
Going Beyond
In this final module, we explore future directions in the field and examine some open problems in the context of what we learned in the previous modules.
Note: The labs in this course are designed to push everyone in this course. Likely there will be some subject that you feel ill equipped to try, but don’t let that be a barrier. Attempt the lab to the best of your ability and try your best to learn the core ideas behind each activity. Then attempt the lab again when you have more time. Please send questions, thoughts, and comments to [email protected] and I will be happy to help you find your way to success for any of the labs. There are multiple solutions to each lab, and in some cases there are no right answers!