D'Elia, Daniele Cono; Coppa, Emilio; Nicchi, Simone; Palmaro, Federico; Cavallaro, Lorenzo; (2019) SoK: Using Dynamic Binary Instrumentation for Security (And How You May Get Caught Red Handed). In: Proceedings of the 2019 ACM Asia conference on Computer and Communications Security (Asia CCS '19). (pp. pp. 15-27). ACM (Association for Computing Machinery): New York, NY, United States.

Preview

PDF asiaccs2019.pdf - Accepted Version Download (515kB) | Preview

Abstract

Dynamic binary instrumentation (DBI) techniques allow for monitoring and possibly altering the execution of a running program up to the instruction level granularity. The ease of use and flexibility of DBI primitives has made them popular in a large body of research in different domains, including software security. Lately, the suitability of DBI for security has been questioned in light of transparency concerns from artifacts that popular frameworks introduce in the execution: while they do not perturb benign programs, a dedicated adversary may detect their presence and defeat the analysis. The contributions we provide are two-fold. We first present the abstraction and inner workings of DBI frameworks, how DBI assisted prominent security research works, and alternative solutions. We then dive into the DBI evasion and escape problems, discussing attack surfaces, transparency concerns, and possible mitigations. We make available to the community a library of detection patterns and stopgap measures that could be of interest to DBI users.

Download activity - last month

Export as JSONCSVXML

Download activity - last 12 months

Export as CSVXMLJSON

Downloads by country - last 12 months

Export as JSONCSVXML

Archive Staff Only

View Item