Nella giornata del 09/07/2019 la delegazione inviata da Prisma, insieme ai membri dell’Università di Roma La Sapienza, ha partecipato alla conferenza ACM ASIACCS 2019, presentando l’articolo scientifico “SoK: Using Dynamic Binary Instrumentation for Security (And How You May Get Caught Red Handed)” all’interno di un talk durato 25 minuti. Il paper discusso tratta il tema dell’utilizzo della tecnologia di Dynamic Binary Instrumentation nell’ambito della malware analysis, fornendone una visione completa riguardo lo stato dell’arte e su come i possibili problemi riscontrati possano essere aggiustati sia a livello di metodologia sia a livello di codice.
SoK: Using Dynamic Binary Instrumentation for Security (And How You May Get Caught Red Handed)
Dynamic binary instrumentation (DBI) techniques allow for monitoring and possibly altering the execution of a running program up to the instruction level granularity. The ease of use and flexibility of DBI primitives has made them popular in a large body of research in different domains, including software security. Lately, the suitability of DBI for security has been questioned in light of transparency concerns from artifacts that popular frameworks introduce in the execution: while they do not perturb benign programs, a dedicated adversary may detect their presence and defeat the analysis. The contributions we provide are two-fold. We first present the abstraction and inner workings of DBI frameworks, how DBI assisted prominent security research works, and alternative solutions. We then dive into the DBI evasion and escape problems, discussing attack surfaces, transparency concerns, and possible mitigations. We make available to the community a library of detection patterns and stopgap measures that could be of interest of DBI users
