Attackers can exploit software vulnerabilities through patches by either manually or automatically identifying vulnerable code. However, for certain types of patches, the effectiveness of exploit tools can be diminished, thus closing an attacker's window of opportunity. E very second Tuesday of the month, Microsoft releases its "Patch Tuesday" software updates. These updates include security patches, most of which are documented to inform system administrators about what's vulnerable. Microsoft typically words this without giving concrete hints on how to exploit the fixed vulnerabilities, but its descriptions don't always match the patched vulnerabilities, and some aren't even mentioned. 1 So when security researchers or attackers get their hands on binary patches, they start inspecting them in preparation for "Exploit Wednesday," the window of opportunity for attackers to target unsuspicious users who didn't immediately apply the update. In some cases, attackers can also target users who did apply the patch immediately but were left vulnerable because a fix wasn't complete. 2 With the help of so-called diffing tools such as Darungrim (www.darungrim.org) and BinDiff (www.zynamics.com/bindiff.html), attackers compare the binary code before and after the patch to identify the fixed code fragments and the applied fixes, determine the closed vulnerabilities, and ultimately devise actual exploits for those vulnerabilities. While Patch Tuesday and Exploit Wednesday are the best-known instances of this scenario, it takes place every time software vendors release binary security updates. Attackers can, for example, launch a similar exploit to identify the code that implements new functionality in software updates as a first step toward reverse-engineering or stealing intellectual property. They can also use such attacks and diffing tools to port information from one program version to another. Once they identify the corresponding parts in consecutive program versions, attackers can more easily reuse their existing reverse-engineering knowledge. David Brumley and his colleagues demonstrated that exploits can sometimes be devised without any human code analysis or understanding: all the attack needs is an accurate identification of the new instructions that the patch inserted. 3 On that basis, attackers apply constraint-solving techniques on program inputs to generate attacks automatically. To the best of our knowledge, any published patched-based attack to date similarly builds on the assumption that expert attackers assisted by diffing tools can easily identify the relatively few relevant differences between unpatched and patched binaries. [4] [5] [6] In this article, we demonstrate that this assumption is often but not always valid for ordinary code-in fact, it falls apart completely for diversified code. Here, diversification is the deliberate generation of different binaries from the same source code. We evaluate how it complicates and delays the identification of vulnerable code by making the diffing tools less effective. A delay shortens the attacker's window of opportunity, thus reducing the potential profit. It also corresponds to an increased effort to compensate for the tools' reduced effectiveness, and hence to an increased investment on the attacker's part.
Diversification can prevent collusion attacks to identify software vulnerabilities based on patches REF .
Protecting Your Software Updates
IEEE Security & Privacy
IEEE Security & Privacy
Computer Science