自動化定位執行檔中密碼學相關資訊

Automatically Locate Cryptography-related Information in Executable Files

鄭翔予(Hsiang-Yu Cheng)

指導教授 ： 雷欽隆

國立臺灣大學/電機資訊學院/電機工程學研究所/碩士(2022年)

https://doi.org/10.6342/NTU202202284

摘要

隨著電腦的使用率急遽增加，以及大量的資料以數位化的形式儲存在電腦中，出現被惡意程式攻擊的情況也越來越頻繁。在這些惡意程式中，經常使用密碼學演算法來隱藏自己的行為以增加分析的困難度，其中勒索軟體更會進一步利用密碼學演算法加密受害者的資料以便勒索贖金，因此能夠從執行檔中得到密碼學演算法的相關資訊在惡意程式分析中是重要的一個環節。
由於程式的多樣性，大部分的情況仍然是以研究員手動分析為主，但也因此需要耗費許多的人力和時間。為了解決這樣的問題，我們提出了一個新的系統。它能夠利用動態分析自動化地偵測執行檔中跟密碼學演算法相關的函式們，並幫它們排序，排名越高就越有機會是我們要找的目標。除此之外，它也能提供明文、密文、金鑰、初始向量等密碼學參數所在的可能位置。最後一點，它可以處理加殼的程式。透過這個系統，除了能夠幫助研究員更快地得到密碼學演算法的相關資訊，也能夠幫研究員定位出值得做進一步分析的函式們。
在測試樣本上，我們總共挑選了十種密碼學演算法，實作方式包括兩種常見的密碼學函式庫以及六種自定義的密碼學演算法。我們的系統能夠找到所有測試目標中的密碼學演算法位置。此外，也能提供至少一種密碼學參數的所在位置，並在大部分情況下找到所有的密碼學參數。

關鍵字

動態分析 ； 逆向工程 ； 自動偵測 ； 密碼學 ； 加殼程式

並列摘要

As the usage rate of computers has dramatically increased, and massive data is digitalized and stored in computers, it's more common to be attacked by malicious software. Among all the malware, cryptography algorithms are frequently abused to hide their activity and raise the difficulty of analysis. Especially for ransomware, which utilizes these cryptography algorithms to encrypt the victim's data and ask for ransom. Therefore, retrieving cryptography algorithms related information from binary executable files plays an important part in malware analysis.
Due to the variety of programs, most situations still depend mainly on manual analysis by researchers and thus cost lots of human resources and time. To solve such an issue, we propose a novel system. It can automatically detect cryptography algorithms related functions in binary executable files through dynamic analysis and sort them, where the high-ranking functions are more likely to be the wanted goal. Moreover, it can also provide the possible addresses of cryptography parameters such as plaintext, ciphertext, key, and initialization vector. Last but not least, it can handle the packed programs. By utilizing this system, researchers can not only get cryptography algorithm related information faster but also figure out which functions require deeper analysis.
On the testing samples, we select ten cryptography algorithms and the implementation method includes two common cryptography libraries and six proprietary cryptography algorithms. Our system can find out all the locations of cryptography algorithm related functions. Furthermore, it can at least provide one cryptographic parameter, and find all the cryptographic parameters in most cases.

並列關鍵字

Dynamic Analysis ； Reverse Engineering ； Automatic Detection ； Cryptography ； Packed Programs

參考文獻

O. G. Abdulzaher. Tea tiny encryption algorithm, https://github.com/o-gamal/tea-tiny-encryption-algorithm.

L. Auriemma. signsrch - tool for searching signatures inside files.

D. Buhov, P. Kochberger, R. Thron, and S. Schrittwieser. Discovering cryptographic algorithms in binary code through loop enumeration. In 2017 International Conference on Software Security and Assurance (ICSSA), pages 80–86, 2017.

J. Caballero, P. Poosankam, C. Kreibich, and D. Song. Dispatcher: Enabling active botnet infiltration using automatic protocol reverse-engineering. pages 621–634, 01 2009.

J. Calvet, J. Fernandez, and J.-Y. Marion. Aligot: cryptographic function identification in obfuscated binary programs. In ACM Conference on Computer and Communications Security, pages 169–182, Raleigh, United States, Oct. 2012.