Chad Spensky

University of North Carolina at Chapel Hill, Computer Science, Graduate Student

Followers

Following

Public Views

Supervisors: Mike Reiter

less

Interests

Uploads

Papers by Chad Spensky

mit-ll/CATAN: Update to enable DOI wehook

updated attempt to complete webhook

mit-ll/LL-Smartcard: DOI tagged

Release to initialize Zenodo DOI

Analyzing and Securing Embedded Systems

Author(s): Spensky, Chad | Advisor(s): Vigna, Giovanni; Kruegel, Christopher | Abstract: Embedded... more Author(s): Spensky, Chad | Advisor(s): Vigna, Giovanni; Kruegel, Christopher | Abstract: Embedded systems (i.e., single-purpose computers with tightly-coupled software and hardware) are now pervasive throughout in our increasingly digitized world. Due to the rapid growth of the embedded systems industry and the commercial pressure to implement new features, most of these systems are built using insecure hardware and have numerous latent software vulnerabilities. Unfortunately, the diversity of physical hardware and software implementations on these various systems along with their tight coupling between software and hardware have rendered most of our existing automated security analysis techniques ineffective. Attackers currently have the upper hand, as they need only discover a single vulnerability, whereas defenders must manually identify, and fix, all of the existing vulnerabilities. To make matters worse, many of these vulnerable embedded systems can interact with the physical w...

Can Smartphones and Privacy Coexist

Conware: Automated Modeling of Hardware Peripherals

Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security, 2021

Emulation is at the core of many security analyses. However, emulating embedded systems is still ... more Emulation is at the core of many security analyses. However, emulating embedded systems is still not possible in most cases. To facilitate this critical analysis, we present Conware, a hardware emulation framework that can automatically generate models for hardware peripherals, which alleviates one of the major challenges currently hindering embedded systems emulation. Conware enables individual peripherals to be modeled, exported, and combined with other peripherals in a pluggable fashion. Conware achieves this by first obtaining a recording of the low-level hardware interactions between the firmware and the peripheral, using either existing methods or our source-code instrumentation technique. These recordings are then used to create high-fidelity automata representations of the peripheral using novel automata-generation techniques. The various models can then be merged to facilitate full-system emulation of any embedded firmware that uses any of the modeled peripherals, even if t...

Download

Practical Misconfiguration Identification in Access-Control Systems

We develop an approach for identifying accesses that are not permitted by implemented policy but ... more We develop an approach for identifying accesses that are not permitted by implemented policy but that share similarities with accesses that have been allowed. Such accesses are indicative of potential access-control policy misconfigurations; identifying the misconfigurations allows administrators to resolve them before they interfere with the use of the system. Our work improves on previous research by supporting a desired balance between the accuracy of its misconfiguration predictions and the amount of intended policy that it uncovers, and by removing the need to hand-tune various parameters. Our method introduces computational challenges that we address through the development of a novel algorithm. We revisit the methodology used to evaluate misconfiguration prediction algorithms in the past, and show that it substantially overestimates the benefits of such algorithms in real systems, owing to its tendency to reward predictions that can be deduced to be redundant. Finally, we go ...

Download

Glitching Demystified: Analyzing Control-flow-based Glitching Attacks and Defenses

2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2021

Hardware fault injection, or glitching, attacks can compromise the security of devices even when ... more Hardware fault injection, or glitching, attacks can compromise the security of devices even when no software vulnerabilities exist. Attempts to analyze the hardware effects of glitching are subject to the Heisenberg effect and there is typically a disconnect between what people “think” is possible and what is actually possible with respect to these attacks. In this work, we attempt to provide some clarity to the impacts of attacks and defenses for control-flow modification through glitching. First, we introduce a glitching emulation framework, which provides a scalable playground to test the effects of bit flips on specific instruction set architectures (ISAs) (i.e., the fault tolerance of the instruction encoding). Next, we examine real glitching experiments using the ChipWhisperer, a popular microcontroller using open-source glitching hardware. These real-world experiments provide novel insights into how glitching attacks are realized and might be defended against in practice. Fin...

Download

Evolutionary Computation for Improving Malware Analysis

Research in genetic improvement (GI) conventionally focuses on the improvement of software, inclu... more Research in genetic improvement (GI) conventionally focuses on the improvement of software, including the automated repair of bugs and vulnerabilities as well as the refinement of software to increase performance. Eliminating or reducing vulnerabilities using GI has improved the security of benign software, but the growing volume and complexity of malicious software necessitates better analysis techniques that may benefit from a GI-based approach. Rather than focus on the use of GI to improve individual software artifacts, we believe GI can be applied to the tools used to analyze malicious code for its behavior. First, malware analysis is critical to understanding the damage caused by an attacker, which GI-based bug repair does not currently address. Second, modern malware samples leverage complex vectors for infection that cannot currently be addressed by GI. In this paper, we discuss an application of genetic improvement to the realm of automated malware analysis through the use o...

Download

Making Contribution-Aware Peer-Assisted Content Distribution Robust to Collusion Using Bandwidth Puzzles

Many peer-assisted content-distribution systems reward a peer based on the amount of data that th... more Many peer-assisted content-distribution systems reward a peer based on the amount of data that this peer serves to others. However, validating that a peer did so is, to our knowledge, an open problem; e.g., a group of colluding attackers can earn rewards by claiming to have served content to one another, when they have not. We propose a bandwidth puzzle mechanism to make contribution-aware peer-assisted content distribution robust to such collusion. Our construction both ties solving the puzzle to possession of content and, by issuing puzzle challenges simultaneously to all parties claiming to have the same content, prevents one content-holder from solving many others’ puzzles. We bound (in the random oracle model) the adversaries’ ability to defeat our puzzle scheme. We also describe our integration of bandwidth puzzles into a fully operational media streaming system, and demonstrate the attack resilience offered by bandwidth puzzles through simulations of both streaming and file-s...

Download

Toward the Analysis of Embedded Firmware through Automated Re-hosting

Author(s): Gustafson, Eric; Muench, Marius; Spensky, Chad; Redini, Nilo; Machiry, Aravind; Fratan... more

Download

DR. CHECKER: A Soundy Analysis for Linux Kernel Drivers

While kernel drivers have long been know to poses huge security risks, due to their privileged ac... more While kernel drivers have long been know to poses huge security risks, due to their privileged access and lower code quality, bug-finding tools for drivers are still greatly lacking both in quantity and effectiveness. This is because the pointer-heavy code in these drivers present some of the hardest challenges to static analysis, and their tight coupling with the hardware make dynamic analysis infeasible in most cases. In this work, we present DR. CHECKER, a soundy (i.e., mostly sound) bug-finding tool for Linux kernel drivers that is based on well-known program analysis techniques. We are able to overcome many of the inherent limitations of static analysis by scoping our analysis to only the most bug-prone parts of the kernel (i.e., the drivers), and by only sacrificing soundness in very few cases to ensure that our technique is both scalable and precise. DR. CHECKER is a fully-automated static analysis tool capable of performing general bug finding using both pointer and taint an...

Download

Karonte: Detecting Insecure Multi-binary Interactions in Embedded Firmware

2020 IEEE Symposium on Security and Privacy (SP)

Low-power, single-purpose embedded devices (e.g., routers and IoT devices) have become ubiquitous... more Low-power, single-purpose embedded devices (e.g., routers and IoT devices) have become ubiquitous. While they automate and simplify many aspects of users' lives, recent large-scale attacks have shown that their sheer number poses a severe threat to the Internet infrastructure. Unfortunately, the software on these systems is hardware-dependent, and typically executes in unique, minimal environments with non-standard configurations, making security analysis particularly challenging. Many of the existing devices implement their functionality through the use of multiple binaries. This multi-binary service implementation renders current static and dynamic analysis techniques either ineffective or inefficient, as they are unable to identify and adequately model the communication between the various executables. In this paper, we present KARONTE, a static analysis approach capable of analyzing embedded-device firmware by modeling and tracking multi-binary interactions. Our approach propagates taint information between binaries to detect insecure interactions and identify vulnerabilities. We first evaluated KARONTE on 53 firmware samples from various vendors, showing that our prototype tool can successfully track and constrain multi-binary interactions. This led to the discovery of 46 zero-day bugs. Then, we performed a large-scale experiment on 899 different samples, showing that KARONTE scales well with firmware samples of different size and complexity.

Download

The Leakage-Resilience Dilemma

Lecture Notes in Computer Science

Many control-flow-hijacking attacks rely on information leakage to disclose the location of gadge... more Many control-flow-hijacking attacks rely on information leakage to disclose the location of gadgets. To address this, several leakageresilient defenses, have been proposed that fundamentally limit the power of information leakage. Examples of such defenses include address-space re-randomization, destructive code reads, and execute-only code memory. Underlying all of these defenses is some form of code randomization. In this paper, we illustrate that randomization at the granularity of a page or coarser is not secure, and can be exploited by generalizing the idea of partial pointer overwrites, which we call the Relative ROP (Rel-ROP) attack. We then analyzed more that 1,300 common binaries and found that 94% of them contained sufficient gadgets for an attacker to spawn a shell. To demonstrate this concretely, we built a proof-of-concept exploit against PHP 7.0.0. Furthermore, randomization at a granularity finer than a memory page faces practicality challenges when applied to shared libraries. Our findings highlight the dilemma that faces randomization techniques: course-grained techniques are efficient but insecure and fine-grained techniques are secure but impractical.

Download

LO-PHI: Low-Observable Physical Host Instrumentation for Malware Analysis

Proceedings 2016 Network and Distributed System Security Symposium, 2016

Dynamic-analysis techniques have become the linchpins of modern malware analysis. However, softwa... more Dynamic-analysis techniques have become the linchpins of modern malware analysis. However, software-based methods have been shown to expose numerous artifacts, which can either be detected and subverted, or potentially interfere with the analysis altogether, making their results untrustworthy. The need for less-intrusive methods of analysis has led many researchers to utilize introspection in place of instrumenting the software itself. While most current introspection technologies have focused on virtual-machine introspection, we present a novel system, LO-PHI, which is capable of physical-machine introspection of both non-volatile and volatile memory, i.e., hard disk and system memory. We demonstrate that we are able to provide analysis capabilities comparable to existing solutions, whilst exposing zero software-based artifacts and minimal hardware artifacts. To demonstrate the usefulness of our system, we have developed a framework for performing automated binary analysis. We employ this framework to analyze numerous potentially malicious binaries using both traditional virtual-machine introspection and our new hardware-based instrumentation. Our results show that not only is our analysis on-par with existing software-based counterparts, but that our physical instrumentation is capable of successfully analyzing far more binaries, as it is not foiled by popular anti-analysis techniques. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

Download

BOOMERANG: Exploiting the Semantic Gap in Trusted Execution Environments

Proceedings 2017 Network and Distributed System Security Symposium, 2017

In the past decade, we have come to rely on computers for various safety and security-critical ta... more In the past decade, we have come to rely on computers for various safety and security-critical tasks, such as securing our homes, operating our vehicles, and controlling our finances. To facilitate these tasks, chip manufacturers have begun including trusted execution environments (TEEs) in their processors, which enable critical code (e.g., cryptographic functions) to run in an isolated hardware environment that is protected from the traditional operating system (OS) and its applications. While code in the untrusted environment (e.g., Android or Linux) is forbidden from accessing any memory or state within the TEE, the code running in the TEE, by design, has unrestricted access to the memory of the untrusted OS and its applications. However, due to the isolation between these two environments, the TEE has very limited visibility into the untrusted environment's security mechanisms (e.g., kernel vs. application memory). Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

Download

PeriScope: An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary

Proceedings 2019 Network and Distributed System Security Symposium

TRUST.IO: Protecting Physical Interfaces on Cyber-physical Systems

2020 IEEE Conference on Communications and Network Security (CNS)

TRUST.IO: Protecting Physical Interfaces on Cyber-physical Systems

2020 IEEE Conference on Communications and Network Security (CNS)

Using open-source hardware to support disadvantaged communications

2015 IEEE Global Humanitarian Technology Conference (GHTC), 2015

HARCHOL-BALTER, Mor CMU-CS-09-113, CMU-CS-09-115, CMU-CS-09-166 HARKES, Jan CMU-CS-09-178 HAUPTMAN, Alex CMU-CS-09-161 HAYS …

reports-archive.adm.cs.cmu.edu

... SEKAR, Vyas CMU-CS-09-104, CMU-CS-09-125, CMU-CS-09-136. SERENYI, Denis CMU-CS-09-139. SHERWA... more

Chad Spensky

Uploads

Papers by Chad Spensky

Log In