Vulnerability analysis, practical data flow analysis and visualization

ronjor · Mar 23, 2012

msft-mmpc
23 Mar 2012 12:35 PM

Recently at CanSecWest 2012, we presented on the technology we use for analyzing malicious samples and PoC files. As malware often actively attempts to exploit software vulnerabilities these days, understanding the internals of these vulnerabilities is essential when writing defense logic.

Out of the many methods that can be used for vulnerability analysis, we presented a method that uses dynamic binary instrumentation and data flow analysis. Dynamic binary instrumentation and data flow analysis are fancy concepts, and they can be a little bit difficult to apply to real world cases.

We showed a case where we used data flow analysis for a simple integer overflow vulnerability. By showing the result in a more visualized way, it helped us to understand the vulnerability. But the real issue we raised was how to use these technologies in more complicated cases, for example, for analyzing an uninitialized memory access vulnerability. We used CVE-2011-2462 (a vulnerability in Adobe Reader and Acrobat - this issue was addressed by Adobe and you can find more information here) as an example to show how to trace back to the root cause of the vulnerability using these techniques. (Note: the Adobe Reader X Protected Mode and Acrobat X Protected View mitigations (the Reader X and Acrobat X sandboxes) would prevent exploits of this vulnerability from executing – this is an exercise in analyzing a vulnerability not an exploit.)

The vulnerability is a little bit complicated, as the data flow does not show the whole picture of the connection between the user data and the crash point.
Click to expand...

https://blogs.technet.com/b/mmpc/ar...alysis-and-visualization.aspx?Redirected=true

Log in or Sign up

Vulnerability analysis, practical data flow analysis and visualization

ronjor Global Moderator

Log in or Sign up

Vulnerability analysis, practical data flow analysis and visualization

ronjor Global Moderator

Useful Searches