[Cryptography] Crypto Trick Makes Software Nearly Impossible to Reverse-Engineer
Henry Baker
hbaker1 at pipeline.com
Thu Feb 12 17:05:15 EST 2015
FYI --
http://www.wired.com/2015/02/crypto-trick-makes-software-nearly-impossible-reverse-engineer/
A Crypto Trick That Makes Software Nearly Impossible to Reverse-Engineer
By Andy Greenberg 02.11.15 9:00 pm
Software reverse engineering, the art of pulling programs apart to figure out how they work, is what makes it possible for sophisticated hackers to scour code for exploitable bugs. Its also what allows those same hackers dangerous malware to be deconstructed and neutered. Now a new encryption trick could make both those tasks much, much harder.
At the SyScan conference next month in Singapore, security researcher Jacob Torrey plans to present a new scheme he calls Hardened Anti-Reverse Engineering System, or HARES. Torreys method encrypts software code such that its only decrypted by the computers processor at the last possible moment before the code is executed. This prevents reverse engineering tools from reading the decrypted code as its being run. The result is tough-to-crack protection from any hacker who would pirate the software, suss out security flaws that could compromise users, and even in some cases understand its basic functions.
This makes an application completely opaque, says Torrey, who works as a researcher for the New York State-based security firm Assured Information Security. It protects software algorithms from reverse engineering, and it prevents software from being mined for vulnerabilities that can be turned into exploits.
A company like Adobe or Autodesk might use HARES as a sophisticated new form of DRM to protect their pricey software from being illegally copied. On the other hand, it could also mean the start of a new era of well-armored criminal or espionage malware that resists any attempt to determine its purpose, figure out who wrote it, or develop protections against it. As notable hacker the Grugq wrote on twitter when Torreys abstract was posted to SyScans schedule, HARES could mean the end of easy malware analysis. :D
To keep reverse engineering tools in the dark, HARES uses a hardware trick thats possible with Intel and AMD chips called a Translation Lookaside Buffer (or TLB) Split. That TLB Split segregates the portion of a computers memory where a program stores its data from the portion where it stores its own codes instructions. HARES keeps everything in that instructions portion of memory encrypted such that it can only be decrypted with a key that resides in the computers processor. (That means even sophisticated tricks like a cold boot attack, which literally freezes the data in a computers RAM, cant pull the key out of memory.) When a common reverse engineering tool like IDA Pro reads the computers memory to find the programs instructions, that TLB split redirects the reverse engineering tool to the section of memory thats filled with encrypted, unreadable commands.
You can specifically say that encrypted memory shall not be accessed from other regions that arent encrypted, says Don Andrew Bailey, a well-known security researcher for Lab Mouse Security, who has reviewed Torreys work.
Many hackers begin their reverse engineering process with a technique called fuzzing. Fuzzing means they enter random data into the program in the hopes of causing it to crash, then analyze those crashes to locate more serious exploitable vulnerabilities. But Torrey says that fuzzing a program encrypted with HARES would render those crashes completely unexplainable. You could fuzz a program, but even if you got a crash, you wouldnt know what was causing it, he says. It would be like doing it blindfolded and drunk.
Torrey says he intends HARES to be used for protection against hacking-not for creating mysterious malware that cant be dissected. But he admits that if HARES works, it will be adopted for offensive hacking purposes, too. Imagine trying to figure out what Stuxnet did if you couldnt look at it, he says. I think this will change how [nation-state] level malware can be reacted to.
HARESs protections arent quite invincible. Any program that wants to use its crypto trick needs to somehow place a decryption key in a computers CPU when the application is installed. In some cases, a super-sophisticated reverse engineer could intercept that key and use it to read the programs hidden commands. But snagging the key would require him or her to plan ahead, with software thats ready to look for it. And in some cases where software comes pre-installed on a computer, the key could be planted in the CPU ahead of time by an operating system maker like Apple or Microsoft to prevent its being compromised. There are some concerns with this from a technical point of view, says Bailey. But its way better than anything we have out there now.
Another way to crack HARES encryption, says Torrey, would be to take advantage of a debugging feature in some chips. That feature allows a hardware device between the chip and the motherboard to read every command the processor executes. But taking advantage of that feature requires a five-figure-priced JTAG debugger, not a device most reverse engineers tend to have lying around. Its pretty high level stuff, he says. Obviously nation states will have these things, but probably not very many others.
Torrey notes that it may someday be possible to encrypt a programs code in a way that its instructions can run without ever being decrypted-making software thats truly unhackable. But such a system, known as fully homomorphic encryption, is still largely theoretical. It currently makes computer processes take millions of times longer than they would without encryption. HARES slows down the programs it protects by only about 2 percent. Fully homomorphic encryption is the holy grail, but its an academic math problem, Torrey says. This is something you can stick on your existing computer to protect your existing software.
Torrey developed HARESs TLB split trick with funding in 2013 from Darpas Cyber Fast Track program. He plans to release the projects code not at Marchs SyScan conference, but possibly the next month at the Infiltrate security conference in Miami.
Torrey says that he wouldnt be surprised, however, if coders determine from his March talk how to use HARESs tricks and begin writing malware thats far harder to decode. Give hackers an unencrypted hint or two, and they have a way of figuring out your secrets.
More information about the cryptography
mailing list