Bilgisayar Dil Mühendisliği ve
Derleyiciler Kapsamında Güvenlik
Özgür Hepsağ
Plan
1. Software Watermarking
2. Code Obfuscation
3. Code Integrity
4. Type Checking
5. Virtual Machine
Software Watermarking
• Watermarking is a technique that was developed in the thirteenth
century, which has been adapted as a way to protect digital goods.
Watermarks on physical or digital goods are often used to identify
counterfeits, as they will have an incorrect or missing watermark.
• Software watermarking is a defense technique used to prevent
software piracy by embedding a signature, an identifier reliably
representing the owner, in the code. When an illegal copy is made,
the ownership can be claimed by extracting this identifier. The
signature has to be hidden inside the program and it has to be
difficult for an attacker to detect, tamper or remove it.
Compiler Techniques for Watermarking
1- Static Watermarking
Compiler Techniques for Watermarking (cont’d)
2- Dynamic Watermarking
Attacks on Watermark
• Additive Attack: the attacker inserts a custom watermark into the
program.
• Subtractive Attack: the attacker removes most of the original
watermark
• Distortive Attack: transformations are applied to the program to
prevent the recovery of the watermark by scrambling the locations
where the watermark is expected.
Code Obfuscation
• Code obfuscation makes the (compiled binary) code difficult or
impossible to understand.
• Compilation is a form of obfuscation, as it converts source code into
another form (e.g., machine code, byte code).
• One of the major uses of obfuscation is in reverse engineering
prevention.
Obfuscation Techniques
• Abstraction Transformations: alter the structure of a program by
removing program information from the functions, objects and etc.
• Data Transformations: replace data structures with other data
structures.
• Control Transformations alter the control flow structure of the
program to hide the execution path.
• Dynamic Transformations: insert code into the program that causes
the program to be transformed during execution.
Code Integrity
• Code integrity is a threat protection feature that checks the drivers
and system files on your device for signs of corruption or malicious
software.
Buffer Overflow
• Buffer Overflow, is an anomaly
where a program, while writing
data to a buffer, overruns the
buffer's boundary and
overwrites adjacent memory
locations.
• By sending data designed to
cause a buffer overflow, it is
possible to write into areas
known to hold executable code
and replace it with malicious
code.
Buffer Overflow Example
void fun(char*s)
{
char buffer[4];
strcpy(buffer,s);
printf(" value in buffer %s\n", buffer);
}
void main(int argc,char *argv[])
{
fun(argv[1]);
return 0;
}
Stack Canaries
• Stack canaries are used to detect buffer
overflow attacks before they occur.
• They are implemented by compilers to
make the exploitation more harder by
using canaries in potentially vulnerable
functions.
• The function prologue puts a value into
the canary location and the epilogue
checks to make sure that value is not
altered.
Type Checking
• A type, also known as a data type, is a classification identifying one of
various types of data.
• The data type describes the possible values of a structure (such as a
variable), the semantic meaning of that structure.
• For example: Integers, Strings, Floats, and Booleans
• Type checking is the process of verifying and enforcing the constraints
of types, and it can occur either at compile time (statically) or at
runtime (dynamically).
Static vs Dynamic Type Checking
Go
Python
void foo(a int) {
def foo(a):
if (a > 0) {
fmt.Println("Hi")
} else {
fmt.Println("3" + 5)
}
}
if a > 0:
print 'Hi'
else:
print "3" + 5
Static vs Dynamic Type Checking
• The big benefit of static type checking is that it allows many type
errors to be caught early in the development cycle. (defends against
unintended errors)
• Static typing usually results in compiled code that executes more
quickly. (machine code optimization)
• Dynamic typing is more flexible and allows for variables to change
types.
Virtual Machine
• A process VM, runs as a normal
application inside a host OS and
supports a single process.
• Process VMs are implemented
using an JIT (Just-in-time)
compiler.
• Just In Time Compilation is being
done during the execution of a
program. (generally from byte
code to machine code)
Virtual Machine (cont’d)
• A secure VM can enforce security policies
– No file access
– No network access
– No access to personal information
– No sharing of personal information (through dataflow
analysis)
References
Thanks for listening!