KR102070010B1 - Binary fatching apparatus and method thereof for supplementing vulnerabilties casued from using vulnerable functions - Google Patents

Abstract

Provided are methods for compensating for vulnerabilities in some functions of the basic library provided by the platform such as an operating system, and some devices for applying the methods. According to an embodiment of the present invention, a method for compensating a binary vulnerability includes patching a safety function table to a global offset table (GOT) of a binary at a runtime point of time, and instructing a basic library to be installed by an instruction of the binary. When an objective function is called, jumping to an intermediate function loaded at the address of the objective function described in the safety function table, and calling the function of the basic library by the intermediate function.

Description

BINARY FATCHING APPARATUS AND METHOD THEREOF FOR SUPPLEMENTING VULNERABILTIES CASUED FROM USING VULNERABLE FUNCTIONS}

The present invention relates to security patching techniques for binaries, which are files executable by a computing device. More specifically, it is related to a technology that can supplement the vulnerability of the vulnerable function with respect to a binary in which a vulnerable function known as a vulnerability is used, but without the redistribution and update of platform level such as an operating system.

Software is distributed in the form of executable binaries (hereinafter referred to as binaries) that result after compilation is complete. The binary is loaded into a memory in a storage device, and some instructions of the binary in the memory are fetched to a processor to execute the software.

On the other hand, various techniques are provided to compensate for the vulnerability (vulnerability) present in the binary.

On the other hand, there are also vulnerabilities of the binaries themselves caused by incorrect programming, but there are also vulnerabilities inherent in functions themselves included in external shared libraries used by the binaries. If the shared library is not widely used, the problem may be solved by rebuilding and distributing the shared library through supplementation to the source code of the shared library. In addition, the company or individual who developed and distributed the shared library may solve the problem through source code supplement and rebuild.

However, if there are vulnerabilities in the functions included in Linux's default shared library (libc.so), both the updating of the full distribution of Linux and the widespread distribution of updated Linux come with complex problems.

Therefore, it is required to provide a technique for compensating for the vulnerability of the functions included in the basic library by applying a supplementary patch to the binary itself.

Korean Patent Publication No. 2005-0009198

The technical problem to be solved by the present invention is to provide a device and a method for compensating the vulnerabilities inherent in general-purpose functions included in the basic library through a binary patch (patch).

Another technical problem to be solved by the present invention is to generate a safety binary by performing a binary patch to supplement the vulnerability of the general-purpose function for the source binary uploaded by the developer, and then provide the safety binary to the application download service server This provides an automated system that allows secure binaries to be distributed.

The technical problems of the present invention are not limited to the technical problems mentioned above, and other technical problems that are not mentioned will be clearly understood by those skilled in the art from the following description.

In order to solve the above technical problem, the binary vulnerability compensation method according to an embodiment of the present invention, the safety function table is patched to the global offset table (GOT) of the binary at runtime (binary time) And, if the objective function of the basic library is called by the instruction of the binary, jumping to an intermediate function loaded at the address of the objective function described in the safety function table, and the function of the basic library by the intermediate function. It includes the step that is called.

In one embodiment, the safety function table includes a memory address into which one or more of the intermediate functions are loaded. Here, the intermediate function may be a predefined weak function among the functions of the basic library. Here, the predefined vulnerable function may include a buffer overflow vulnerable function, a format string vulnerable function, a race condition vulnerable function, and a multi-instruction execution vulnerable function.

In one embodiment, the step of patching the safety function table in the GOT of the binary may include the step of patching the safety function table in the GOT of the binary through the execution of the constructor code of the binary. Herein, the constructor code may include an instruction for searching for a dynamic library load API in the constructor code, an instruction for loading a security library including the intermediate function and a GOT patch function using the searched dynamic library load API, and the It may contain instructions to call GOT patch functions. In this case, the GOT patch function is composed of instructions for patching the safety function table in the GOT of the binary, and the safety function table includes a memory address of the intermediate function corresponding to each of the vulnerable functions of the basic library. It may be. Here, the security library may be a shared library included with the binary in the installation package of the binary, or may be a static library included in the binary.

According to another aspect of the present invention, there is provided a binary patch method, comprising: receiving a source binary from a compilation device, generating a secure binary in which a secure library load code is patched to a constructor code of the source binary; Transmitting the secure binary to an external device. The secure library loading code may include an instruction for searching for a dynamic library loading API in a basic library of a platform installed in the computing device, an instruction for loading a security library using the searched dynamic library loading API, and the security library. Contains instructions for calling GOT patch functions within a. Here, the GOT patch function may include an instruction for patching a safety function table to a global offset table (GOT) of the binary at a runtime point of time.

In one embodiment, the external device may be an application download service server.

In one embodiment, the safety function table may include a memory address of the intermediate function of the security library, corresponding to each of the weak function of the basic library.

In one embodiment, generating the secure binary may include inserting the secure library into the source binary as a static library.

In one embodiment, the constructor code is a code for performing an initialization operation of the source binary, and may include instructions that are executed after the source binary is loaded into memory but before the main () function is executed. Here, the source binary may be built in an ELF format and the constructor code may include instructions of a text section (.text).

According to another embodiment of the present invention, a computing device includes a network interface for receiving a source binary and transmitting a safety binary that is a result of a security enhancement patch for the source binary, a processor, and a plurality of executions performed by the processor. It contains a memory for storing instructions. Here, the plurality of instructions includes instructions for patching code for loading a security library into the constructor code of the source binary. The code for loading the security library may include an instruction for searching for a dynamic library loading API in a basic library of a platform installed in the computing device, an instruction for loading a security library using the searched dynamic library loading API, and Contains instructions to call the Global Offset Table (GOT) patch function in the security library.

In one embodiment, the GOT patch function includes instructions for patching a safety function table to a GOT of the safe binary at runtime. Here, the safety function table may include a memory address of the intermediate function of the security library, corresponding to each of the weak functions of the basic library.

In one embodiment, the computing device may further comprise storage for storing the binaries of the secure library, and the plurality of instructions may further include instructions to link the binary code of the secure library to the source binary as a static library. have.

1 is a block diagram showing the structure of a binary vulnerability complement system according to an embodiment of the present invention.
2 is a block diagram showing the structure of an application download service system according to another embodiment of the present invention.
3 is a block diagram showing the structure of an application download service system according to another embodiment of the present invention.
Figure 4 is a flow chart of the binary vulnerability compensation method according to another embodiment of the present invention.
FIG. 5 is a first flowchart for describing in detail some operations of FIG. 4.
FIG. 6 is a second flowchart for describing in detail some operations of FIG. 4.
7 is a conceptual diagram illustrating a conversion result from a source binary to a safe binary according to some embodiments of the present invention.
8 is a view for explaining the concept of the constructor code (constructor code) referenced in some embodiments of the present invention with reference to the Linux binary format.
FIG. 9 is a conceptual diagram illustrating an operation performed when a security library load code fetched into a binary is executed in some embodiments of the present invention.
FIG. 10 is a third flowchart for describing in detail some operations of FIG. 4.
FIG. 11 is a third flowchart for describing in detail some operations of FIG. 10.
12 and 13 are conceptual views illustrating a result of performing some embodiments of the present invention when a function of a basic library is called.
14 is a hardware configuration diagram of a binary patch device according to another embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. Advantages and features of the present invention, and methods for achieving them will be apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various forms, and only the embodiments are intended to complete the disclosure of the present invention, and the general knowledge in the art to which the present invention pertains. It is provided to fully convey the scope of the invention to those skilled in the art, and the present invention is defined only by the scope of the claims. Like reference numerals refer to like elements throughout.

Unless otherwise defined, all terms used in the present specification (including technical and scientific terms) may be used as meanings that can be commonly understood by those skilled in the art. In addition, terms that are defined in a commonly used dictionary are not ideally or excessively interpreted unless they are specifically defined clearly. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In this specification, the singular also includes the plural unless specifically stated otherwise in the phrase.

First, some terms will be described in order to facilitate the understanding of the present specification.

Source Binary: A file built by a compiler installed on a computing device of a software developer, etc., which is an executable file by the computing device.

Secure Binary: An executable file created as a result of a security hardening patch for the source binary, according to some embodiments of the invention.

Base library: A shared library that is a set of general purpose functions provided by a general purpose platform. For example, libc.so on Linux.

PLT (Procedure Linkage Table): When calling an external function from a binary internal routine, this table is referenced to retrieve the memory address of the called external function. The memory address of the external function is output by inquiring the memory address according to the function name (symbol) in the GOT described below. If the memory address of the function name does not exist in the GOT because the external function is called for the first time in the currently executing binary, execute "_dll_runtime_resolve ()" function to record the memory address of the function in the GOT. When the function is executed again, the GOT can get the memory address immediately.

GOT (Global Offset Table): This is a matching table of memory addresses for each function name symbol, searched by the PLT.

Security library: A library containing a GOT patch function and a plurality of intermediate functions called during the execution of the safe binary.

Constructor code: Code executed at initialization of the binary. Detailed description will be described later.

Hereinafter, some embodiments of the present invention will be described with reference to the drawings.

First, systems in accordance with some embodiments of the present invention are described. 1 is a binary vulnerability supplement system according to an embodiment of the present invention, which performs a security hardening patch on source binaries received from the compilation devices 10a, 10b, and 10c, and generates a binary binary as a result thereof. A system that includes a supplemental server 100 is shown. The compilation device may be the developer's terminal devices 10a and 10b, but may also be a server-type compilation device 10c. Compiler (10a, 10b, 10c), for example, a Linux platform based compiler may be installed. The binary vulnerability supplement server 100 may transmit the safe binary to the compilation devices 10a, 10b, and 10c. Detailed structure and operation of the binary vulnerability supplement server 100 will be described later.

2 shows an application download service system according to another embodiment of the present invention. The system includes a binary vulnerability supplement server 100 and an application download service server 200. The vulnerability repair server 100 performs an operation similar to that described with reference to FIG. 1 except for transmitting the safety binary to the application download service server 200. According to the present embodiment, the source binary built by the developer is downloaded by the user terminals 10d, 10e, and 10f, and is automatically security-patched before being installed on the user terminals 10d, 10e, and 10f. To provide. Here, the user terminals 10d, 10e, and 10f may be installed with a Linux operating system. In the case of the smart phone 10f, the mobile Linux operating system may be installed.

Here, the binary vulnerability supplement server 100 does not participate in any security-related software measures for the user terminals 10d, 10e, and 10f, and performs measures for strengthening security only for the binaries themselves. Therefore, the present embodiment provides convenience and time / cost reduction in which security vulnerabilities can be enhanced without considering the environment in which the software is executed.

3 shows an application download service system according to another embodiment of the present invention. As shown in FIG. 3, the system according to the present embodiment may include an application download service server 200a to which a binary vulnerability supplement function is added. That is, the system according to the present embodiment provides a compact structure and a cost reduction through the application service server 200a in which the functions of the binary vulnerability supplement server 100 are built.

Next, with reference to Figures 4 to 13, a method of performing a computing device according to some embodiments of the present invention will be described. First, a binary vulnerability complement method according to another embodiment of the present invention will be described with reference to FIG.

In step S100, compilation of the source binary is performed. Step S100 may be performed by, for example, the compiler apparatuses 10a, 10b, and 10c of FIGS. 1 to 3.

In step S200, a security hardening patch is performed on the source binary, and as a result, a safety binary is generated. Step S200 may be performed by, for example, the binary vulnerability supplement server 100 or the application download service server 200a to which the binary vulnerability supplement function is added.

In step S300, the safe binary is executed. Step S300 may be performed by, for example, the user terminals 10d, 10e, and 10f.

Step S200 of FIG. 4 will be described in detail with reference to FIGS. 5 and 6. Step S200 described below may be implemented as a method independently, in this case constitutes another embodiment of the present invention. According to this embodiment, the safe binary is generated by reading the source binary in step S202, identifying the constructor code of the source binary in step S204, and patching the secure library load code to the constructor code of the source binary in step S206.

In some embodiments, the secure binary and the secure binary can be packaged together and sent to an external device as an installation package. The external device may be a compiler device 10a, 10b, or 10c or an application download service server 200. In this case, it is possible to minimize the modification range of the binary and at the same time minimize the increase in the data size of the binary.

In some other embodiments, an operation (S208) of including a security library pre-stored in the binary vulnerability supplement server 100 as a static library by linking the source binary as a static library as shown in FIG. 6 is added. May be performed. In this case, there is an effect of minimizing the possibility that an error may occur in the operation of the safety binary by corrupting the file of the security binary in the user terminal.

Regarding step S204, the meaning of the 'constructor code' will be described with reference to FIG. The constructor code 301 is code executed at the initialization stage of the binaries 300 and 400. The operations included in the constructor code 301 are executed before the main () function is executed. That is, the constructor code 301 is defined to include at least some of the instructions from the start of execution of the binaries 300 and 400 to just before the call to the main () function. For example, if the binaries 300 and 400 are configured in the Executable and Linkable Format (ELF) format, the constructor code 301 is executed until the main () gkatn ghcnf tlwja contained in the text section 301a. May be the code of.

Referring to FIG. 7, it can be understood that the secure library load code 303 is patched to the safe binary 400. If the secure library is distributed with the secure binary 400 in the form of a shared library, patching the secure library load code 303 to the constructor code 301 is the only modification of the source binary 300. Some embodiments of the present invention provide the effect of compensating for vulnerabilities in common functions of the base library with such minimal modifications.

Hereinafter, the operation of the secure library load code 303 will be described with reference to FIG. 9. 9 may be understood as a conceptual diagram illustrating a process when the safety binary 400 is executed in a user terminal.

The secure library load code 303 includes an instruction 502 that searches for the dynamic library load API 501 in the base library of the platform installed on the computing device. The base library may point to libc.so on Linux, for example, and the dynamic library loading API 501 may point to the dlopen () function. The instruction 502 may explore the dynamic library loading API after loading the base library if the base library is not loaded. However, it may be desirable to minimize the code size of the secure library load code 303 by patching the secure library load code 303 at a point after the loading of the basic library.

The instruction 502 further includes an instruction to load the secure library 503 using the searched dynamic library loading API. 9 assumes that the security library 503 is compiled as a dynamic library and can be loaded in the form of a shared library. As a result of loading the security library 503, the security library 503 will be loaded and stored in the memory area occupied by the process of the safe binary.

The secure library load code 303 further includes instructions for calling the Global Offset Table (GOT) patch function 504 in the secure library 503.

As a result, the secure library load code 303 finds the dlopen () function in the base library, calls the secure library 503 using the dlopen () function, and the GOT patch function 504 of the secure library 503 Minimize modifications to the source binary by including minimal code that calls.

Hereinafter, an operation performed when the safe binary is executed in a user terminal will be described with reference to FIG. 10. 10 may be understood as a runtime process in which secure library load code 303 in the constructor code described above is executed. Step S300 described below may be implemented as a method independently, in this case constitutes another embodiment of the present invention.

According to this embodiment, in step S302, the dynamic library loading API (dlopen ()) is searched for in the basic library libc.so. Next, in step S304 the security library is loaded using the dynamic library loading API. Next, in step S306, the GOT patch function of the loaded security library is called. After that, the main () function is executed (S308). Hereinafter, the internal logic of the GOT patch function will be described with reference to FIG.

First, the memory address is searched for each intermediate function included in the security library loaded in step S360. The intermediate function is a one-to-one match with a predefined vulnerable function in which a vulnerability is found among the public functions of the basic library.

The vulnerability function may be classified according to the type of vulnerability.

For example, the vulnerable function may include a buffer overflow vulnerable function, a format string vulnerable function, a race condition vulnerable function, and a multi-instruction execution vulnerable function, as shown in Table 1 below. In some embodiments, an intermediate function may be provided only for some types of vulnerable functions, such as buffer overflow vulnerable functions, format string vulnerable functions, race condition vulnerable functions, and multiple instruction execution vulnerable functions. However, in order to safely compensate for the vulnerability, it is desirable to provide an intermediate function for all of the buffer overflow vulnerable function, the format string vulnerable function, the race condition vulnerable function, and the multiple instruction execution vulnerable function.

type function Buffer Overflow Vulnerability Types strcpy, wcscpy, stpcpy, wcpcpy, strecpy, memcpy, strcat, wcscat, streadd, strtrns, sprintf, vsprintf, vprintf, vfprintf, gets, scanf, fscanf, vscanf, vsscanf, sscanf, vfscanf, getwd, realpath Format string
 Vulnerable Type syslog, vsyslog, fprintf, printf, sprintf, vfprintf, vprintf, vsprintf, snprintf, vsnprintf, vasprintf, asprintf, vdprintf, dprintf Race condition
 Vulnerable Type tmpnam, tmpnam_r, mktemp Multiple commands
Running vulnerable
type system, popen, execve, fexecve, execv, execle, execl, execvp, execlp, execvpe

Next, in step S362, a safety function table including a memory address of each searched intermediate function is constructed.

Next, in step S364, the address of the GOT segment of the binary currently being executed is obtained.

Next, the safety function table is patched to the GOT data area using the GOT address obtained in step S366.

FIG. 12 is a diagram showing the result of executing the method of FIG. A vulnerability exists that could cause a buffer overflow problem when the strcpy () function is executed. The existing source binary code 303 uses the strcpy () function of the basic library libc.so despite the above vulnerability.

The source binary code of a safe binary and the source binary code of a source binary are identical. That is, strcpy () is called the same for both binaries. However, as a result of the GOT patch, the process of the safe binary does not execute the strcpy () function of the default library as it is when strcpy () is called, but executes the secure_strcpy () function, which is an intermediate function matched by strcpy (). Hereinafter, this process will be described in detail with reference to FIG. 13.

When calling the func function from the source binary code 303, the code of the func function corresponding area of the PLT table is called. The code in the func function mapping area of the PLT table jumps to the func function mapping area of the GOT table to obtain the memory address of the func function. However, as a result of executing the security library load code patched to the constructor code of the safe binary, the GOT patch function is called, and each vulnerable function memory address of the GOT table is replaced with a memory address on the security library 503 of the corresponding intermediate function. It is in a state. Thus, the func function is a function of the security library 503 to be executed.

Each intermediate function of the security library 503 needs to call the vulnerable function executed in the source binary code as it is or execute the vulnerable function as it is after executing the minimum pre-instruction to compensate for the vulnerability of each vulnerable function. If does not exist, call another function in the default library. The secure_strcpy () function of FIG. 12 is illustrated as calling the strncpy () function of the basic library.

The methods according to the embodiments of the present invention described so far may be performed by execution of a computer program implemented in computer readable code. The computer program may be transmitted from the first computing device to the second computing device via a network such as the Internet and installed in the second computing device, thereby being used in the second computing device. The first computing device and the second computing device include both a server device, a physical server belonging to a server pool for cloud services, and a stationary computing device such as a desktop PC.

The computer program may be stored in a recording medium such as a DVD-ROM or a flash memory device.

Next, the configuration and operation of the binary patch apparatus 100 according to another embodiment of the present invention will be described with reference to FIG. 14. As illustrated in FIG. 14, the binary patch apparatus 100 according to the present exemplary embodiment may include a processor 101, a memory 102, a storage 103, and a network interface 105. A plurality of instructions loaded and stored in the memory 102 are executed by the processor 101. Note that the binary patch device 100 according to the present embodiment may perform the operation of the binary vulnerability supplement server described with reference to FIGS.

The storage 103 may store a source binary 133, a secure library binary 131, and a secure library load code 132.

Network interface 105 receives source binaries 133 and transmits secure binaries that are the result of security enhancement patches to the source binaries.

The plurality of instructions includes a security enhancement patch instruction 122. In one embodiment, the plurality of instructions may further include a linker 121 for linking the secure library binary 131.

The security enhancement patch instruction 122 includes instructions for patching code for loading a security library into the constructor code of the source binary. In this case, the code for loading the secured library may include instructions for searching for a dynamic library load API in a basic library of a platform installed in the computing device, instructions for loading a secured library using the searched dynamic library load API, An instruction for calling a Global Offset Table (GOT) patch function in the security library may be included.

Although the embodiments of the present invention have been described above with reference to the accompanying drawings, those skilled in the art to which the present invention pertains may implement the present invention in other specific forms without changing the technical spirit or essential features thereof. I can understand that. Therefore, it is to be understood that the embodiments described above are exemplary in all respects and not restrictive.

Claims (16)

A method performed by a computing device,
Generating a secure binary in which the code for calling the GOT patch function is inserted into the constructor code of the source binary,
The GOT patch function,
At a runtime of the safe binary, including instructions for patching a safe function table to a global offset table (GOT) of the binary,
Binary patching method. According to claim 1,
The constructor code,
Instructions for searching for dynamic library loading APIs in the constructor code;
Instructions for loading a security library including an intermediate function and a GOT patch function using the searched dynamic library loading API; And
Including an instruction for calling the GOT patch function,
Binary Patch Method According to claim 1,
The safety function table,
Contains the memory address of the intermediate function in the secure library, corresponding to each of the vulnerable functions in the base library
Binary patching method. According to claim 1,
At runtime of the safe binary, an instruction for patching a safe function table to a global offset table (GOT) of the binary,
Instructions for patching a safety function table to the GOT of the binary through execution of the constructor code of the binary,
Binary patching method. The method of claim 4, wherein
The constructor code,
Code for performing an initialization operation of the source binary, including instructions that are executed after the source binary is loaded into memory, but before the main function is executed,
Binary patching method. The method of claim 4, wherein
The source binaries are built in ELF format,
The constructor code is a code up until immediately before the main function call included in the text section (.text).
Binary patching method.
delete delete delete delete delete delete delete delete delete delete

Images