In this poster, we proposed a .NET patch analysis framework named MSILDiffer based on Microsoft Intermediate Language (MSIL). First, MSILDiffer directly extracts MSIL instructions from the .NET assemblies, and retrieves the hierarchy of classes as well as their internal class methods. Then, with coarse and fine granularity feature extraction and comparison, MSILDiffer quickly filters out the code with substantial changes after patch. Besides, we build a dataset of patch analysis containing 24.46 million class methods based on the Microsoft Exchange mail system security patches. With the assistance of MSILDiffer, we generated 32 call paths and crafted corresponding POCs for 1-day vulnerabilities in the dataset. Through the experiment evaluation, MSILDiffer is superior to JustAssembly in terms of coverage, accuracy and time consumption of patch difference analysis.

Local Privilege Escalation (LPE) is a common attack vector used by attackers to gain higher-level permissions. In this poster, we present a system called LPET to mine LPE vulnerabilities of third-party software in MS-Windows. Our insight is that the LPE is often caused by the interactions between high-privilege processes and user-controllable files. The interactions include creating a file, starting a process and others. Based on this observation, LPET first monitors software behaviors and constructs a directed interaction graph to abstract entities, such as files and processes, and their interactions. Then LPET analyzes exploiting paths from the graph by extracting user-controllable entities and checking their privileges. Finally, LPET verifies the exploiting paths using replacement or hijacking attacks. In the preliminary experiments, LPET found vulnerabilities in various software. Moreover, we discovered a common weakness pattern that some components were executed by software with high privilege after being released in the user-controllable temporary directory during installation, update, and uninstallation. By replacing the components, attackers with low privilege can hijack the execution flow of software to execute their codes with high privilege. We found that a wide range of software suffers from this weakness pattern, including Cisco AnyConnect, Dropbox, Notepad++.

In recent years, Android commercial packers have been widely used to encrypt dex files of apps, making analysts and malware detection solutions hard to obtain the actual dex files for further analysis. Therefore, we propose a novel unpacking system named ReDex. ReDex uses Java reflection to execute all methods with forged arguments and collects the original instructions when the method is executing. Although apps may crash due to forged arguments, ReDex can collect its original instructions released by the commercial packer before the crash. Also, we design an exception/crash handling module, which can avoid most of the crashes and restart the unpacking process at the next method after the crash. The comparison with 2 state-of-the-art unpackers on 100 packed apps with source code and 140 wild packed apps shows that ReDex can unpack more apps. Besides, we conduct an experiment with 1,801 real-world apps packed by 7 representative packers. Of 21 million methods, ReDex can extract 19,239,743 (90.30%) methods. The exception/crash handling module effectively reduces the crash rate to 2.31%. In these packed apps, we find 4 interesting packing techniques. ReDex can deal with these packing techniques while 2 state-of-the-art unpackers cannot.