Assessing the Security Properties of Software Obfuscation.

Hui Xu,Michael R. Lyu

DOI: https://doi.org/10.1109/msp.2016.112

IF: 3.105

2016-01-01

IEEE Security & Privacy

Abstract:The battle between software obfuscation and reverse engineering has been ongoing for decades. Yet the degree of security that obfuscation actually guarantees remains unclear. Obfuscation's security properties and challenges to achieving a valid security property are evaluated.

What problem does this paper attempt to address?

On Secure and Usable Program Obfuscation: A Survey

Hui Xu,Yangfan Zhou,Yu Kang,Michael R. Lyu

DOI: https://doi.org/10.48550/arXiv.1710.01139

2017-10-03

Abstract:Program obfuscation is a widely employed approach for software intellectual property protection. However, general obfuscation methods (e.g., lexical obfuscation, control obfuscation) implemented in mainstream obfuscation tools are heuristic and have little security guarantee. Recently in 2013, Garg et al. have achieved a breakthrough in secure program obfuscation with a graded encoding mechanism and they have shown that it can fulfill a compelling security property, i.e., indistinguishability. Nevertheless, the mechanism incurs too much overhead for practical usage. Besides, it focuses on obfuscating computation models (e.g., circuits) rather than real codes. In this paper, we aim to explore secure and usable obfuscation approaches from the literature. Our main finding is that currently we still have no such approaches made secure and usable. The main reason is we do not have adequate evaluation metrics concerning both security and performance. On one hand, existing code-oriented obfuscation approaches generally evaluate the increased obscurity rather than security guarantee. On the other hand, the performance requirement for model-oriented obfuscation approaches is too weak to develop practical program obfuscation solutions.

Cryptography and Security,Software Engineering
Layered Obfuscation: a Taxonomy of Software Obfuscation Techniques for Layered Security.

Hui Xu,Yangfan Zhou,Jiang Ming,Michael Lyu

DOI: https://doi.org/10.1186/s42400-020-00049-3

2020-01-01

Abstract:Software obfuscation has been developed for over 30 years.A problem always confusing the communities is what security strength the technique can achieve.Nowadays,this problem becomes even harder as the software economy becomes more diversified.Inspired by the classic idea of layered security for risk management,we propose layered obfuscation as a promising way to realize reliable software obfuscation.Our concept is based on the fact that real-world software is usually complicated.Merely applying one or several obfuscation approaches in an ad-hoc way cannot achieve good obscurity.Layered obfuscation,on the other hand,aims to mitigate the risks of reverse software engineering by integrating different obfuscation techniques as a whole solution.In the paper,we conduct a systematic review of existing obfuscation techniques based on the idea of layered obfuscation and develop a novel taxonomy of obfuscation techniques.Following our taxonomy hierarchy,the obfuscation strategies under different branches are orthogonal to each other.In this way,it can assist developers in choosing obfuscation techniques and designing layered obfuscation solutions based on their specific requirements.
Assure High Quality Code Using Refactoring and Obfuscation Techniques

Teng Long,Lin Liu,Yijun Yu,Zhiguo Wan

DOI: https://doi.org/10.1109/FCST.2010.85

2010-01-01

Abstract:Nowadays, software refactoring techniques are widely adopted to enhance the quality of software by improving its understandability, performance, as well as other quality related design attributes. On the other hand, various kinds of software obfuscation methods have been proposed to protect security-sensitive information involved in software implementations. This paper analyzes how refactoring and obfuscation use reverse transformations to improve quality and security of software code, and proposes a systematic modeling approach based on i* to support the selection of refactoring techniques and obfuscation methods under different social, environmental and operational situations. First, top-level softgoals guiding designer's decision making are identified and analyzed; next accidental programming “bad smells” and intentional code cracker's threats to these softgoals are identified and analyzed; then refactoring and obfuscation transformations are modeled as countermeasures for these threats; eventually their reversal relations and counteracting patterns are examined using example code segments.
Applications of homomorphic functions to software obfuscation

William Zhu,Clark Thomborson,Fei-Yue Wang

DOI: https://doi.org/10.1007/11734628_18

2006-01-01

Abstract:As various computers are connected into a world wide network, software is a target of copyright pirates, attackers, or even terrorists, as a result, software protections become a more and more important issue for software users and developers. There are some technical measures for software protections, such as hardware-based protections and software-based techniques [1], etc. Software obfuscation [2] is one of these measures to protect software from unauthorized modification by making software more obscure so that it is hard for potential attackers to understand the obfuscated software. There are several algorithms of software obfuscation such as layout transformation, computation transformation, ordering transformation, and data transformation [2]. Variable transformation is a major method of data transformation to transform software into a new semantically equivalent one that is hard for attackers to understand the true meaning of variables in software.
A Review of Code Obfuscation and Anti Analysis Techniques

Mutya Sri Lakshmi Meher Gayatri,Akula Veera Vasu Sriphalya,Manas Kumar Yogi

DOI: https://doi.org/10.46610/johtdcpcv.2024.v01i01.005

2024-04-25

Abstract:This paper investigates the intricate landscape of code obfuscation and anti analysis techniques within software security. The primary objective is to comprehensively understand the various methods employed to obscure code functionality and impede analysis efforts. Through an extensive literature review, this study examines the fundamental concepts of code obfuscation and identifies common anti analysis strategies utilized by malware authors. By exploring the arms race between obfuscation and analysis, this paper aims to shed light on the evolving tactics employed by both defenders and adversaries in cybersecurity. Methodologically, this research delves into the detailed explanation of prevalent code obfuscation techniques, including control flow obfuscation, data obfuscation, and string obfuscation, alongside examples and case studies illustrating their effectiveness. Similarly, the study scrutinizes anti analysis methods utilized by malware authors, highlighting their impact on software security and malware analysis. Through experimental evaluation and case studies of real world incidents, this research evaluates the efficacy of code obfuscation and anti analysis techniques, providing insights into their implications for software security and malware defence strategies. Key findings of this research underscore the critical role of code obfuscation in software security and the escalating challenge it poses for malware detection and analysis. Moreover, the study elucidates the significance of effectively understanding and countering anti analysis techniques to bolster cybersecurity defences. The implications of this research extend to practitioners and researchers, offering valuable insights into developing mitigation strategies and tools to combat code obfuscated malware and enhance overall software security.
A Taxonomy of Obfuscating Transformations

Christian Collberg,Clark Thomborson,Douglas Low

1997-01-01

Abstract: It has become more and more common to distribute software in forms that retain most or all of the information present in the original source code. An important example is Java bytecode. Since such codes are easy to decompile, they increase the risk of malicious reverse engineering attacks. In this paper we review several techniques for technical protection of software secrets. We will argue that automatic code obfuscation is currently the most viable method for preventing reverse engineering....
Software protection on the go: a large-scale empirical study on mobile app obfuscation.

Pei Wang,Qinkun Bao,Li Wang,Shuai Wang,Zhaofeng Chen,Tao Wei,Dinghao Wu

DOI: https://doi.org/10.1145/3180155.3180169

2018-01-01

Abstract:The prosperity of smartphone markets has raised new concerns about software security on mobile platforms, leading to a growing demand for effective software obfuscation techniques. Due to various differences between the mobile and desktop ecosystems, obfuscation faces both technical and non-technical challenges when applied to mobile software. Although there have been quite a few software security solution providers launching their mobile app obfuscation services, it is yet unclear how real-world mobile developers perform obfuscation as part of their software engineering practices. Our research takes a first step to systematically studying the deployment of software obfuscation techniques in mobile software development. With the help of an automated but coarse-grained method, we computed the likelihood of an app being obfuscated for over a million app samples crawled from Apple App Store. We then inspected the top 6600 instances and managed to identify 601 obfuscated versions of 539 iOS apps. By analyzing this sample set with extensive manual effort, we made various observations that reveal the status quo of mobile obfuscation in the real world, providing insights into understanding and improving the situation of software protection on mobile platforms.
Protection on the Go : A Large-Scale Empirical Study on Mobile App

Pei Wang,Qinkun Bao,Li Wang,Shuai Wang,Zhaofeng Chen,Tao Wei,Dinghao Wu

2018-01-01

Abstract:The prosperity of smartphone markets has raised new concerns about software security on mobile platforms, leading to a growing demand for effective software obfuscation techniques. Due to various differences between the mobile and desktop ecosystems, obfuscation faces both technical and non-technical challenges when applied to mobile software. Although there have been quite a few software security solution providers launching their mobile app obfuscation services, it is yet unclear how real-world mobile developers perform obfuscation as part of their software engineering practices. Our research takes a first step to systematically studying the deployment of software obfuscation techniques in mobile software development. With the help of an automated but coarse-grained method, we computed the likelihood of an app being obfuscated for over a million app samples crawled from Apple App Store. We then inspected the top 6600 instances and managed to identify 601 obfuscated versions of 539 iOS apps. By analyzing this sample set with extensive manual effort, we made various observations that reveal the status quo of mobile obfuscation in the real world, providing insights into understanding and improving the situation of software protection on mobile platforms.
Benchmarking Obfuscators of Functionality.

Clark Thomborson

DOI: https://doi.org/10.48550/arxiv.1501.02885

2015-01-01

Abstract:We propose a set of benchmarks for evaluating the practicality of software obfuscators which rely on provably-secure methods for functional obfuscation.
Mimic Security Defence Strategy Based on Software Diversity

Yu-jia ZHANG,Jian-min PANG,Zheng ZHANG,Jiang-xing WU

DOI: https://doi.org/10.11896/j.issn.1002-137X.2018.02.037

2018-01-01

Abstract:With the development of reverse engineering,the software industry has suffered a great loss from the software piracy and malicious attack for a long time.Code obfuscation techniques which can hide specific function of a program from malicious analysis for malware is thus frequently employed to mitigate this risk.However,most of the existing obfuscation methods are language embedded and depend on the target architecture,this paper proposed a method of compile-time obfuscation,and further presented a prototype implementedation based on the LLVM compiler infrastructure.Furthermore,this paper implemented a mimic security defence system which is free from malicious attack with the software diversity method.
Protecting million-user iOS apps with obfuscation: motivations, pitfalls, and experience.

Pei Wang,Dinghao Wu,Zhaofeng Chen,Tao Wei

DOI: https://doi.org/10.1145/3183519.3183524

2018-01-01

Abstract:In recent years, mobile apps have become the infrastructure of many popular Internet services. It is now fairly common that a mobile app serves a large number of users across the globe. Different from web-based services whose important program logic is mostly placed on remote servers, many mobile apps require complicated client-side code to perform tasks that are critical to the businesses. The code of mobile apps can be easily accessed by any party after the software is installed on a rooted or jailbroken device. By examining the code, skilled reverse engineers can learn various knowledge about the design and implementation of an app. Real-world cases have shown that the disclosed critical information allows malicious parties to abuse or exploit the app-provided services for unrightful profits, leading to significant financial losses for app vendors. One of the most viable mitigations against malicious reverse engineering is to obfuscate the software before release. Despite that security by obscurity is typically considered to be an unsound protection methodology, software obfuscation can indeed increase the cost of reverse engineering, thus delivering practical merits for protecting mobile apps. In this paper, we share our experience of applying obfuscation to multiple commercial iOS apps, each of which has millions of users. We discuss the necessity of adopting obfuscation for protecting modern mobile business, the challenges of software obfuscation on the iOS platform, and our efforts in overcoming these obstacles. Our report can benefit many stakeholders in the iOS ecosystem, including developers, security service providers, and Apple as the administrator of the ecosystem.
How to Kill Symbolic Deobfuscation for Free; or Unleashing the Potential of Path-Oriented Protections

Mathilde Ollivier,Sébastien Bardin,Richard Bonichon,Jean-Yves Marion

DOI: https://doi.org/10.48550/arXiv.1908.01549

2019-08-07

Abstract:Code obfuscation is a major tool for protecting software intellectual property from attacks such as reverse engineering or code tampering. Yet, recently proposed (automated) attacks based on Dynamic Symbolic Execution (DSE) shows very promising results, hence threatening software integrity. Current defenses are not fully satisfactory, being either not efficient against symbolic reasoning, or affecting runtime performance too much, or being too easy to spot. We present and study a new class of anti-DSE protections coined as path-oriented protections targeting the weakest spot of DSE, namely path exploration. We propose a lightweight, efficient, resistant and analytically proved class of obfuscation algorithms designed to hinder DSE-based attacks. Extensive evaluation demonstrates that these approaches critically counter symbolic deobfuscation while yielding only a very slight overhead.

Cryptography and Security
Manufacturing Cheap, Resilient, and Stealthy Opaque Constructs.

Christian S. Collberg,Clark D. Thomborson,Douglas Low

DOI: https://doi.org/10.1145/268946.268962

1998-01-01

Abstract:It has become common to distribute software in forms that are isomorphic to the original source code. An important example is Java bytecode. Since such codes are easy to decompile, they increase the risk of malicious reverse engineering attacks.In this paper we describe the design of a Java code obfuscator, a tool which - through the application of code transformations - converts a Java program into an equivalent one that is more difficult to reverse engineer.We describe a number of transformations which obfuscate control-flow. Transformations are evaluated with respect to potency (To what degree is a human reader confused?), resilience (How well are automatic deobfuscation attacks resisted?), cost (How much time/space overhead is added?), and stealth (How well does obfuscated code blend in with the original code?).The resilience of many control-altering transformations rely on the resilience of opaque predicates. These are boolean valued expressions whose values are known to the obfuscator but difficult to determine for an automatic deobfuscator. We show how to construct resilient, cheap, and stealthy opaque predicates based on the intractability of certain static analysis problems such as alias analysis.
A Provable Scheme For Homomorphic Obfuscations In Software Security

William Zhu,Clark Thomborson

2005-01-01

Abstract:Computer and communication industries develop so rapidly that the demand for software becomes larger and larger and the demand for software protections, such as copyright and anti-tampering defense, are more and more important to software users and developers. There are some technical measures for software protections, such as hardware-based protections, network filters, cryptosystems, etc. Software obfuscation is one of these measures. It protects software from unauthorized modification by making software more obscure so that it is hard for the potential attacker to understand the obfuscated software. In software obfuscation, we can obfuscate the control flow and the data flow of the software. In this paper, we explore an obfuscation based on residue number coding, which is a method widely used in hardware design, high precision integer arithmetic, and cryptography [1]. Recently, it has used as an obfuscation that encoded variables in the original program to hide the true meaning of these variables [2]. There is some discussion about the division of residue numbers in [2], but the technique proposed there is incorrect. In this paper, we establish a provable residue number encoding for software obfuscation, especially a provable algorithm for division by several constants in residue numbers.
Watermarking, tamper-proffing, and obfuscation: tools for software protection

Christian S. Collberg,Clark Thomborson

DOI: https://doi.org/10.1109/TSE.2002.1027797

2002-01-01

Abstract:AbstractWe identify three types of attack on the intellectual property contained in software and three corresponding technical defenses. A defense against reverse engineering is obfuscation, a process that renders software unintelligible but still functional. A defense against software piracy is watermarking, a process that makes it possible to determine the origin of software. A defense against tampering is tamper-proofing, so that unauthorized modifications to software (for example, to remove a watermark) will result in nonfunctional code. We briefly survey the available technology for each type of defense.
Use of Cryptography in Malware Obfuscation

Hassan Jameel Asghar,Benjamin Zi Hao Zhao,Muhammad Ikram,Giang Nguyen,Dali Kaafar,Sean Lamont,Daniel Coscia

2023-09-08

Abstract:Malware authors often use cryptographic tools such as XOR encryption and block ciphers like AES to obfuscate part of the malware to evade detection. Use of cryptography may give the impression that these obfuscation techniques have some provable guarantees of success. In this paper, we take a closer look at the use of cryptographic tools to obfuscate malware. We first find that most techniques are easy to defeat (in principle), since the decryption algorithm and the key is shipped within the program. In order to clearly define an obfuscation technique's potential to evade detection we propose a principled definition of malware obfuscation, and then categorize instances of malware obfuscation that use cryptographic tools into those which evade detection and those which are detectable. We find that schemes that are hard to de-obfuscate necessarily rely on a construct based on environmental keying. We also show that cryptographic notions of obfuscation, e.g., indistinghuishability and virtual black box obfuscation, may not guarantee evasion detection under our model. However, they can be used in conjunction with environmental keying to produce hard to de-obfuscate version of programs.

Cryptography and Security
A Systematic Study on Static Control Flow Obfuscation Techniques in Java

Renuka Kumar,Anjana Mariam Kurian

DOI: https://doi.org/10.48550/arXiv.1809.11037

2018-09-28

Abstract:Control flow obfuscation (CFO) alters the control flow path of a program without altering its semantics. Existing literature has proposed several techniques; however, a quick survey reveals a lack of clarity in the types of techniques proposed, and how many are unique. What is also unclear is whether there is a disparity in the theory and practice of CFO. In this paper, we systematically study CFO techniques proposed for Java programs, both from papers and commercially available tools. We evaluate 13 obfuscators using a dataset of 16 programs with varying software characteristics, and different obfuscator parameters. Each program is carefully reverse engineered to study the effect of obfuscation. Our study reveals that there are 36 unique techniques proposed in the literature and 7 from tools. Three of the most popular commercial obfuscators implement only 13 of the 36 techniques in the literature. Thus there appears to be a gap between the theory and practice of CFO. We propose a novel classification of the obfuscation techniques based on the underlying component of a program that is transformed. We identify the techniques that are potent against reverse engineering attacks, both from the perspective of a human analyst and an automated program decompiler. Our analysis reveals that majority of the tools do not implement these techniques, thus defeating the protection obfuscation offers. We furnish examples of select techniques and discuss our findings. To the best of our knowledge, we are the first to assemble such a research. This study will be useful to software designers to decide upon the best techniques to use based upon their needs, for researchers to understand the state-of-the-art and for commercial obfuscator developers to develop new techniques.

Cryptography and Security
Exploring Android Obfuscators and Deobfuscators: An Empirical Investigation

Shouki A. Ebad,Abdulbasit A. Darem

DOI: https://doi.org/10.3390/electronics13122272

IF: 2.9

2024-06-11

Electronics

Abstract:Researchers have proposed different obfuscation transformations supported by numerous smartphone protection tools (obfuscators and deobfuscators). However, there is a need for a comprehensive study to empirically characterize these tools that belong to different categories of transformations. We propose a property-based framework to systematically classify twenty cutting-edge tools according to their features, analysis type, programming language support, licensing, applied obfuscation transformations, and general technical drawbacks. Our analysis predominantly reveals that very few tools work at the dynamic level, and most tools (which are static-based) work for Java or Java-based ecosystems (e.g., Android). The findings also show that the widespread adoption of renaming transformations is followed by formatting and code injection. In addition, this paper pinpoints the technical shortcomings of each tool; some of these drawbacks are common in static-based analyzers (e.g., resource consumption), and other drawbacks have negative effects on the experiment conducted by students (e.g., a third-party library involved). According to these critical limitations, we provide some timely recommendations for further research. This study can assist not only Android developers and researchers to improve the overall health of their apps but also the managers of computer science and cybersecurity academic programs to embed suitable obfuscation tools in their curricula.

engineering, electrical & electronic,physics, applied,computer science, information systems
Slicing Obfuscations: Design, Correctness, and Evaluation.

Anirban Majumdar,Stephen Drape,Clark Thomborson

DOI: https://doi.org/10.1145/1314276.1314290

2007-01-01

Abstract:The goal of obfuscation is to transform a program, without affecting its functionality, such that some secret information within the program can be hidden for as long as possible from an adversary armed with reverse engineering tools. Slicing is a form of reverse engineering which aims to abstract away a subset of program code based on a particular program point and is considered to be a potent program comprehension technique. Thus, slicing could be used as a way of attacking obfuscated programs. It is challenging to manufacture obfuscating transforms that are provably resilient to slicing attacks.We show in this paper how we can utilise the information gained from slicing a program to aid us in designing obfuscations that are more resistant to slicing. We extend a previously proposed technique and provide proofs of correctness for our transforms. Finally, we illustrate our approach with a number of obfuscating transforms and provide empirical results using software engineering metrics.
Obfuscation using Encryption

Johannes Schneider,Thomas Locher

DOI: https://doi.org/10.48550/arXiv.1612.03345

2016-12-11

Abstract:Protecting source code against reverse engineering and theft is an important problem. The goal is to carry out computations using confidential algorithms on an untrusted party while ensuring confidentiality of algorithms. This problem has been addressed for Boolean circuits known as `circuit privacy'. Circuits corresponding to real-world programs are impractical. Well-known obfuscation techniques are highly practicable, but provide only limited security, e.g., no piracy protection. In this work, we modify source code yielding programs with adjustable performance and security guarantees ranging from indistinguishability obfuscators to (non-secure) ordinary obfuscation. The idea is to artificially generate `misleading' statements. Their results are combined with the outcome of a confidential statement using encrypted \emph{selector variables}. Thus, an attacker must `guess' the encrypted selector variables to disguise the confidential source code. We evaluated our method using more than ten programmers as well as pattern mining across open source code repositories to gain insights of (micro-)coding patterns that are relevant for generating misleading statements. The evaluation reveals that our approach is effective in that it successfully preserves source code confidentiality.

Cryptography and Security

Assessing the Security Properties of Software Obfuscation.

On Secure and Usable Program Obfuscation: A Survey

Layered Obfuscation: a Taxonomy of Software Obfuscation Techniques for Layered Security.

Assure High Quality Code Using Refactoring and Obfuscation Techniques

Applications of homomorphic functions to software obfuscation

A Review of Code Obfuscation and Anti Analysis Techniques

A Taxonomy of Obfuscating Transformations

Software protection on the go: a large-scale empirical study on mobile app obfuscation.

Protection on the Go : A Large-Scale Empirical Study on Mobile App

Benchmarking Obfuscators of Functionality.

Mimic Security Defence Strategy Based on Software Diversity

Protecting million-user iOS apps with obfuscation: motivations, pitfalls, and experience.

How to Kill Symbolic Deobfuscation for Free; or Unleashing the Potential of Path-Oriented Protections

Manufacturing Cheap, Resilient, and Stealthy Opaque Constructs.

A Provable Scheme For Homomorphic Obfuscations In Software Security

Watermarking, tamper-proffing, and obfuscation: tools for software protection

Use of Cryptography in Malware Obfuscation

A Systematic Study on Static Control Flow Obfuscation Techniques in Java

Exploring Android Obfuscators and Deobfuscators: An Empirical Investigation

Slicing Obfuscations: Design, Correctness, and Evaluation.

Obfuscation using Encryption