Bachelor- and Master Seminar

Dear All,

The next seminar takes place on 26.5. at 14:30.

Session A 14:30-15:30
Banji Olorundare - Lorenz Hetterich

https://cispa-de.zoom.us/j/96786205841?pwd=M3FOQ3dSczRabDNLb3F1czVXVUpvdz09

Meeting-ID: 967 8620 5841
Kenncode: BT!u5=

 

Session A:

14:30-15:00

 

Speaker: Banji Olorundare.
Type of talk: Master Intro.
Supervisor: Prof. Dr. Andreas Zeller.
Advisor: Dr. Rahul Gopinath.
Title: Inferring Input Grammar from Binary Programs using String Inclusion
Abstract: Knowing the input language of a program is important for fuzzing. While
there are tools that learn an input language from a program with or without
samples, most of these tools rely on dynamic taints. However, obtaining dynamic
taints involves using instrumented binaries. Unfortunately, such instrumentation
may be unavailable in many cases. Hence, tracking information flow using dynamic
taint information can be challenging. This can be especially hard in stripped
binaries where no debug information is present.
In this work, we present a technique that can extract the grammar from a given
program. Our technique takes a binary program and a small set of sample inputs
and identifies the structural decomposition of the input using the string inclusion
technique.
The result of this process is context-free grammar that forms the complete input
specification of the program. In our evaluation, our prototype automatically
produces readable and structurally accurate grammars from different evaluation
subjects. The resulting grammars produced can be used as input in test generators
for comprehensive automated testing.

15:00-15:30

Speaker:
Lorenz Hetterich

Type of talk:
Bachelor Intro

Advisor:
Dr. Michael Schwarz

Title:
Spectre on IOS

Abstract:
Most CPU don't stall execution when they encounter control flow instructions, but use predictors to make educated guesses on the destination (e.g. whether a branch is taken or not).
This allows them to speculatively continue execution resulting in a major time save upon correct predictions.
On incorrect predictions, speculatively executed instructions are not retired, the pipeline is flushed, and execution continues at the correct destination.
Whilst speculatively executed instructions are not visible on an architectural level, they may leave microarchitectural traces that can be observed using a side-channel.
Spectre abuses this by miss-training predictors and observing microarchitectural state changes caused by speculative execution.
Even though research has been done on Spectre on most major platforms, IOS Mobile Devices have hardly received any attention.
We want to evaluate the primitives required for cache side-channels on IOS Devices and explore whether Spectre type attacks are practical.
This talk will give an overview of the building blocks for a simple Spectre attack and what difficulties we expect compared to other platforms.