Exorcist: automated differential analysis to detect compromises in closed-source software supply chains
The insertion of trojanised binaries into supply chains are a particularly subtle form of cyber-attack that require a multi-staged and complex deployment methodology to implement and execute. In the years preceding this research there has been a spike in closed-source software supply chain attacks u...
| Hoofdauteurs: | , , , |
|---|---|
| Formaat: | Conference item |
| Taal: | English |
| Gepubliceerd in: |
Association for Computing Machinery
2022
|
| _version_ | 1826309642309861376 |
|---|---|
| author | Barr-Smith, F Baker, R Blazytko, T Martinovic, I |
| author_facet | Barr-Smith, F Baker, R Blazytko, T Martinovic, I |
| author_sort | Barr-Smith, F |
| collection | OXFORD |
| description | The insertion of trojanised binaries into supply chains are a particularly subtle form of cyber-attack that require a multi-staged and complex deployment methodology to implement and execute. In the years preceding this research there has been a spike in closed-source software supply chain attacks used to attack downstream clients or users of a company. To detect this attack type, we present an approach to detecting the insertion of malicious functionality in supply chains via differential analysis of binaries. This approach determines whether malicious functionality has been inserted in a particular build by looking for indicators of maliciousness. We accomplish this via automated comparison of a known benign build to successive potentially malicious versions. To substantiate this approach we present a system, Exorcist, that we have designed, developed and evaluated as capable of detecting trojanised binaries in Windows software supply chains. In evaluating this system we analyse 12 samples from high-profile APT attacks conducted via the software supply chain. |
| first_indexed | 2024-03-07T07:38:48Z |
| format | Conference item |
| id | oxford-uuid:01189dc8-26bd-4bc5-9b20-70068c20c8f7 |
| institution | University of Oxford |
| language | English |
| last_indexed | 2024-03-07T07:38:48Z |
| publishDate | 2022 |
| publisher | Association for Computing Machinery |
| record_format | dspace |
| spelling | oxford-uuid:01189dc8-26bd-4bc5-9b20-70068c20c8f72023-04-04T12:41:14ZExorcist: automated differential analysis to detect compromises in closed-source software supply chainsConference itemhttp://purl.org/coar/resource_type/c_5794uuid:01189dc8-26bd-4bc5-9b20-70068c20c8f7EnglishSymplectic ElementsAssociation for Computing Machinery2022Barr-Smith, FBaker, RBlazytko, TMartinovic, IThe insertion of trojanised binaries into supply chains are a particularly subtle form of cyber-attack that require a multi-staged and complex deployment methodology to implement and execute. In the years preceding this research there has been a spike in closed-source software supply chain attacks used to attack downstream clients or users of a company. To detect this attack type, we present an approach to detecting the insertion of malicious functionality in supply chains via differential analysis of binaries. This approach determines whether malicious functionality has been inserted in a particular build by looking for indicators of maliciousness. We accomplish this via automated comparison of a known benign build to successive potentially malicious versions. To substantiate this approach we present a system, Exorcist, that we have designed, developed and evaluated as capable of detecting trojanised binaries in Windows software supply chains. In evaluating this system we analyse 12 samples from high-profile APT attacks conducted via the software supply chain. |
| spellingShingle | Barr-Smith, F Baker, R Blazytko, T Martinovic, I Exorcist: automated differential analysis to detect compromises in closed-source software supply chains |
| title | Exorcist: automated differential analysis to detect compromises in closed-source software supply chains |
| title_full | Exorcist: automated differential analysis to detect compromises in closed-source software supply chains |
| title_fullStr | Exorcist: automated differential analysis to detect compromises in closed-source software supply chains |
| title_full_unstemmed | Exorcist: automated differential analysis to detect compromises in closed-source software supply chains |
| title_short | Exorcist: automated differential analysis to detect compromises in closed-source software supply chains |
| title_sort | exorcist automated differential analysis to detect compromises in closed source software supply chains |
| work_keys_str_mv | AT barrsmithf exorcistautomateddifferentialanalysistodetectcompromisesinclosedsourcesoftwaresupplychains AT bakerr exorcistautomateddifferentialanalysistodetectcompromisesinclosedsourcesoftwaresupplychains AT blazytkot exorcistautomateddifferentialanalysistodetectcompromisesinclosedsourcesoftwaresupplychains AT martinovici exorcistautomateddifferentialanalysistodetectcompromisesinclosedsourcesoftwaresupplychains |