2020/09/09 by Carlo Meijer, Meijer, Carlo, Veelasha Moonsamy +3 · 2 citations
Computer Science · #68M25 #Advanced Data Storage Technologies #Advanced Malware Detection Techniques #Cryptography and Security (cs.CR) #Digital and Cyber Forensics #E.3 #FOS: Computer and information sciences #Security and Verification in Computing
paper · pdf · doi:10.48550/arxiv.2009.04274
openalex publication_date 2020/09/09 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
The continuing use of proprietary cryptography in embedded systems across\nmany industry verticals, from physical access control systems and\ntelecommunications to machine-to-machine authentication, presents a significant\nobstacle to black-box security-evaluation efforts. In-depth security analysis\nrequires locating and classifying the algorithm in often very large binary\nimages, thus rendering manual inspection, even when aided by heuristics, time\nconsuming.\n In this paper, we present a novel approach to automate the identification and\nclassification of (proprietary) cryptographic primitives within binary code.\nOur approach is based on Data Flow Graph (DFG) isomorphism, previously proposed\nby Lestringant et al. Unfortunately, their DFG isomorphism approach is limited\nto known primitives only, and relies on heuristics for selecting code fragments\nfor analysis. By combining the said approach with symbolic execution, we\novercome all limitations of their work, and are able to extend the analysis\ninto the domain of unknown, proprietary cryptographic primitives. To\ndemonstrate that our proposal is practical, we develop various signatures, each\ntargeted at a distinct class of cryptographic primitives, and present\nexperimental evaluations for each of them on a set of binaries, both publicly\navailable (and thus providing reproducible results), and proprietary ones.\nLastly, we provide a free and open-source implementation of our approach,\ncalled Where's Crypto?, in the form of a plug-in for the popular IDA\ndisassembler.\n