Internship offers at Quarkslab for the 2017-2018 season

Code virtualization is a common obfuscation technique, comparable to the embedding of a custom interpreter in the program. This is a multiple-layer internship subject! It starts like a school exercise, but as it grows you'll endup playing with compilation concepts like register allocation, instruction selection and their relatives.

The first level is very similar to implementing a minimal (and thus easily embeddable) interpreter for a subset of the LLVM-IR, much like the existing lli -force-interpreter mode. Starting with a single basic block, then with a more complex control flow graph and finally with function calls. The next level involves parametrization of this custom interpreter in order to provide new challenges to the reversers each time they encounter a new instance of the interpreter, for instance by using random instruction selection, or changing the register model. As an introduction, one can have a look at how it has been done for the Python interpreter [0], [1], [2].

Before diving into this great subject, a small challenge is proposed. It should not take more than one hour, and you are free to choose any relevant language to implement your solution.

Game of Stack: Write an interpreter for the following micro-language, which uses a stack machine [3]:

• PUSH <integer> pushes <integer> on the stack;

• DUP pushes a copy of the stack head on the stack;

• ADD pops two elements from the stack and pushes their sum on the stack

• MUL pops two elements from the stack and pushes their product on the stack

• READ reads an integer from stdin and pushes this value on the stack

• WRITE pops an integer value from the stack and prints it on stdout

For instance, this is a valid program:

0 READ
1 DUP
2 ADD
3 WRITE

• Being motivated, open-minded and enthusiast is the Graal of any successful internship.

• Being technically skilled always helps, but you're also here to learn.

• A decent command of C++ and Python is still a requirement.

• Experience with any compiler infrastructure is a plus.

• Basic compilation knowledge is a must-have.

• A passion for chopping wood is unlikely but appreciated.

Most anti-malware software uses signature-based methods of detection. Those methods consist in detecting in the raw binary some specific strings of bytes, characteristic to a known malware. However, those methods can be easily evaded using techniques such as encryption, polymorphism or obfuscation. Moreover, the signatures used to detect variants of a known malware are often manually defined by security experts after a close look at the binaries, making this approach very difficult to scale to the large amount of new malware programs encountered every day.

To overcome this issue, new intelligent malware detection systems have been investigated recently, using stae-of-the-art machine learning and data mining techniques. One promising approach consists in analyzing the binary through his call-graph, a graph in which each node stands for a function of the program and each directed edge represents a call from a function to another. For each new software to analyze, one idea would be to extract its call-graph and check for a potential match (or partial match) among a huge database of suspicious binary graphs. Two graphs that match well would very likely behave similarly and, in case of a malware, bear a similar attack. Since the whole category of general graph matching problems is known to be NP-complete, finding the best possible match among a huge graph database is an even more challenging problem that requires efficient probabilistic models as much as wise storage implementations.

During this internship, you will be working on new probabilistic methods in the context of malware detection. Those graph-based techniques could go from smarter call-graph generation or representation to efficient graphical model ((e.g., Bayesian networks) or even deep learning frameworks for graph classification.

As this topic requires both mathematical and computer science skills, we cannot expect the candidates to master both fields and we will provide training in the missing expertise.

Read the two following papers and explain in your own words and understanding how they can be related and which are the major challenges they underlie. Remark: you are not required to understand entirely and completely the papers to answer this exercise, you have to extract useful elements out of them.

• Kinable, Joris, and Orestis Kostakis. "Malware classification based on call graph clustering." Journal in computer virology 7.4 (2011): 233-245.

• Mateus, Diana, et al. "Articulated shape matching using Laplacian eigenfunctions and unsupervised point registration." Computer Vision and Pattern Recognition, 2008. CVPR 2008. IEEE Conference on. IEEE, 2008.

• Good knowledge in machine learning or data mining techniques

• Good knowledge in linear algebra

• Programming skills (Python, Matlab or R)

• Static binary analysis is a plus

Fuzz testing (Fuzzing) is a software testing technique that consists in injecting randomized or mutated inputs into a program. This process is usually completely automated and provides a way to find defects in software. In order to be effective, it requires a good strategy, but also state-of-the-art tools to find what others missed.

The goal of this internship is to improve our fuzzing techniques and toolkits. The intern will need to assimilate our in-house dynamic instrumentation tools (including QBDI, our custom DBI framework) and to improve and optimize our AFL (American Fuzzy Lop) based fuzzer to make them able to target a greater variety of closed source software (in a way similar to what can be done with WinAFL).

The intern will be part of a team dedicated to instrumentation tools and that brings together reverse engineers and software developers. He/She will learn how to assess and instrument software, while being able to explore unknown territories by implementing one's own ideas in custom tools.

• Programming (C is required, C++ is a plus plus)

• Some knowledge in reverse engineering and fuzzing

A dominant feature of nowadays Internet-connected devices is their ability to communicate wirelessly. The Wi-Fi stack is, therefore, a crucial component of such systems.

The purpose of this internship is to study selected Wi-Fi stacks and search for vulnerabilities. The actual work will be divided into two parts. In the first part, the intern will reproduce existing attacks on Wi-Fi stacks and acquire a deep understanding of the mechanisms involved. In the second part, the intern will port these vulnerabilities to routers with similar Wi-Fi chipsets. This can reveal hidden difficulties and subtle system differences that need to be taken care of. The end goal is to expand Quarkslab's knowledge of embedded systems.

Some interesting examples of recent vulnerabilities found in Wi-Fi stacks can be found here and there. This kind of research is what would typically fit into this internship. This is a challenging topic on which you will work with two Quarkslab's vulnerability researchers who have previously worked on similar topics.

• Good knowledge of the ARM architecture

• Understanding of the Linux kernel

• Programming (C required)

• Knowledge in reverse engineering and vulnerability research