Münster University of Applied Sciences

About: Münster University of Applied Sciences is a education organization based out in Münster, Germany. It is known for research contribution in the topics: Luminescence & Laser. The organization has 694 authors who have published 1067 publications receiving 12597 citations.

AntiFuzz: Impeding Fuzzing Audits of Binary Executables

Abstract: A general defense strategy in computer security is to increase the cost of successful attacks in both computational resources as well as human time. In the area of binary security, this is commonly done by using obfuscation methods to hinder reverse engineering and the search for software vulnerabilities. However, recent trends in automated bug finding changed the modus operandi. Nowadays it is very common for bugs to be found by various fuzzing tools. Due to ever-increasing amounts of automation and research on better fuzzing strategies, large-scale, dragnet-style fuzzing of many hundreds of targets becomes viable. As we show, current obfuscation techniques are aimed at increasing the cost of human understanding and do little to slow down fuzzing. In this paper, we introduce several techniques to protect a binary executable against an analysis with automated bug finding approaches that are based on fuzzing, symbolic/concolic execution, and taint-assisted fuzzing (commonly known as hybrid fuzzing). More specifically, we perform a systematic analysis of the fundamental assumptions of bug finding tools and develop general countermeasures for each assumption. Note that these techniques are not designed to target specific implementations of fuzzing tools, but address general assumptions that bug finding tools necessarily depend on. Our evaluation demonstrates that these techniques effectively impede fuzzing audits, while introducing a negligible performance overhead. Just as obfuscation techniques increase the amount of human labor needed to find a vulnerability, our techniques render automated fuzzing-based approaches futile.

Data channel considerations for RTCWeb

Abstract: Browser-to-browser communication is a hot topic in the network research community. The goal of developing and standardizing RTCWeb for real-time communication is to enhance the communication experience over the Internet. The RTCWeb protocol stack provides a service for several use cases, which includes media as well as non-media data transfer. Therefore, it adapts some established protocols like SCTP for a new common goal. Since real-time communication comes with the inherent need for low end-to-end delay, this article will discuss possible enhancements to SCTP that will improve the RTCWeb service in that regard.