Abstract

A Dozen Years of Shellphish: From DEFCON to the DARPA Cyber Grand Challenge (CGC) How we built an automatic exploitation system and qualified for the DARPA Cyber Grand Challenge

In this talk we will first introduce Shellphish, a group of security enthusiasts born in the University of California, Santa Barbara (UCSB). Then, we will explain what we built to participate in the DARPA Cyber Grand Challenge, a security competition in which participants have to design a system able to automatically exploit and patch binaries. In particular, we will show how it is possible to use the open source binary analysis framework we developed (https://github.com/angr/angr) to automatically find vulnerabilities in binaries.

Shellphish is a group of security enthusiasts born in the University of California, Santa Barbara (UCSB) in 2004. Since then Shellphish played countless Capture the Flag (CTF) security competitions, winning DEFCON CTF in 2005.

In 2015, Shellphish enrolled in the DARPA Cyber Grand Challenge (CGC). Different from others security competitions, in which humans have to solve security challenges (such as exploiting binaries or web services), during the CGC participants have to build an automatic system playing for them! In particular, teams have to build a system that is able to automatically find vulnerabilities in binaries, exploit them, and patch them, without any human intervention.

In this talk we will present the system we developed to participate to the CGC. Our system was able to score among the top 7 teams during the qualification event of the CGC, qualifying us for the final event (in August 2016 at Las Vegas), in which participants will compete against each other to win a first-place prize of 2 million dollars (and eternal bragging rights).

Part of the system we developed is based on angr, the open source binary analysis framework developed at UCSB (available at:https://github.com/angr/angr). During the talk we will demo angr, showing how it can be used to automatically find vulnerabilities in binaries. In particular, we will first show how angr helped us during CGC and then how, more generally, it can be used to automatically solve binaries challenges proposed in recent CTF security competitions.