Keynote: Automatic Exploitation - The DARPA Cyber Grand Challenge, what came after, and what is next

No ratings

Presented at DeepSecVienna 2018 by

Kevin Borgolte

The automatic exploitation of vulnerabilities has long been a holy grail for software security.However, even manual exploitation by experienced security analysts and researchers has become ever more challenging due to the increased complexity of software systems and the introduction of security defenses.In this keynote, we will orientate ourselves on where we are on the path to automatically "popping root shells with theorems."We will recap the DARPA Cyber Grand Challenge, a competition organized by the United States' Defense Advanced Research Projects Agency, in which competitors were required to develop and implement a self-contained system that automatically finds, patches, and exploits vulnerabilities in software, and which spurred research on automatic exploitation because of its high stakes.We will look into the automatic exploitation systems that Shellphish fielded in the DARPA Cyber Grand Challenge (CGC), the Mechanical Phish, which exploited more binary executables than any other team in the CGC's final event.Finally, we will learn what research came after the DARPA Cyber Grand Challenge, the limitations of current approaches, and what the next challenges that we need to tackle are.