Office漏洞挖掘与分析技术研究

发布时间：2018-06-04 16:40

本文选题：Office文件格式 + 逆向工程　；参考：《重庆理工大学》2017年硕士论文

【摘要】：随着杀毒软件的防护技术不断加强和用户个人安全意识的不断提高,针对系统的漏洞攻击和普通的病毒木马攻击已经越来越难以发挥作用,攻击者逐渐将其关注的目标转移到常用的浏览器、聊天和文字处理等软件上。目前,微软Office系列应用程序得到了广泛应用,其对应的软件的安全问题也引起了广大安全研究人员和攻击者的普遍关注,自Office 2007以后,其相应软件均采用了Open XML文档格式,若有文档格式漏洞被发掘并被恶意利用,受影响的用户数量庞大,就会造成极大的危害。因此,深入研究Office文档格式,挖掘潜在的Office应用程序漏洞将对Office应用的安全性具有非常重要的意义。为获得较好的Office漏洞防御效果,本文以Office的文档格式以及目前的漏洞挖掘工具为具体研究对象,经过对Office文档格式详细深入的分析和对目前的漏洞挖掘工具、方法对比研究,实现了对Office文档格式的解析,并在基于Office文档格式解析的基础之上结合Fuzzing技术和逆向工程技术开发了一套Office漏洞挖掘系统,并通过实验证了本系统的有效性。本文的主要研究内容如下:1.深入分析和研究Office文档格式,对O ffice文件格式进行解析,实现对文件的特点和结构详细说明。2.研究Office系列软件目前面临的安全威胁,分析O ffice应用程序出现漏洞的原因以及目前的攻击手法及相应的防护措施。3.对目前的漏洞挖掘技术对比研究,找出各自的差异以及优缺点,总结现有的漏洞挖掘技术的特征。4.结合Fuzzing技术和逆向分析技术完成了对Office Digger漏洞挖掘原型系统的设计与实现,并对系统中各个模块作了详细的介绍,提高了Office应用程序漏洞挖掘的自动化水平和漏洞挖掘的效率,同时更加准确的定位了发生异常的位置,提高了漏洞分析的效率。5.通过实例对OfficeDigger系统进行了漏洞挖掘测试,重现了已有的Office漏洞,并为该漏洞编写shellcode加以利用,测试结果证明了OfficeDigger挖掘系统的有效性和高效性。本文提出的Office漏洞挖掘技术及相应的系统实现具有针对性强,误报率低和对异常定位准确等特点,经过试验测试,能够发掘已发现的漏洞,并能准确高效地还原漏洞现场信息,具有一定的实用价值。
[Abstract]:With the continuous strengthening of anti-virus software protection technology and the continuous improvement of the user's personal security awareness, it is becoming more and more difficult to play a role in system vulnerability attacks and common virus Trojan horse attacks. The attacker gradually shifted his focus to popular browsers, chat and word-processing software. At present, Microsoft Office series applications have been widely used, and the security problems of the corresponding software have aroused the general concern of the vast number of security researchers and attackers. Since Office 2007, the corresponding software has adopted the Open XML document format. If a document format vulnerability is exploited and maliciously exploited, a large number of users will be affected, which will cause great harm. Therefore, it is very important for the security of Office applications to study the Office document format and mine the potential Office application vulnerabilities. In order to obtain better Office vulnerability defense effect, this paper takes the Office document format and the current vulnerability mining tools as the specific research object, through the detailed in-depth analysis to the Office document format and to the present vulnerability mining tool, the method contrast research. This paper realizes the parsing of Office document format and develops a Office vulnerability mining system based on Office document format parsing combined with Fuzzing technology and reverse engineering technology. The effectiveness of the system is verified by experiments. The main contents of this paper are as follows: 1. Deeply analyze and study the Office document format, parse the O ffice file format, and realize the detailed description of the characteristics and structure of the file. 2. This paper studies the security threats faced by Office series of software, analyzes the reasons for the vulnerability of O ffice applications, the current attack techniques and the corresponding protective measures. 3. This paper compares the current vulnerability mining techniques, finds out their differences, advantages and disadvantages, and summarizes the characteristics of existing vulnerability mining techniques. Combined with Fuzzing technology and reverse analysis technology, the design and implementation of Office Digger vulnerability mining prototype system are completed, and each module of the system is introduced in detail, which improves the automation level of Office application vulnerability mining and the efficiency of vulnerability mining. At the same time more accurate location of the occurrence of anomalies, improve the efficiency of vulnerability analysis. 5. The vulnerability mining test of OfficeDigger system is carried out, the existing Office vulnerability is reproduced, and shellcode is written to exploit the vulnerability. The test results show that the OfficeDigger mining system is effective and efficient. The Office vulnerability mining technology and the corresponding system implementation presented in this paper have the characteristics of strong pertinence, low false alarm rate and accurate location of anomalies. After testing and testing, we can discover the vulnerabilities that have been discovered, and can accurately and efficiently restore the site information of the vulnerabilities. It has certain practical value.
【学位授予单位】：重庆理工大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP317.1;TP309

【参考文献】