一种针对分组密码软件的APT后门及其防范

随着计算机技术及信息化的高速发展,软件已经广泛应用于各行各业,利用软件后门获取敏感信息的攻击事件不断发生,给国计民生的重要领域带来很大损失.通常,软件后门的隐蔽性和其强大功能之间是矛盾的,冗长的代码、复杂的功能往往导致后门的代码特征或行为特征过于明显.本文借助差分故障分析、逆向分析、高级持续性威胁等技术,给出了一种向分组密码软件植入后门的可行方案,并以DES加密软件为载体进行了实现.我们将后门激活时输出的故障密文、后门未激活时输出的正确密文进行结合,通过差分故障分析最终恢复了完整的DES密钥.该后门具有隐蔽性强、植入简单、危害性大等特点,可作为一种高级持续性威胁的手段.最后,我们给出了该类后门的防御措施,对后门植入和防范问题进行了辩证地讨论.

APT Backdoor for Block Cipher Software and Its Countermeasures

With the rapid development of computer technology and information technology, software is used everywhere. Attackers can make use of software backdoors to gain important information and resources, causing severe problems and losses. There are contradictions between the concealment and powerful function of software backdoors. Long codes and complex functionalities bring obvious features of the backdoor. This paper proposes a feasible backdoor injection scheme on the block cipher software. The proposed method is based on differential fault analysis, reverse engineering, and advanced persistent threat. By employing fault ciphertexts from active backdoor and correct ciphertexts from non-active backdoor, it is possible to recover the whole DES key by differential fault analysis. The characteristics of this backdoor include strong concealment, easy to operate, can cause big harm, etc.So, this backdoor can be used as a means of advanced persistent threat. Finally, countermeasures for this type of backdoor are given, and the problems of backdoor injection and defense are dialectically discussed.