A Dozen Years of Shellphish

From a rag-tag hackademic group to getting money from DARPA for auto-exploiting and auto-patching. A tale of surfing, CTF-playing, and releasing an angry binary-analysis framework as open source :) Beside introducing Shellphish, we will explain how we qualified to the final round of the DARPA Cyber Grand Challenge. The CGC is a security competition played by programs. Yep, you read it right, your code must automatically exploit and patch binaries, without any human intervention! In particular, we will show how our open source binary analysis framework (angr) can help you find vulnerabilities in binaries. Shellphish is a group of security enthusiasts born in the University of California, Santa Barbara (UCSB) in 2004. Since then Shellphish played countless Capture the Flag (CTF) security competitions, winning the DEFCON CTF finals in 2005. In 2015, Shellphish enrolled in the DARPA Cyber Grand Challenge (CGC). Differently from others security competitions, in which humans have to solve security challenges (such as exploiting binaries or web services), during the CGC participants have to build an automatic system that plays for them! In particular, teams have to build a system that is able to automatically find vulnerabilities in binaries, exploit them, and patch them, without any human intervention. In this talk we will present the system we developed to participate in the CGC, our almost-million dollar baby :) Our system was able to score among the top 7 teams during the qualification event of the CGC, qualifying us for the final event (in August 2016 at Las Vegas), in which participants will compete against each other to win a first-place prize of 2 million dollars (and eternal bragging rights). Part of the system we developed is based on angr, the open source binary analysis framework developed at UCSB. During the talk we will demo angr, showing how it can be used to automatically find vulnerabilities in binaries. In particular, we will first show how angr helped us during CGC and then how, more generally, it can be used to automatically solve binaries challenges proposed in recent CTF security competitions.