BOFT: Exploitable Buffer Overflow Detection by Information Flow Tracking

Buffer overflow is possibly the most well-known memory issue. It can cause erratic program behavior, such as incorrect outputs and crashes, and can be exploited to issue security attacks. Detecting buffer overflows has drawn significant research attention for almost three decades. However, the prevalence of security attacks due to buffer overflows indicates that existing tools are still not widely utilized in production environments, possibly due to their high performance overhead or limited effectiveness. This paper proposes CSOD, a buffer overflow detection tool designed for the production environment. CSOD proposes a novel context-sensitive overflow detection technique that can dynamically adjust its detection strategy based on the behavior of different allocation calling contexts, enabling it to effectively detect overflows in millions of objects via four hardware watchpoints. It can correctly report root causes of buffer over-writes and over-reads, without any additional manual effort. Furthermore, CSOD only introduces 6.7% performance overhead on average, which makes it appealing as an always-on approach for production software.

Buffer overflow is one of the most common types of software vulnerabilities. Various static analysis and dynamic testing techniques have been proposed to detect buffer overflow vulnerabilities. With automatic tool support, static buffer overflow detection technique has been widely used in academia and industry. However, it tends to report too many false positives fundamentally due to the lack of software execution information. Currently, static warnings can only be validated by manual inspection, which significantly limits the practicality of the static analysis. In this paper, we present BovInspector, a tool framework for automatic static buffer overflow warnings inspection and validated bugs repair. Given the program source code and static buffer overflow vulnerability warnings, BovInspector first performs warning reachability analysis. Then, BovInspector executes the source code symbolically under the guidance of reachable warnings. Each reachable warning is validated and classified by checking whether all the path conditions and the buffer overflow constraints can be satisfied simultaneously. For each validated true warning, BovInspector fix it with three predefined strategies. BovInspector is complementary to prior static buffer overflow discovery schemes. Experimental results on real open source programs show that BovInspector can automatically inspect on average of 74.9% of total warnings, and false warnings account for about 25% to 100% (on average of 59.9%) of the total inspected warnings. In addition, the automatically generated patches fix all target vulnerabilities. Further information regarding the implementation and experimental results of BovInspector is available at http://bovinspectortool.github.io/project/. And a short video for demonstrating the capabilities of BovInspector is now available at https://youtu.be/IMdcksROJDg.

Hardware information flow tracking based on lightweight path awareness

Security of Internet-of-Things (IoT) systems is important due to their widespread usage in everyday life. Much research has been performed on analyzing the security of IoT communication protocols and operating systems. However, few studies have focused on analyzing the security of IoT applications and automatic detection of vulnerabilities in them. In these studies, the code of IoT applications and operating systems are analyzed statically to detect vulnerabilities. To the best of our knowledge, there is no dynamic analysis solution suggested for vulnerability detection in such applications, although this method is more accurate than static analysis. In fact, IoT applications are executed in special-purpose hardware, which makes their dynamic analysis more difficult than ordinary applications. In this paper, we propose a technical solution that combines static and dynamic analysis methods to automatically detect vulnerability in applications of Tizen IoT operating system. We consider Native and Web Tizen applications and present an automatic vulnerability detection method for each type of application. Our focus is on detecting buffer overflow and XSS vulnerability classes in Native and Web applications, respectively. We have evaluated the effectiveness of our method using a group of native and web test programs. The results of our experiments show that our solution is able to detect the vulnerability in these programs effectively.

Coverage-Guided fuzzing is the type of fuzzing which focuses on the code or branch coverage. It is mainly efficient in detecting buffer overflow. For the code coverage, it is an important parameter of performance evaluation of the Coverage-Guided fuzzing tools, since the higher coverage means higher possibility of bug detection. However, the timeout set for the fuzzing also affects the efficiency, due to the fact that the growth rate of code coverage will gradually become slower as the running time becoming longer. Setting a timeout that is too long cannot help improving the coverage nor the bug detected, and it will be a complete waste of time. Since selecting the fuzzing time might be quite confusing for testers, in this paper, the author decided to discover the relationship of the growth of the coverage and the running time of the. AFL and FuzzFactory were used for the evaluation and the timeout were set as 1 second, 1 minute, 1 hour, 6 hours and 12 hours respectively. The results showed the relationship between fuzzing time and the performance, for all fuzzers and the effect between different fuzzers.

Buffer overflows cause serious problems in different categories of software systems. For example, if present in network or security applications, they can be exploited to gain unauthorized grant or access to the system. In embedded systems, such as avionics or automotive systems, they can be the cause of serious accidents.This paper proposes to combine static analysis and program slicing with evolutionary testing, to detect buffer overflow threats. Static analysis identifies vulnerable statements, while slicing and data dependency analysis identify the relationship between these statements and program or function inputs, thus reducing the search space.To guide the search towards discovering buffer overflow in this work we define three multi-objective fitness functions and compare them on two open-source systems. These functions account for terms such as the statement coverage, the coverage of vulnerable statements, the distance form buffer boundaries and the coverage of unconstrained nodes of the control flow graph.

Analysis and assessment of a knowledge based smart city architecture providing service APIs

Buffer overflow (BOF) vulnerabilities when present in code can be exploited to violate security objectives such as availability, confidentiality and integrity. They make up substantial portion of input manipulation attacks due to their common presence and ease of exploitation. In this study, the authors propose a hybrid approach combining static and dynamic program analysis with machine learning to audit BOFs. Simple rules to generate test data is proposed to confirm some of the vulnerabilities through dynamic analysis. Confirmed cases can be fixed by developers without further verification. Statements whose vulnerability is not confirmed by dynamic analysis are predicted by mining static code attributes. In the authors’ evaluation using standard benchmarks, their best classifier achieved a recall over 93% and accuracy >94%. Dynamic analysis itself confirmed 34% of known vulnerabilities along with reporting six new bugs, thereby reducing by third, otherwise needed manual auditing effort.

One of the main limitations of untargeted metabolomics analysis is the low detection coverage of analytical techniques such as NMR, LC-MS, or GC-MS. In this research, the detection coverage of an automated approach configured by the on-line coupling of SPE to LC-MS/MS was evaluated by combination of sorbents based on different retention mechanisms. The approach was applied to the analysis of human serum using three types of sorbents: alkyl bonded silica, polymeric resins, and mixed-mode ionic resins. The combination of four sorbents (C18, a modified polystyrene-divinylbenzene resin and two mixed-mode ionic resins) led to the best extraction results and, therefore, the best detection coverage, which is explained by their complementary retention mechanisms. However, some of the sorbents provide a high detection coverage by themselves, as is the case with C18, which can afford to retain almost 83% of all detected entities. Taking into account the complementarity between pairs of these sorbents (C18 and the polystyrene-divinylbenzene resin with the mixed-mode ionic resins), dual cartridge SPE-LC-MS/MS configurations were designed for serum analysis. These configurations allowed increasing the detection coverage up to 91% of the total number of molecular features detected with all sorbents tested. An additional benefit of the SPE-LC-MS/MS strategy was the improvement of sensitivity as compared to protein precipitation and fractionation with methanol and chloroform. Thus, an average preconcentration factor of 10-75 was obtained in the SPE-based approach versus the two-phase protocol for metabolites extraction.

In recent years, with the growing popularity of smartphones, the number of Android malware shows explosive growth. As malicious apps may steal users' sensitive data and money from mobile and bank accounts, it's important to detect potential malicious behavior in real time. To achieve this goal, we propose a dynamic behavior inspection and analysis framework for malicious behavior detection in Android apps. A customized Android system is built to record apps' API (Application Programming Interface) calls, permission uses, and some other runtime features such as user operations. We also develop an automated testing platform to test massive samples so as to collect dynamic app behavior records. Then we exploit these records to extract apps' runtime features of both user interaction and app dynamic behavior for benign and malicious behavior classification. The experimental results show that the app behavior classification can reach an accuracy of 99.0%, identifying 71.8% instances of malware samples by running each app for only 18 minutes.

Fuzzing serves as a prevalent automated approach for uncovering software vulnerabilities. However, traditional fuzzing often exhibit a lack of directional focus when applied to particular vulnerability types, leading to inefficient triggering performance and suboptimal allocation of testing resources. This paper introduces a directed identification metric guided fuzzing aimed specifically at detecting buffer overflow vulnerabilities. We add source-level instrumentation that computes a runtime identification metric and feed that information back into the fuzzing loop to bias seed selection and mutation toward code areas that appear close to unsafe memory accesses. Based on the AFL++ framework, experimental evaluations demonstrate that the proposed technique accelerates crash detection markedly compared to existing fuzzing, confirming the practicality and efficacy of the directed identification metric in enhancing fuzzing.

While memory-safe and type-safe languages have been available for many years, the vast majority of software is still implemented in type-unsafe languages such as C/C++. Despite massive concerted efforts by software vendors such as Microsoft to eliminate buffer overflow vulnerabilities through automated and manual code review, they continue to be found and exploited. We present a novel approach that accepts the existence of overflow vulnerabilities and uses parallelism available through current and future multi-core architectures to detect vulnerabilities by monitoring the parallel execution of several slightly varying instances of the same application. During regular execution each instance performs equivalent computations. When an attacker attempts to inject an attack vector through a buffer overflow vulnerability, however, each instance reacts differently due to the variances we introduced into each instance. We describe our prototype implementation of such a parallelism-based buffer overflow detection system and demonstrate that it is capable of stopping buffer overflow vulnerabilities using actual exploit codes for the popular Apache Web server. The experimental results show that the runtime overhead of our parallel execution framework is less than 10% on average.

Online course management system (OCMS) mainly aids various events in online instructing, including testing, course discussion, assignment submission, and assignment grading. This paper is mainly designed basing on the study of completed OCMS of the past. Online assignment submission is prone to easy plagiarism, infecting the learning process of the students and interfering with their studies. In the past, using human power to inspect for plagiarism is very time-consuming. This research then is focused on allowing programming courses to employ procedures such as code standardization, textual analysis, structural analysis, and variable analysis, to evaluate and compare programming codes. We provide an intelligent agent as a daemon to analyze the program code for OCMS. Textually, we use document fingerprinting algorithm as a basis for text comparison; structurally, we utilize formal algebraic expression and dynamic control structure tree (DCS tree) to rebuild and evaluate the program structure; variable-wise, we not only record relevant information for each variable, but also analyze the programming structure where the variables are positioned. By applying a similarity measuring method, we output a similarity value for each program in the three aspects mentioned above. This research implements a convenient user interface that can be applied independently for assignment analyzation. Moreover, we have designed a set of application programming interface (API) that could be embedded into online course management systems.

We've seen in previous chapters that we can subsume a great deal of programming functionality and logic into our queries. This is very useful when running queries from the command line in the MySQL Monitor, but what about writing programs that work with MySQL? In order to develop applications that interact effectively with MySQL, we need to know how to submit queries to MySQL from client applications and retrieve the results so that we can use the result data in the program code. This is provided by a MySQL Application Programming Interface (API).KeywordsMultiple StatementError MessageException HandlingError CodeLink ObjectThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

In the evolving landscape of complex business ecosystems and their digital platforms, an increasing number of business Application Programming Interfaces (APIs) are encountering challenges in ensuring optimal authorization control. This challenge arises due to factors such as programming errors, improper configurations, and sub-optimal business processes. While security departments have exhibited proficiency in identifying vulnerabilities and mitigating certain viral or adversarial incursions, the safeguarding of comprehensive business processes remains an intricate task. This paper introduces a novel paradigm, denoted as the Low-Intervention Security Embedding Architecture (LiSEA), which empowers business applications to enhance the security of their processes through judicious intervention within business APIs. By strategically incorporating pre- and post-intervention checkpoints, we devise a finely grained access control model that meticulously assesses both the intent of incoming business requests and the outcomes of corresponding responses. Importantly, these advancements are seamlessly integrated into the existing business codebase. Our implementation demonstrates the effectiveness of LiSEA, as it adeptly addresses eight out of the ten critical vulnerabilities enumerated in the OWASP API Security Top 10. Notably, when the number of threads is less than 200, LiSEA brings less than 20 msec of latency to the business process, which is significantly less than the microservice security agent based on the API gateway.