Wasmati: An efficient static vulnerability scanner for WebAssembly

: This report presents the results of the mini-grant research project. It explores a possible explanation on why buffer overflows, format strings and other memory related vulnerabilities are still prevalent today. It is argued that this can be attributed to the required level of user interaction to apply today's solutions. Therefore, the researched solution was a hardware based instruction level mandatory access control mechanism that will be enabled by default whenever a user obtains a new computer with such a processor. It also presents the reasoning behind why instruction level is more desirable than function level access control mechanism, which was the original theory. The design and proof of concept demonstration as well as difficulties in achieving the desired proof are also presented.

Programs written in unsafe languages like C and C++ often suffer from errors like buffer overflows, dangling pointers, and memory leaks. Dynamic analysis tools like Valgrind can detect these errors, but their overhead---primarily due to the cost of instrumenting every memory read and write---makes them too heavyweight for use in deployed applications and makes testing with them painfully slow. The result is that much deployed software remains susceptible to these bugs, which are notoriously difficult to track down.

Universal Plug and Play (UPnP) technology is gaining popularity day by day since this technology reduces the complexity associated with the installation and management of devices and network services. As a result, most of the modern consumer electronics and intelligent appliances are now equipped with UPnP capabilities. However, there exist several potential vulnerabilities in the UPnP protocol implementation that can be exploited by a malicious attacker to cause financial or reputation damage to a victim. In this paper, we have analyzed the general architecture of UPnP protocol and presented three potential vulnerabilities of UPnP protocol implementation namely Power consumption, Denial of Service and Buffer overflow. Furthermore, we have exploited these vulnerabilities to perform several attacks and analyzed the results of these attacks. Finally, we have proposed several schemes to thwart these attacks and to improve the security state of the UPnP protocol.

If-transpiler: Inlining of hybrid flow-sensitive security monitor for JavaScript

Static code analysis is widely used to support the development of high-quality software. It helps developers detect potential bugs and security vulnerabilities in a program's source code without executing it. While the potential benefits of static analysis tools are beyond question, their usability is often criticised and prevents software developers from using static analysis to its full potential. In the past decade, researchers have studied developer needs and contrasted them to available static analysis tool functionalities. In this paper, we summarize the main design challenges for building usable static analysis tools, and show that they revolve around the notion of explainability, which is a subarea of usability. We present existing analysis tools and current research in static analysis usability, and detail how they approach those challenges. This leads us to proposing potential lines of future work in explainability for static analysis, namely turning static analysis tools into assistants and teachers.

The life and death of statically detected vulnerabilities: An empirical study

Web servers and the Web services associated with them have become increasingly important in the last few years. Online banking, e-mail, and money, business- to-business (B2B), and business-to-client (B2C) transactions are growing rapidly. It is difficult to imagine modern business without these forms of networking. However, there are also significant negative aspects. In many cases, due to competitive pressures, companies and government agencies had to implement these services very fast, often too fast and without any appreciation of the concepts of security and protection. As a consequence, it turns out that a hacker can misuse with little effort these Web services or compromise the underlying database (e.g., to obtain access to credit cards numbers or social insurance information). A very significant percentage of the population in developed and developing countries is using wired and wireless connections for reading e-mails, accessing newsgroups, or using Internet banking. All these services are running on a Web server. Most Web servers are running the Apache or the Microsoft Internet Information Server (IIS) (all versions of both servers [Apache 1.3.x/2.x, IIS 3-6]) (Netcraft, 2006). Of these, older versions of the Internet Information Server are especially vulnerable to numerous attacks. Therefore, an attacker is in a position to break, with little effort, into many Web servers running IIS 4 or 5. However, the Apache Web server (running on Windows systems) is also vulnerable to similar attacks. Moreover, using a Web server based on UNIX or Linux is not a guarantee for a secure system. UNIX and Linux systems are also affected by inherent weaknesses and vulnerabilities such as buffer overflows and the handling of format strings (ZDNet, 2006). Readers who like to have more general insight are referred to works by Leiss (1990) and Garfinkel and Spafford (2002). These books give broader perspectives on Internet security.

Context: In C, low-level errors, such as buffer overflow and use-after-free, are a major problem, as they cause security vulnerabilities and hard-to-find bugs. C lacks automatic checks, and programmers cannot apply defensive programming techniques because objects (e.g., arrays or structs) lack run-time information about bounds, lifetime, and types. Inquiry: Current approaches to tackling low-level errors include dynamic tools, such as bounds or type checkers, that check for certain actions during program execution. If they detect an error, they typically abort execution. Although they track run-time information as part of their runtimes, they do not expose this information to programmers. Approach: We devised an introspection interface that allows C programmers to access run-time information and to query object bounds, object lifetimes, object types, and information about variadic arguments. This enables library writers to check for invalid input or program states and thus, for example, to implement custom error handling that maintains system availability and does not terminate on benign errors. As we assume that introspection is used together with a dynamic tool that implements automatic checks, errors that are not handled in the application logic continue to cause the dynamic tool to abort execution. Knowledge: Using the introspection interface, we implemented a more robust, source-compatible version of the C standard library that validates parameters to its functions. The library functions react to otherwise undefined behavior; for example, they can detect lurking flaws, handle unterminated strings, check format string arguments, and set errno when they detect benign usage errors. Grounding: Existing dynamic tools maintain run-time information that can be used to implement the introspection interface, and we demonstrate its implementation in Safe Sulong, an interpreter and dynamic bug-finding tool for C that runs on a Java Virtual Machine and can thus easily expose relevant run-time information. Importance: Using introspection in user code is a novel approach to tackling the long-standing problem of low-level errors in C. As new approaches are lowering the performance overhead of run-time information maintenance, the usage of dynamic runtimes for C could become more common, which could ultimately facilitate a more widespread implementation of such an introspection interface.

Security certification of mobile platforms is usually a lengthy process. Apart from internal development and testing, it requires hiring a consultancy for guidance and certification. Consultants start with code reviews to identify potential vulnerabilities and subsequently conduct independent tests in their laboratory. Typically consultancy is expensive. We propose a technique to statically analyze the secure mobile platform source code to identify some of the potential vulnerabilities typically detected by the consultants. We have devised a set of patterns in code that are typically flagged by consultants as vulnerabilities. The presence of each such pattern is detected by custom developed checkers. A prototype implementation tool called SVAT (Static Vulnerability Analysis Tool) containing custom checkers has been developed by extending the Clang static analysis tool. SVAT is a collection of custom checkers developed to detect the vulnerabilities in TEE. We illustrate the working of our tool on OP-TEE, an open source implementation of TEE (Trusted Execution Environment), a typical environment that runs in mobile platforms to assure security. SVAT is currently not publicly available.

보안 침입 사건이 있은 후 해당되는 취약점만을 패치시키는 방식으로만 침입 피해를 줄이는 것은 충분하지 않다. 시스템 내에 취약한 코드가 있더라도 시스템의 내구성을 높여 보다 포괄적으로 침입을 막을 수 있는 방법이 필요하다. 본 논문은 리눅스 시스템에서 관리자를 대신하여 root 권한을 가진 프로세스를 감시하는 강건한 실시간 침입탐지기법을 제시한다. 이 기법은 사용자IP 주소를 프로세스 테이블에 추가하고 root 권한으로 기동되는 모든 프로세스의 IP 주소를 감시한다. 제안한 기법이 버퍼 오버 플로우 취약성에 대해 방어하는 것을 KON 프로그램을 통해 확인한다. 또한 원격으로 시스템을 관리할 수 있는 설정 프로토콜을 제안하며, 이 프로토콜을 통해 관리자 호스트의 IP주소가 침입으로부터 안전하게 보호될 수 있다. It is not enough to reduce damages of computer systems by just patching vulnerability codes after incidents occur. It is necessary to detect and block intrusions by boosting the durability of systems even if there are vulnerable codes in systems. This paper proposes a robust real-time intrusion detection method by monitoring root privileged processes instead of system administrators in Linux systems. This method saves IP addresses of users in the process table and monitors IP addresses of every root privileged process. The proposed method is verified to protect vulnerable programs against the buffer overflow by using KON program. A configuration protocol is proposed to manage systems remotely and host IP addresses are protected from intrusions safely through this protocol.

Static analysis of source code is considered to be a powerful tool for detecting potential security vulnerabilities. However, only limited information regarding the current quality of static analysis tools exist. A public assessment of the capabilities of the competing approaches and products is not available. Also, neither a common benchmark nor a standard evaluation procedure has yet been defined. In this paper, we propose a general methodology for systematically evaluating static analysis tools. We document the design of an automatic execution and evaluation framework to support iterative test case design and reliable result analysis. Furthermore, we propose a methodology for creating test cases which can assess the specific capabilities of static analysis tools on a very fine level of detail. We conclude the paper with a brief discussion of our experiences which we collected through a practical evaluation study of six commercial static analysis products.

Static analysis of source code security: Assessment of tools against SAMATE tests

This article proposes approaches supporting the analysis of code vulnerabilities based on overlapping machine instructions of variable length. For the purpose of focusing the search for potential malicious code it is suggested to apply first disassembling techniques allowing for a restriction of potentially exploitable memory space. Successively, testing based on heuristic optimization may be applied in order to evaluate dynamically the practicality of vulnerability exploitation.

One of the top two causes of software vulnerabilities in operating systems is the integer overflow. A typical integer overflow vulnerability is the Integer Overflow to Buffer Overflow IO2BO for short vulnerability. IO2BO is an underestimated threat. Many programmers have not realized the existence of IO2BO and its harm. Even for those who are aware of IO2BO, locating and fixing IO2BO vulnerabilities are still tedious and error-prone. Automatically identifying and fixing this kind of vulnerability are critical for software security. In this article, we present the design and implementation of IntPatch, a compiler extension for automatically fixing IO2BO vulnerabilities in C/C++ programs at compile time. IntPatch utilizes classic type theory and a dataflow analysis framework to identify potential IO2BO vulnerabilities, and then uses backward slicing to find out related vulnerable arithmetic operations, and finally instruments programs with runtime checks. Moreover, IntPatch provides an interface for programmers who want to check integer overflows manually. We evaluated IntPatch on a few real-world applications. It caught all 46 previously known IO2BO vulnerabilities in our test suite and found 21 new bugs. Applications patched by IntPatch have negligible runtime performance losses which are on average 1%.

Code vulnerability detection is a crucial approach to ensuring software security, aiming to automatically identify potential security vulnerabilities in source code. However, existing static vulnerability detection methods often face challenges such as feature loss and an insufficient expressive power when extracting program features. To address these issues, in this paper, we propose a source code vulnerability detection method based on joint graph and multimodal feature fusion. Innovatively, we construct a joint graph that integrates multiple program dependencies and semantic edges to achieve more comprehensive feature extraction. Additionally, by combining Graph Attention Networks (GATs) with the Transformer architecture, both structural and sequential features of code snippets are captured, further enhancing the model’s expressive capabilities. Finally, we introduce pre-fusion and post-fusion strategies to fully integrate multimodal features, thereby improving the accuracy and performance of vulnerability detection. Experimental results on the SARD dataset demonstrate the method’s excellent performance in detecting various types of vulnerabilities, achieving an F1 score of 85.20% and an accuracy of 86.50%. On the Real-Vul real-world dataset, the method achieves an F1 score of 73.9% and an accuracy of 86.50%. The detection results exhibit remarkable stability, ensuring a reliable and consistent performance. Overall, the proposed method surpasses the performance of existing mainstream detection approaches.