Protecting computer systems through eliminating or analyzing vulnerabilities

Security;Vulnerability;Use after free;Bad casting;Timing channel

Lee, Byoungyoung ; Lee, Wenke Kim, Taesoo Computer Science Harris, William R. Orso, Alessandro Cui, Weidong ; Lee, Wenke

University:Georgia Institute of Technology

Department:Computer Science

关键词: Security;    Vulnerability;    Use after free;    Bad casting;    Timing channel;   

Others  :  https://smartech.gatech.edu/bitstream/1853/58603/1/LEE-DISSERTATION-2016.pdf

美国|英语

来源: SMARTech Repository

【 摘 要 】

There have been tremendous efforts to build fully secure computer systems, but it is not an easy goal. Making a simple mistakeintroduces a vulnerability, which can critically endanger a whole system's security. This thesis aims at protecting computer systems fromvulnerabilities. We take two complementary approaches in achieving this goal, eliminating or analyzing vulnerabilities. In the vulnerability elimination approach, we eliminate a certain class of memory corruption vulnerabilities to completely close attack vectors from such vulnerabilities. In particular, we develop tools DangNull and CaVer, each of which eliminates popular and emerging vulnerabilities, use-after-free and bad-casting, respectively. DangNull relies on the key observation that the root cause of use-after-free is that pointers are not nullified after the target object is freed. Thus, DangNull instruments a program to trace the object's relationships via pointers and automatically nullifies all pointers when the target object is freed. Similarly, CaVer relies on the key observation that the root cause of bad-casting is that casting operations are not properly verified. Thus, CaVer uses a new runtime type tracing mechanism to overcome the limitation of existing approaches, and performs efficient verification on all typecasting operations dynamically. We have implemented these protection solutions and successfully applied them to Chrome and Firefoxbrowsers. Our evaluation showed that DangNull and CaVer imposes 29% and 7.6% benchmark overheads in Chrome, respectively. We have also tested seven use-after-free and five bad-casting exploits in Chrome, and DangNull and CaVer safely prevented them all. In the vulnerability analysis approach, we focus on a timing-channel vulnerability which allows an attacker to learn information about program's sensitive data without causing a program to perform unsafe operations. It is challenging to test and further confirm the timing-channel vulnerability as it typically involves complex algorithmic operations. We implemented SideFinder, an assistant tool identifying timing-channel vulnerabilities in a hash table. Empowered with symbolic execution techniques, SideFinder semi-automatically synthesizes inputs attacking timing-channels, and thus confirms the vulnerability. Using SideFinder, we analyzed and further synthesized two real-world attacks in the Linux kernel, and showed it can break one important security mechanism, Address Space Layout Randomization (ASLR).