The Experts below are selected from a list of 1287 Experts worldwide ranked by ideXlab platform

Christos Kozyrakis - One of the best experts on this subject based on the ideXlab platform.

  • real world buffer overflow protection for userspace kernelspace
    USENIX Security Symposium, 2008
    Co-Authors: Michael Dalton, Hari Kannan, Christos Kozyrakis
    Abstract:

    Despite having been around for more than 25 years, buffer overflow attacks are still a major security threat for deployed software. Existing techniques for buffer overflow detection provide partial protection at best as they detect limited cases, suffer from many false positives, require source code access, or introduce large performance overheads. Moreover, none of these techniques are easily applicable to the operating system kernel. This paper presents a practical security environment for buffer overflow detection in userspace and kernelspace code. Our techniques build upon dynamic information flow tracking (DIFT) and prevent the attacker from overwriting pointers in the application or operating system. Unlike previous work, our technique does not have false positives on unmodified binaries, protects both data and control pointers, and allows for practical hardware support. Moreover, it is applicable to the kernel and provides robust detection of buffer overflows and user/kernel pointer dereferences. Using a full system prototype of a Linux Workstation (hardware and software), we demonstrate our security approach in practice and discuss the major challenges for robust buffer overflow protection in real-world software.

  • USENIX Security Symposium - Real-world buffer overflow protection for userspace & kernelspace
    2008
    Co-Authors: Michael Dalton, Hari Kannan, Christos Kozyrakis
    Abstract:

    Despite having been around for more than 25 years, buffer overflow attacks are still a major security threat for deployed software. Existing techniques for buffer overflow detection provide partial protection at best as they detect limited cases, suffer from many false positives, require source code access, or introduce large performance overheads. Moreover, none of these techniques are easily applicable to the operating system kernel. This paper presents a practical security environment for buffer overflow detection in userspace and kernelspace code. Our techniques build upon dynamic information flow tracking (DIFT) and prevent the attacker from overwriting pointers in the application or operating system. Unlike previous work, our technique does not have false positives on unmodified binaries, protects both data and control pointers, and allows for practical hardware support. Moreover, it is applicable to the kernel and provides robust detection of buffer overflows and user/kernel pointer dereferences. Using a full system prototype of a Linux Workstation (hardware and software), we demonstrate our security approach in practice and discuss the major challenges for robust buffer overflow protection in real-world software.

  • ISCA - Raksha: a flexible information flow architecture for software security
    Proceedings of the 34th annual international symposium on Computer architecture - ISCA '07, 2007
    Co-Authors: Michael Dalton, Hari Kannan, Christos Kozyrakis
    Abstract:

    High-level semantic vulnerabilities such as SQL injection and crosssite scripting have surpassed buffer overflows as the most prevalent security exploits. The breadth and diversity of software vulnerabilities demand new security solutions that combine the speed and practicality of hardware approaches with the flexibility and robustness of software systems. This paper proposes Raksha, an architecture for software security based on dynamic information flow tracking (DIFT). Raksha provides three novel features that allow for a flexible hardware/software approach to security. First, it supports flexible and programmable security policies that enable software to direct hardware analysis towards a wide range of high-level and low-level attacks. Second, it supports multiple active security policies that can protect the system against concurrent attacks. Third, it supports low-overhead security handlers that allow software to correct, complement, or extend the hardware-based analysis without the overhead associated with operating system traps. We present an FPGA prototype for Raksha that provides a full featured Linux Workstation for security analysis. Using unmodified binaries for real-world applications, we demonstrate that Raksha can detect high-level attacks such as directory traversal, command injection, SQL injection, and cross-site scripting as well as low-level attacks such as buffer overflows. We also show that low overhead exception handling is critical for analyses such as memory corruption protection in order to address false positives that occur due to the diverse code patterns in frequently used software.

  • Raksha: a flexible information flow architecture for software security
    2007
    Co-Authors: Michael Dalton, Hari Kannan, Christos Kozyrakis
    Abstract:

    High-level semantic vulnerabilities such as SQL injection and cross-site scripting have surpassed buffer overflows as the most prevalent security exploits. The breadth and diversity of software vulnera-bilities demand new security solutions that combine the speed and practicality of hardware approaches with the flexibility and robust-ness of software systems. This paper proposes Raksha, an architecture for software se-curity based on dynamic information flow tracking (DIFT). Rak-sha provides three novel features that allow for a flexible hard-ware/software approach to security. First, it supports flexible and programmable security policies that enable software to direct hard-ware analysis towards a wide range of high-level and low-level at-tacks. Second, it supports multiple active security policies that can protect the system against concurrent attacks. Third, it supports low-overhead security handlers that allow software to correct, com-plement, or extend the hardware-based analysis without the over-head associated with operating system traps. We present an FPGA prototype for Raksha that provides a full-featured Linux Workstation for security analysis. Using unmodi-fied binaries for real-world applications, we demonstrate that Rak-sha can detect high-level attacks such as directory traversal, com-mand injection, SQL injection, and cross-site scripting as well as low-level attacks such as buffer overflows. We also show that low-overhead exception handling is critical for analyses such as mem-ory corruption protection in order to address false positives that occur due to the diverse code patterns in frequently used software

Michael Dalton - One of the best experts on this subject based on the ideXlab platform.

  • real world buffer overflow protection for userspace kernelspace
    USENIX Security Symposium, 2008
    Co-Authors: Michael Dalton, Hari Kannan, Christos Kozyrakis
    Abstract:

    Despite having been around for more than 25 years, buffer overflow attacks are still a major security threat for deployed software. Existing techniques for buffer overflow detection provide partial protection at best as they detect limited cases, suffer from many false positives, require source code access, or introduce large performance overheads. Moreover, none of these techniques are easily applicable to the operating system kernel. This paper presents a practical security environment for buffer overflow detection in userspace and kernelspace code. Our techniques build upon dynamic information flow tracking (DIFT) and prevent the attacker from overwriting pointers in the application or operating system. Unlike previous work, our technique does not have false positives on unmodified binaries, protects both data and control pointers, and allows for practical hardware support. Moreover, it is applicable to the kernel and provides robust detection of buffer overflows and user/kernel pointer dereferences. Using a full system prototype of a Linux Workstation (hardware and software), we demonstrate our security approach in practice and discuss the major challenges for robust buffer overflow protection in real-world software.

  • USENIX Security Symposium - Real-world buffer overflow protection for userspace & kernelspace
    2008
    Co-Authors: Michael Dalton, Hari Kannan, Christos Kozyrakis
    Abstract:

    Despite having been around for more than 25 years, buffer overflow attacks are still a major security threat for deployed software. Existing techniques for buffer overflow detection provide partial protection at best as they detect limited cases, suffer from many false positives, require source code access, or introduce large performance overheads. Moreover, none of these techniques are easily applicable to the operating system kernel. This paper presents a practical security environment for buffer overflow detection in userspace and kernelspace code. Our techniques build upon dynamic information flow tracking (DIFT) and prevent the attacker from overwriting pointers in the application or operating system. Unlike previous work, our technique does not have false positives on unmodified binaries, protects both data and control pointers, and allows for practical hardware support. Moreover, it is applicable to the kernel and provides robust detection of buffer overflows and user/kernel pointer dereferences. Using a full system prototype of a Linux Workstation (hardware and software), we demonstrate our security approach in practice and discuss the major challenges for robust buffer overflow protection in real-world software.

  • ISCA - Raksha: a flexible information flow architecture for software security
    Proceedings of the 34th annual international symposium on Computer architecture - ISCA '07, 2007
    Co-Authors: Michael Dalton, Hari Kannan, Christos Kozyrakis
    Abstract:

    High-level semantic vulnerabilities such as SQL injection and crosssite scripting have surpassed buffer overflows as the most prevalent security exploits. The breadth and diversity of software vulnerabilities demand new security solutions that combine the speed and practicality of hardware approaches with the flexibility and robustness of software systems. This paper proposes Raksha, an architecture for software security based on dynamic information flow tracking (DIFT). Raksha provides three novel features that allow for a flexible hardware/software approach to security. First, it supports flexible and programmable security policies that enable software to direct hardware analysis towards a wide range of high-level and low-level attacks. Second, it supports multiple active security policies that can protect the system against concurrent attacks. Third, it supports low-overhead security handlers that allow software to correct, complement, or extend the hardware-based analysis without the overhead associated with operating system traps. We present an FPGA prototype for Raksha that provides a full featured Linux Workstation for security analysis. Using unmodified binaries for real-world applications, we demonstrate that Raksha can detect high-level attacks such as directory traversal, command injection, SQL injection, and cross-site scripting as well as low-level attacks such as buffer overflows. We also show that low overhead exception handling is critical for analyses such as memory corruption protection in order to address false positives that occur due to the diverse code patterns in frequently used software.

  • Raksha: a flexible information flow architecture for software security
    2007
    Co-Authors: Michael Dalton, Hari Kannan, Christos Kozyrakis
    Abstract:

    High-level semantic vulnerabilities such as SQL injection and cross-site scripting have surpassed buffer overflows as the most prevalent security exploits. The breadth and diversity of software vulnera-bilities demand new security solutions that combine the speed and practicality of hardware approaches with the flexibility and robust-ness of software systems. This paper proposes Raksha, an architecture for software se-curity based on dynamic information flow tracking (DIFT). Rak-sha provides three novel features that allow for a flexible hard-ware/software approach to security. First, it supports flexible and programmable security policies that enable software to direct hard-ware analysis towards a wide range of high-level and low-level at-tacks. Second, it supports multiple active security policies that can protect the system against concurrent attacks. Third, it supports low-overhead security handlers that allow software to correct, com-plement, or extend the hardware-based analysis without the over-head associated with operating system traps. We present an FPGA prototype for Raksha that provides a full-featured Linux Workstation for security analysis. Using unmodi-fied binaries for real-world applications, we demonstrate that Rak-sha can detect high-level attacks such as directory traversal, com-mand injection, SQL injection, and cross-site scripting as well as low-level attacks such as buffer overflows. We also show that low-overhead exception handling is critical for analyses such as mem-ory corruption protection in order to address false positives that occur due to the diverse code patterns in frequently used software

Hari Kannan - One of the best experts on this subject based on the ideXlab platform.

  • real world buffer overflow protection for userspace kernelspace
    USENIX Security Symposium, 2008
    Co-Authors: Michael Dalton, Hari Kannan, Christos Kozyrakis
    Abstract:

    Despite having been around for more than 25 years, buffer overflow attacks are still a major security threat for deployed software. Existing techniques for buffer overflow detection provide partial protection at best as they detect limited cases, suffer from many false positives, require source code access, or introduce large performance overheads. Moreover, none of these techniques are easily applicable to the operating system kernel. This paper presents a practical security environment for buffer overflow detection in userspace and kernelspace code. Our techniques build upon dynamic information flow tracking (DIFT) and prevent the attacker from overwriting pointers in the application or operating system. Unlike previous work, our technique does not have false positives on unmodified binaries, protects both data and control pointers, and allows for practical hardware support. Moreover, it is applicable to the kernel and provides robust detection of buffer overflows and user/kernel pointer dereferences. Using a full system prototype of a Linux Workstation (hardware and software), we demonstrate our security approach in practice and discuss the major challenges for robust buffer overflow protection in real-world software.

  • USENIX Security Symposium - Real-world buffer overflow protection for userspace & kernelspace
    2008
    Co-Authors: Michael Dalton, Hari Kannan, Christos Kozyrakis
    Abstract:

    Despite having been around for more than 25 years, buffer overflow attacks are still a major security threat for deployed software. Existing techniques for buffer overflow detection provide partial protection at best as they detect limited cases, suffer from many false positives, require source code access, or introduce large performance overheads. Moreover, none of these techniques are easily applicable to the operating system kernel. This paper presents a practical security environment for buffer overflow detection in userspace and kernelspace code. Our techniques build upon dynamic information flow tracking (DIFT) and prevent the attacker from overwriting pointers in the application or operating system. Unlike previous work, our technique does not have false positives on unmodified binaries, protects both data and control pointers, and allows for practical hardware support. Moreover, it is applicable to the kernel and provides robust detection of buffer overflows and user/kernel pointer dereferences. Using a full system prototype of a Linux Workstation (hardware and software), we demonstrate our security approach in practice and discuss the major challenges for robust buffer overflow protection in real-world software.

  • ISCA - Raksha: a flexible information flow architecture for software security
    Proceedings of the 34th annual international symposium on Computer architecture - ISCA '07, 2007
    Co-Authors: Michael Dalton, Hari Kannan, Christos Kozyrakis
    Abstract:

    High-level semantic vulnerabilities such as SQL injection and crosssite scripting have surpassed buffer overflows as the most prevalent security exploits. The breadth and diversity of software vulnerabilities demand new security solutions that combine the speed and practicality of hardware approaches with the flexibility and robustness of software systems. This paper proposes Raksha, an architecture for software security based on dynamic information flow tracking (DIFT). Raksha provides three novel features that allow for a flexible hardware/software approach to security. First, it supports flexible and programmable security policies that enable software to direct hardware analysis towards a wide range of high-level and low-level attacks. Second, it supports multiple active security policies that can protect the system against concurrent attacks. Third, it supports low-overhead security handlers that allow software to correct, complement, or extend the hardware-based analysis without the overhead associated with operating system traps. We present an FPGA prototype for Raksha that provides a full featured Linux Workstation for security analysis. Using unmodified binaries for real-world applications, we demonstrate that Raksha can detect high-level attacks such as directory traversal, command injection, SQL injection, and cross-site scripting as well as low-level attacks such as buffer overflows. We also show that low overhead exception handling is critical for analyses such as memory corruption protection in order to address false positives that occur due to the diverse code patterns in frequently used software.

  • Raksha: a flexible information flow architecture for software security
    2007
    Co-Authors: Michael Dalton, Hari Kannan, Christos Kozyrakis
    Abstract:

    High-level semantic vulnerabilities such as SQL injection and cross-site scripting have surpassed buffer overflows as the most prevalent security exploits. The breadth and diversity of software vulnera-bilities demand new security solutions that combine the speed and practicality of hardware approaches with the flexibility and robust-ness of software systems. This paper proposes Raksha, an architecture for software se-curity based on dynamic information flow tracking (DIFT). Rak-sha provides three novel features that allow for a flexible hard-ware/software approach to security. First, it supports flexible and programmable security policies that enable software to direct hard-ware analysis towards a wide range of high-level and low-level at-tacks. Second, it supports multiple active security policies that can protect the system against concurrent attacks. Third, it supports low-overhead security handlers that allow software to correct, com-plement, or extend the hardware-based analysis without the over-head associated with operating system traps. We present an FPGA prototype for Raksha that provides a full-featured Linux Workstation for security analysis. Using unmodi-fied binaries for real-world applications, we demonstrate that Rak-sha can detect high-level attacks such as directory traversal, com-mand injection, SQL injection, and cross-site scripting as well as low-level attacks such as buffer overflows. We also show that low-overhead exception handling is critical for analyses such as mem-ory corruption protection in order to address false positives that occur due to the diverse code patterns in frequently used software

Michael Bellomo - One of the best experts on this subject based on the ideXlab platform.

  • Red Hat Linux: Your Visual Blueprint to the Linux Platform
    2000
    Co-Authors: Ruth Maran, Michael Bellomo
    Abstract:

    From the Publisher: Finally, a guide for Linux users who don't want to wade through page after page of boring text! With over 100 illustrated two-page lessons on everything from installation and Internet connections to shell scripts and group permissions, this is the ideal reference for visually oriented users who want to set up a Linux Workstation or server. The CD-ROM includes an e-version of the book and the latest Red Hat Linux release.

  • Master Red Hat Linux Visually with Cdrom
    2000
    Co-Authors: Michael Bellomo
    Abstract:

    From the Publisher: By tightly integrating text and graphics, this guide shows you how Red Hat Linux works — and makes it easier than ever to harness the power of a Linux Workstation or server. Step-by-step instructions and hands-on tips show you how to accomplish specific tasks, solve real-world problems, and master undocumented techniques. Master every facet of Red Hat Linux, from customizing GNOME and configuring users and groups to setting up Web access and dealing with security issues.

Kimberly Ruud - One of the best experts on this subject based on the ideXlab platform.

  • SSC97-XI-4 Rapid Space Hardware Development through Computer-Automated Testing
    2016
    Co-Authors: Dallas S. Masters, Kimberly Ruud
    Abstract:

    Abstract. FORTE, the Fast On-Orbit Recording of Transient Events small satellite designed and built by Los Alamos and Sandia National Laboratories, is scheduled for launch in August, 1997. In the spirit of "better, cheaper, faster " satellites, the RF experiment hardware (receiver and trigger sub-systems) necessitated rapid prototype testing and characterization in the development of space-flight components. This was accomplished with the assembly of engineering model hardware prior to construction of flight hardware and the design of component-specific, PC-based software control libraries. Using the LabVIEW ® graphical programming language, together with off-the-shelf PC digital 1/0 and GPIB interface cards, hardware control and complete automation of test equipment was possible from one Pc. Because the receiver and trigger sub-systems employed complex functions for signal discrimination and transient detection, thorough validation of all functions and illumination of any faults were priorities. These methods were successful in accelerating the development and characterization of space-flight components prior to integration and allowed more complete data to be gathered than could have been accomplished without automation. Additionally, automated control of input signal sources was carried over from bench-level to system-level with the use of a networked Linux Workstation utilizing a GPIB interface

  • Rapid space hardware development through computer-automated testing
    1997
    Co-Authors: Dallas Masters, Kimberly Ruud
    Abstract:

    FORTE, the Fast On-Orbit Recording of Transient Events small satellite designed and built by Los Alamos and Sandia National Laboratories, is scheduled for launch in August, 1997. In the spirit of {open_quotes}better, cheaper, faster{close_quotes} satellites, the RF experiment hardware (receiver and trigger sub-systems) necessitated rapid prototype testing and characterization in the development of space-flight components. This was accomplished with the assembly of engineering model hardware prior to construction of flight hardware and the design of component-specific, PC-based software control libraries. Using the LabVIEW{reg_sign} graphical programming language, together with off-the-shelf PC digital I/O and GPIB interface cards, hardware control and complete automation of test equipment was possible from one PC. Because the receiver and trigger sub-systems employed complex functions for signal discrimination and transient detection, thorough validation of all functions and illumination of any faults were priorities. These methods were successful in accelerating the development and characterization of space-flight components prior to integration and allowed more complete data to be gathered than could have been accomplished without automation. Additionally, automated control of input signal sources was carried over from bench-level to system-level with the use of networked Linux Workstation utilizing a GPIB interface.