The Experts below are selected from a list of 4236 Experts worldwide ranked by ideXlab platform
Chongkyung Kil - One of the best experts on this subject based on the ideXlab platform.
-
MemSherlock: An Automated Debugger for Unknown Memory Corruption Vulnerabilities ∗ ABSTRACT
2008Co-Authors: Emre C. Sezer, Peng Ning, Chongkyung KilAbstract:Software vulnerabilities have been the main contributing factor to the Internet security problems such as fast spreading worms. Among these software vulnerabilities, memory corruption vulnerabilities such as buffer overflow and format string bugs have been the most common ones exploited by network-based attacks. Many security countermeasures (e.g., patching, automatic signature generation for intrusion detection systems) require vulnerability information to function correctly. However, despite many years of research, automatically identifying unknown software vulnerabilities still remains an open problem. In this paper, we present the development of a security debugging tool named MemSherlock, which can automatically identify unknown memory corruption vulnerabilities upon the detection of Malicious payloads that exploit such vulnerabilities. MemSherlock provides critical information for unknown memory corruption vulnerabilities, including (1) the corruption point in the source code (i.e., the statement that allows the exploitation of memory corruption vulnerability), (2) the slice of source code that helps the Malicious Input to reach the corruption point, and (3) the description of how the Malicious Input exploits the unknown vulnerability. We evaluate MemSherlock with a set of 11 real-world applications that have buffer overflow, heap overflow, and format string vulnerabilities. The evaluation results indicate that MemSherlock is a useful tool to facilitate the automatic vulnerability analysis process
-
MemSherlock: An Automated Debugger for Unknown Memory Corruption Vulnerabilities
2007Co-Authors: Emre C. Sezer, Peng Ning, Chongkyung KilAbstract:Software vulnerabilities have been the main contributing factor to the Internet security problems such as fast spreading worms. Among these software vulnerabilities, memory corruption vulnerabilities such as buffer overflow and format string bugs have been the most common ones exploited by network-based attacks. Many security countermeasures (e.g., patching, automatic signature generation for intrusion detection systems) require vulnerability information to function correctly. However, despite many years of research, automatically identifying unknown software vulnerabilities still remains an open problem. In this paper, we present the development of a security debugging tool named MemSherlock, which can automatically identify unknown memory corruption vulnerabilities upon the detection of Malicious payloads that exploit such vulnerabilities. MemSherlock provides critical information for unknown memory corruption vulnerabilities, including (1) the corruption point in the source code (i.e., the statement that allows the exploitation of memory corruption vulnerability), (2) the slice of source code that helps the Malicious Input to reach the corruption point, and (3) the description of how the Malicious Input exploits the unknown vulnerability. We evaluate MemSherlock with a set of 11 real-world applications that have buffer overflow, heap overflow, and format string vulnerabilities. The evaluation results indicate that MemSherlock is a useful tool to facilitate the automatic vulnerability analysis process
-
Automatic Diagnosis and Response to Memory Corruption Vulnerabilities
2005Co-Authors: Peng Ning, Chongkyung Kil, Yan Zhai, Chris BookholtAbstract:Cyber attacks against networked computers have become relentless in recent years. The most common attack method is to exploit memory corruption vulnerabilities such as buffer overflow and format string bugs. This paper presents a technique to automatically identify both known and unknown memory corruption vulnerabilities. Based on the observation that a randomized program usually crashes upon a memory corruption attack, this technique uses the crash as a trigger to initiate an automatic diagnosis algorithm. The output of the diagnosis includes the instruction that is tricked to corrupt data, the call stack at the time of corruption, and the propagation history of corrupted data. These results provide useful information in fixing the vulnerabilities. Moreover, the diagnosis process also generates a signature of the attack using data/address values embedded in the Malicious Input message, and is used to block future attacks. Such a signature is further associated with the program execution state to reduce false positives without decreasing the detection rate. The proposed techniques enable the development of a decentralized self-diagnosing and self-protecting defense mechanism for networked computers. We report the implementation experience and experimental evaluation of a prototype system on Linux
Laurie Williams - One of the best experts on this subject based on the ideXlab platform.
-
omni automated ensemble with unexpected models against adversarial evasion attack
arXiv: Cryptography and Security, 2020Co-Authors: Rui Shu, Laurie Williams, Tianpei Xia, Tim MenziesAbstract:BACKGROUND: Machine learning-based security detection models have become prevalent in modern malware and intrusion detection systems. However, previous studies show that such models are susceptible to adversarial evasion attacks. In this type of attack, Inputs (i.e., adversarial examples) are specially crafted by intelligent Malicious adversaries, with the aim of being misclassified by existing state-of-the-art models (e.g., deep neural networks). Once the attackers can fool a classifier to think that a Malicious Input is actually benign, they can render a machine learning-based malware or intrusion detection system ineffective. GOAL: To help security practitioners and researchers build a more robust model against adversarial evasion attack through the use of ensemble learning. METHOD: We propose an approach called OMNI, the main idea of which is to explore methods that create an ensemble of "unexpected models"; i.e., models whose control hyperparameters have a large distance to the hyperparameters of an adversary's target model, with which we then make an optimized weighted ensemble prediction. RESULTS: In studies with five adversarial evasion attacks (FGSM, BIM, JSMA, DeepFool and Carlini-Wagner) on five security datasets (NSL-KDD, CIC-IDS-2017, CSE-CIC-IDS2018, CICAndMal2017 and the Contagio PDF dataset), we show that the improvement rate of OMNI's prediction accuracy over attack accuracy is about 53% (median value) across all datasets, with about 18% (median value) loss rate when comparing pre-attack accuracy and OMNI's prediction accuracy. CONCLUSIONWhen using ensemble learning as a defense method against adversarial evasion attacks, we suggest to create ensemble with unexpected models who are distant from the attacker's expected model (i.e., target model) through methods such as hyperparameter optimization.
-
idea using system level testing for revealing sql injection related error message information leaks
International Conference on Engineering Secure Software and Systems, 2010Co-Authors: Ben Smith, Laurie Williams, Andrew AustinAbstract:Completely handling SQL injection consists of two activities: properly protecting the system from Malicious Input, and preventing any resultant error messages caused by SQL injection from revealing sensitive information. The goal of this research is to assess the relative effectiveness of unit and system level testing of web applications to reveal both error message information leak and SQL injection vulnerabilities. To produce 100% test coverage of 176 SQL statements in four open source web applications, we augmented the original automated unit test cases with our own system level tests that use both normal Input and 132 forms of Malicious Input. Although we discovered no SQL injection vulnerabilities, we exposed 17 error message information leak vulnerabilities associated with SQL statements using system level testing. Our results suggest that security testers who use an iterative, test-driven development process should compose system level rather than unit level tests.
-
an early testing and defense web application framework for Malicious Input attacks
2006Co-Authors: Michael Gegick, Eric Isakson, Laurie WilliamsAbstract:Input validation vulnerabilities, one of the largest problems in software security today, are readily identified by software assurance (SA) tools. Software development organizations are increasingly adopting SA tools to quickly identify vulnerabilities in their software systems. These tools, usually applied when implementation is complete, have a comprehensive and extendable rule set to detect known and new vulnerabilities. A simple and effective framework is needed to provide developers with a strategic approach to securing against Malicious Input attacks early in software development. We introduce a Java Web Application Reliability and Defense (WARD) framework, a two-part security solution composed of a vulnerability detection component, SecureUnit, and a vulnerability protection component, SecureFilter. SecureUnit enables developers to write automated, reusable, and customizable JUnit penetration tests that launch attacks on their systems to reveal security vulnerabilities. SecureFilter is a customizable server-side choke point containing a regular expression-based filter to match legal Input according to system requirements. WARD provides an attack-then-defend approach for developers to build security into a software system early in the software process. We integrated WARD v1.0 with WebGoat, an open-source web application security test bed, and successfully “warded off” 38 of 43 (88%) injected cross-site scripting exploits. WARD v2.0 will address the encoded (e.g. with HTML entities, hex characters) exploits that were not stopped from entering WebGoat in WARD v1.0.
Peng Ning - One of the best experts on this subject based on the ideXlab platform.
-
MemSherlock: An Automated Debugger for Unknown Memory Corruption Vulnerabilities ∗ ABSTRACT
2008Co-Authors: Emre C. Sezer, Peng Ning, Chongkyung KilAbstract:Software vulnerabilities have been the main contributing factor to the Internet security problems such as fast spreading worms. Among these software vulnerabilities, memory corruption vulnerabilities such as buffer overflow and format string bugs have been the most common ones exploited by network-based attacks. Many security countermeasures (e.g., patching, automatic signature generation for intrusion detection systems) require vulnerability information to function correctly. However, despite many years of research, automatically identifying unknown software vulnerabilities still remains an open problem. In this paper, we present the development of a security debugging tool named MemSherlock, which can automatically identify unknown memory corruption vulnerabilities upon the detection of Malicious payloads that exploit such vulnerabilities. MemSherlock provides critical information for unknown memory corruption vulnerabilities, including (1) the corruption point in the source code (i.e., the statement that allows the exploitation of memory corruption vulnerability), (2) the slice of source code that helps the Malicious Input to reach the corruption point, and (3) the description of how the Malicious Input exploits the unknown vulnerability. We evaluate MemSherlock with a set of 11 real-world applications that have buffer overflow, heap overflow, and format string vulnerabilities. The evaluation results indicate that MemSherlock is a useful tool to facilitate the automatic vulnerability analysis process
-
MemSherlock: An Automated Debugger for Unknown Memory Corruption Vulnerabilities
2007Co-Authors: Emre C. Sezer, Peng Ning, Chongkyung KilAbstract:Software vulnerabilities have been the main contributing factor to the Internet security problems such as fast spreading worms. Among these software vulnerabilities, memory corruption vulnerabilities such as buffer overflow and format string bugs have been the most common ones exploited by network-based attacks. Many security countermeasures (e.g., patching, automatic signature generation for intrusion detection systems) require vulnerability information to function correctly. However, despite many years of research, automatically identifying unknown software vulnerabilities still remains an open problem. In this paper, we present the development of a security debugging tool named MemSherlock, which can automatically identify unknown memory corruption vulnerabilities upon the detection of Malicious payloads that exploit such vulnerabilities. MemSherlock provides critical information for unknown memory corruption vulnerabilities, including (1) the corruption point in the source code (i.e., the statement that allows the exploitation of memory corruption vulnerability), (2) the slice of source code that helps the Malicious Input to reach the corruption point, and (3) the description of how the Malicious Input exploits the unknown vulnerability. We evaluate MemSherlock with a set of 11 real-world applications that have buffer overflow, heap overflow, and format string vulnerabilities. The evaluation results indicate that MemSherlock is a useful tool to facilitate the automatic vulnerability analysis process
-
Automatic Diagnosis and Response to Memory Corruption Vulnerabilities
2005Co-Authors: Peng Ning, Chongkyung Kil, Yan Zhai, Chris BookholtAbstract:Cyber attacks against networked computers have become relentless in recent years. The most common attack method is to exploit memory corruption vulnerabilities such as buffer overflow and format string bugs. This paper presents a technique to automatically identify both known and unknown memory corruption vulnerabilities. Based on the observation that a randomized program usually crashes upon a memory corruption attack, this technique uses the crash as a trigger to initiate an automatic diagnosis algorithm. The output of the diagnosis includes the instruction that is tricked to corrupt data, the call stack at the time of corruption, and the propagation history of corrupted data. These results provide useful information in fixing the vulnerabilities. Moreover, the diagnosis process also generates a signature of the attack using data/address values embedded in the Malicious Input message, and is used to block future attacks. Such a signature is further associated with the program execution state to reduce false positives without decreasing the detection rate. The proposed techniques enable the development of a decentralized self-diagnosing and self-protecting defense mechanism for networked computers. We report the implementation experience and experimental evaluation of a prototype system on Linux
Thomas Walter - One of the best experts on this subject based on the ideXlab platform.
-
Filter-resistant code injection on ARM
Journal in Computer Virology, 2011Co-Authors: Yves Younan, Frank Piessens, Pieter Philippaerts, Sven Lachmund, Wouter Joosen, Thomas WalterAbstract:Code injection attacks are one of the most powerful and important classes of attacks on software. In these attacks, the attacker sends Malicious Input to a software application, where it is stored in memory. The Malicious Input is chosen in such a way that its representation in memory is also a valid representation of a machine code program that performs actions chosen by the attacker. The attacker then triggers a bug in the application to divert the control flow to this injected machine code. A typical action of the injected code is to launch a command interpreter shell, and hence the Malicious Input is often called shellcode . Attacks are usually performed against network facing applications, and such applications often perform validations or encodings on Input. Hence, a typical hurdle for attackers, is that the shellcode has to pass one or more filtering methods before it is stored in the vulnerable application’s memory space. Clearly, for a code injection attack to succeed, the Malicious Input must survive such validations and transformations. Alphanumeric Input (consisting only of letters and digits) is typically very robust for this purpose: it passes most filters and is untouched by most transformations. This paper studies the power of alphanumeric shellcode on the ARM architecture. It shows that the subset of ARM machine code programs that (when interpreted as data) consist only of alphanumerical characters is a Turing complete subset. This is a non-trivial result, as the number of instructions that consist only of alphanumeric characters is very limited. To craft useful exploit code (and to achieve Turing completeness), several tricks are needed, including the use of self-modifying code.
-
filter resistant code injection on arm
Computer and Communications Security, 2009Co-Authors: Yves Younan, Frank Piessens, Pieter Philippaerts, Sven Lachmund, Wouter Joosen, Thomas WalterAbstract:Code injections attacks are one of the most powerful and important classes of attacks on software. In such attacks, the attacker sends Malicious Input to a software application, where it is stored in memory. The Malicious Input is chosen in such a way that its representation in memory is also a valid representation of a machine code program that performs actions chosen by the attacker. The attacker then triggers a bug in the application to divert the control flow to this injected machine code. A typical action of the injected code is to launch a command interpreter shell, and hence the Malicious Input is often called shellcode. Attacks are usually performed against network facing applications, and such applications often perform validations or encodings on Input. Hence, a typical hurdle for attackers, is that the shellcode has to pass one or more filtering methods before it is stored in the vulnerable application's memory space. Clearly, for a code injection attack to succeed, the Malicious Input must survive such validations and transformations. Alphanumeric Input (consisting only of letters and digits) is typically very robust for this purpose: it passes most filters and is untouched by most transformations. This paper studies the power of alphanumeric shellcode on the ARM 32 bit RISC processor. It shows that the subset of ARM machine code programs that (when interpreted as data) consist only of alphanumerical characters is a Turing complete subset. This is a non-trivial result, as the number of instructions that consist only of alphanumeric characters is very limited. To craft useful exploit code (and to achieve Turing completeness), several tricks are needed, including the use of self-modifying code.
Van Ginkel Neeltje - One of the best experts on this subject based on the ideXlab platform.
-
Securing the Interaction of Software Modules across Security Boundaries
2020Co-Authors: Van Ginkel NeeltjeAbstract:In the current software development culture, software modules from different parties need to work together in a single application. While this culture allows for reuse of components, using third-party software modules adds security risks. A single Malicious or buggy module can compromise the whole system, and thus compromise the security of all other modules. In this thesis we investigate how we can better secure the interactions between different software modules. We study this problem in two settings. The first is that of C software modules compiled to Intel x86-64 assembly. The second setting considers Node.js web applications, comprised of different modules written in JavaScript. In low-level applications, hardware technology such as Intel SGX can protect software modules from an untrusted context by isolating them in an enclave. This introduces new possibilities in the software trust model. It is however not trivial to securely integrate a software module protected with Intel SGX into an untrusted application. Such a software module should be able to detect and prevent an attacker from providing Malicious Input to the enclave. In Node.js web applications, different JavaScript modules can be composed together to provide the functionality needed. If a single JavaScript module contains a bug or tries to interact with another module in a Malicious way, the application should be able to detect this and prevent or modify the interaction. The solution in both cases is to protect the border between security domains with extra checks. In this thesis we propose, implement and evaluate the automatic generation of border checks for Intel SGX enclaves by using separation logic specifications. We further investigate how to create provably safe enclaves, by formalizing the interactions between the enclave and its untrusted context. In the web application domain, we evaluate and extend the NodeSentry security architecture, which uses the membrane pattern to isolate two object graphs, and can hence isolate a JavaScript module from its context. By applying the NodeSentry architecture to several use cases in the Tearless project, we can properly evaluate if NodeSentry is also applicable in the context of larger applications. We discuss a few issues in the current implementation that prevent the current implementation from staying compatible with future versions of the ECMAScript standard without large modifications.status: accepte
-
Securing the Interaction of Software Modules across Security Boundaries
2020Co-Authors: Van Ginkel NeeltjeAbstract:In the current software development culture, software modules from different parties need to work together in a single application. While this culture allows for reuse of components, using third-party software modules adds security risks. A single Malicious or buggy module can compromise the whole system, and thus compromise the security of all other modules. In this thesis we investigate how we can better secure the interactions between different software modules. We study this problem in two settings. The first is that of C software modules compiled to Intel x86-64 assembly. The second setting considers Node.js web applications, comprised of different modules written in JavaScript. In low-level applications, hardware technology such as Intel SGX can protect software modules from an untrusted context by isolating them in an enclave. This introduces new possibilities in the software trust model. It is however not trivial to securely integrate a software module protected with Intel SGX into an untrusted application. Such a software module should be able to detect and prevent an attacker from providing Malicious Input to the enclave. In Node.js web applications, different JavaScript modules can be composed together to provide the functionality needed. If a single JavaScript module contains a bug or tries to interact with another module in a Malicious way, the application should be able to detect this and prevent or modify the interaction. The solution in both cases is to protect the border between security domains with extra checks. In this thesis we propose, implement and evaluate the automatic generation of border checks for Intel SGX enclaves by using separation logic specifications. We further investigate how to create provably safe enclaves, by formalizing the interactions between the enclave and its untrusted context. In the web application domain, we evaluate and extend the NodeSentry security architecture, which uses the membrane pattern to isolate two object graphs, and can hence isolate a JavaScript module from its context. By applying the NodeSentry architecture to several use cases in the Tearless project, we can properly evaluate if NodeSentry is also applicable in the context of larger applications. We discuss a few issues in the current implementation that prevent the current implementation from staying compatible with future versions of the ECMAScript standard without large modifications.status: publishe