Unfortunately, the speaker for tomorrow (Omar) is sick and thus, unable to give the talk. He will present his topic at the end of the semester instead, i.e., on 9th of February. Therefore, we will skip tomorrow's seminar session and meet next week when... Read more
Unfortunately, the speaker for tomorrow (Omar) is sick and thus, unable to give the talk. He will present his topic at the end of the semester instead, i.e., on 9th of February. Therefore, we will skip tomorrow's seminar session and meet next week when Hong-Thai will talk about crypto API misuses.
Unfortunately, the speaker from next week (Mitul) faced an unforeseen emergency and he will not be able to give the talk on Wednesday, as planned. Hence, we will skip next week's seminar and he will present at the end of the semester, instead. Please... Read more
Unfortunately, the speaker from next week (Mitul) faced an unforeseen emergency and he will not be able to give the talk on Wednesday, as planned. Hence, we will skip next week's seminar and he will present at the end of the semester, instead. Please find the updated semester plan on the seminar's page. See you all on the 1st of December when Sukanya will present.
I uploaded the slides for the kickoff presentation: you can find a link to them on the main page, or you can see them in the Information -> Materials section on CMS. I also uploaded the template for the report. Please do not forget to send me today the... Read more
I uploaded the slides for the kickoff presentation: you can find a link to them on the main page, or you can see them in the Information -> Materials section on CMS. I also uploaded the template for the report. Please do not forget to send me today the list of preferred topics.
The kickoff meeting is about to start. Please join us in the Zoom call.
This is a reminder that the kickoff meeting will take place tomorrow at 10. I sent you all the Zoom link by email.
See you tomorrow,
For registration, please apply for this seminar through the central seminar assignment system.
Program analysis is a mature research area at the intersection of programming languages, formal methods, and software engineering. One of its main applications is automatic vulnerability detection. However, the complexity of modern systems is overwhelming and the vulnerabilities to be detected are increasingly sophisticated. To account for these particularities, many recent approaches advocate for lightweight program analysis techniques or hybrid methods, i.e., static and dynamic analysis. This seminar explores the trade-offs involved in designing a program analysis that scales to analyzing the security of real systems. In this seminar, we will discuss recent research papers in the area in a reading group format. Each week, one student will present papers covering a given topic, followed by a discussion. All participants are expected to actively participate in the discussion by asking questions.
Instructor: Cristian-Alexandru Staicu,
Time: Wednesday, 10 am,
Location: Zoom (Disclaimer).
- 27th of October - kickoff meeting
- 17th of November - Florian Romann, Fuzzing low-level programs,
24th of November - Mitul Bipin, Availability vulnerabilities,
- 1st of December - Sukanya Sengupta, Vulnerabilities in mobile apps,
- 8th of December - Reza Zamiri, Vulnerabilities in software components and dependencies,
- 15th of December - Florian Nawrath, Vulnerability prediction,
- 5th of January - Davide Cecchini, Vulnerabilities in low-level programs,
- 12th of January - Farah Shenawy, Automatic patching of vulnerabilities,
19th of January - Omar Renawi, Vulnerabilities in web applications,
- 26th of January - Hong-Thai Luu, Detect misuses of crypto APIs,
- 2nd of February - Mitul Bipin, Availability vulnerabilities,
- 9th of February - Omar Renawi, Vulnerabilities in web applications,
- 24th of February - deadline for submitting the report.
The final grade is an aggregate of the following parts, both presentation and final report are mandatory:
- 40% the final report,
- 40% the presentation,
- 20% for being active in class,
- bonus: up to 15% for the hands-on exercise.
Please find below a set of useful materials for the seminar:
- The kick-off presentation's slides contain useful information about the structure and goals of this seminar, but also some required background for the assigned papers.
- Sample presentation 1 - you should aim for this much content when presenting each of the assigned papers (approx. 15 minutes). See the kick-off presentation for the recommended presentation's structure.
- Sample presentation 2 - a slightly shorter presentation (approx. 10 minutes).
- Consider using the following template for the report and its associated sources.
- You can find a sample report from last year here.
- Vulnerabilities in web applications
- NAVEX: precise and scalable exploit generation for dynamic web applications, USENIX Security 2018,
- Detecting Node.js Prototype Pollution Vulnerabilities via Object Lookup Analysis, FSE 2021,
- [optional] hands-on exercise: study the NoSQL vulnerability in CVE-2017-100049, and explain how it works; ideally, provide a PoC exploit.
- Vulnerabilities in software components and dependencies
- Beyond metadata: code-centric and usage-based analysis of known vulnerabilities in open-source software, ICSME 2018,
- [optional] hands-on exercise: study the prototype pollution vulnerability in CVE-2020-8203, and explain how it works. Build two client applications: one that safely uses lodash and one that is affected by the vulnerability. How do the two approaches differ in alerting the two client applications about this vulnerability?
- Vulnerabilities in mobile apps
- FIRMSCOPE: automatic uncovering of privilege-escalation vulnerabilities in pre-installed apps in Android firmware, USENIX Security 2020,
- Iframes/popups are dangerous in mobile WebView: studying and mitigating differential context vulnerabilities, USENIX Security 2019,
- [optional] hands-on exercise: create a simple Android application that loads third-party code in a WebView. Try to access sensitive web APIs such as the Geolocation API or the Sensor API. If access is allowed, is the user alerted that such APIs are accessed?
- Detect misuses of crypto APIs
- Cryptoguard: high precision detection of cryptographic vulnerabilities in massive-sized Java projects, CCS 2019,
- CRYLOGGER: Detecting Crypto Misuses Dynamically, S&P 2021,
- [optional] hands-on exercise: analyze the Apache Ranger's fix (here and here)in response to Cryptoguard findings. Extract a minimal, crypto API-only working example that constructs an MD5 hash (old) and an SHA-1 (new). Hash the same password with the two approaches and discuss how the length of the hashes differs.
- Vulnerabilities in low-level programs
- K-Miner: uncovering memory corruption in Linux, NDSS 2018,
- Symbolic execution with SymCC: don't interpret, compile!, USENIX Security 2020,
- Optional hands-on exercise: install and run SymCC on the example provided in the repo. Evaluate its scalability by running it on your favorite C programs (a few hundred or thousand lines of code). Report any interesting findings.
- Fuzzing low-level programs
- Qsym : a practical concolic execution engine tailored for hybrid fuzzing, USENIX Security 2018,
- Redqueen: fuzzing with input-to-state correspondence, NDSS 2019,
- [optional] hands-on exercise: study one of the vulnerabilities found by Redqueen, e.g., CVE-2018-14567, and explain how it works; ideally, provide a PoC exploit.
- [not assigned] Fuzzing compilers and engines
- [optional] hands-on exercise: study one of the vulnerabilities found by Montage, e.g., CVE-2019-0860, and explain how it works; ideally, provide a PoC exploit.
- [not assigned] Machine learning-aided vulnerability detection
- Neutaint: efficient dynamic taint analysis with neural networks, S&P 2020,
- Scalable taint specification inference with big code, PLDI 2019,
- [optional] hands-on exercise: study one of the vulnerabilities found by the presented extension of DeepCode, e.g., this path traversal, and explain how it works; ideally, provide a PoC exploit or a fix.
- Availability vulnerabilities
- Revealer: Detecting and Exploiting Regular Expression Denial-of-Service Vulnerabilities, S&P 2021,
- SlowFuzz: automated domain-independent detection of algorithmic complexity vulnerabilities, CCS 2017,
- [optional] hands-on exercise: study the ReDoS vulnerability in CVE-2017-16119, and explain how the associated PoC exploit works. Show how it can affect a vulnerable express server installed on your machine.
- Automatic patching of vulnerabilities
- Automating Patching of vulnerable open-source software versions in application binaries, NDSS 2019,
- Automatic Hot Patch Generation for Android Kernels, USENIX Security 2020,
- [optional] hands-on exercise: Write a small tool that updates vulnerable dependencies in package.json files. The tool should support 5-10 vulnerable packages from this list.
- [not assigned] Removing vulnerabilities through debloating
- RazoR: a framework for post-deployment software debloating, USENIX Security 2019,
- Less is more: quantifying the security benefits of debloating web applications, USENIX Security 2019,
- [optional] hands-on exercise: Write a compiler pass, e.g, as babel plugin or esprima traversal, to find calls to lodash.defaultsDeep. Run it on a few examples that use various lodash methods.
- Vulnerability prediction
- Leopard: identifying vulnerable code for vulnerability assessment through program metrics, ICSE 2019,
- The importance of accounting for real-world labeling when predicting software vulnerabilities, FSE 2019,
- [optional] hands-on exercise: Analyze three CVEs found by Leopard and their fixes. Using your best judgment, how many of the metrics used by Leopard change after the fix?