NewsCurrently, no news are available
For registration, please apply for this seminar through the central seminar assignment system.
Program analysis is a mature research area at the intersection of programming languages, formal methods, and software engineering. One of its main applications is automatic vulnerability detection. However, the complexity of modern systems is overwhelming and the vulnerabilities to be detected are increasingly sophisticated. To account for these particularities, many recent approaches advocate for lightweight program analysis techniques or hybrid methods, i.e., static and dynamic analysis. This seminar explores the trade-offs involved in designing a program analysis that scales to analyzing the security of real systems. In this seminar, we will discuss recent research papers in the area in a reading group format. Each week, one student will present papers covering a given topic, followed by a discussion. All participants are expected to actively participate in the discussion by asking questions.
Instructor: Cristian-Alexandru Staicu,
Time: Wednesday, 10 am,
Location: Zoom (Disclaimer).
- 27th of October - kickoff meeting
- 17th of November - presentation slot
- 24th of November - presentation slot
- 1st of December - presentation slot
- 8th of December - presentation slot
- 15th of December - presentation slot
- 6th of January - presentation slot
- 13th of January - presentation slot
- 20th of January - presentation slot
- 27th of January - presentation slot
- 3rd of February - presentation slot
- 10th of February - presentation slot
The final grade is an aggregate of the following parts, both presentation and final report are mandatory:
- 40% the final report,
- 40% the presentation,
- 20% for being active in class,
- bonus: up to 15% for the hands-on exercise.
Please find below a set of useful materials for the seminar:
- The kick-off presentation's slides contain useful information about the structure and goals of this seminar, but also some required background for the assigned papers.
- Sample presentation 1 - you should aim for this much content when presenting each of the assigned papers (approx. 10 minutes). See the kick-off presentation for the recommended presentation's structure.
- Sample presentation 2 - a slightly longer presentation (approx. 15 minutes).
- Consider using the following template for the report and its associated sources.
- Vulnerabilities in web applications
- NAVEX: precise and scalable exploit generation for dynamic web applications, USENIX Security 2018,
- Detecting Node.js Prototype Pollution Vulnerabilities via Object Lookup Analysis, FSE 2021,
- [optional] hands-on exercise: study the NoSQL vulnerability in CVE-2017-100049, and explain how it works; ideally, provide a PoC exploit.
- Vulnerabilities in software components and dependencies
- Beyond metadata: code-centric and usage-based analysis of known vulnerabilities in open-source software, ICSME 2018,
- [optional] hands-on exercise: study the prototype pollution vulnerability in CVE-2020-8203, and explain how it works. Build two client applications: one that safely uses lodash and one that is affected by the vulnerability. How do the two approaches differ in alerting the two client applications about this vulnerability?
- Vulnerabilities in mobile apps
- FIRMSCOPE: automatic uncovering of privilege-escalation vulnerabilities in pre-installed apps in Android firmware, USENIX Security 2020,
- Iframes/popups are dangerous in mobile WebView: studying and mitigating differential context vulnerabilities, USENIX Security 2019,
- [optional] hands-on exercise: create a simple Android application that loads third-party code in a WebView. Try to access sensitive web APIs such as the Geolocation API or the Sensor API. If access is allowed, is the user alerted that such APIs are accessed?
- Detect misuses of crypto APIs
- Cryptoguard: high precision detection of cryptographic vulnerabilities in massive-sized Java projects, CCS 2019,
- CRYLOGGER: Detecting Crypto Misuses Dynamically, S&P 2021,
- [optional] hands-on exercise: analyze the Apache Ranger's fix (here and here)in response to Cryptoguard findings. Extract a minimal, crypto API-only working example that constructs an MD5 hash (old) and an SHA-1 (new). Hash the same password with the two approaches and discuss how the length of the hashes differs.
- Vulnerabilities in low-level programs
- K-Miner: uncovering memory corruption in Linux, NDSS 2018,
- Symbolic execution with SymCC: don't interpret, compile!, USENIX Security 2020,
- Optional hands-on exercise: install and run SymCC on the example provided in the repo. Evaluate its scalability by running it on your favorite C programs (a few hundred or thousand lines of code). Report any interesting findings.
- Fuzzing low-level programs
- Qsym : a practical concolic execution engine tailored for hybrid fuzzing, USENIX Security 2018,
- Redqueen: fuzzing with input-to-state correspondence, NDSS 2019,
- [optional] hands-on exercise: study one of the vulnerabilities found by Redqueen, e.g., CVE-2018-14567, and explain how it works; ideally, provide a PoC exploit.
- Fuzzing compilers and engines
- [optional] hands-on exercise: study one of the vulnerabilities found by Montage, e.g., CVE-2019-0860, and explain how it works; ideally, provide a PoC exploit.
- Machine learning-aided vulnerability detection
- Neutaint: efficient dynamic taint analysis with neural networks, S&P 2020,
- Scalable taint specification inference with big code, PLDI 2019,
- [optional] hands-on exercise: study one of the vulnerabilities found by the presented extension of DeepCode, e.g., this path traversal, and explain how it works; ideally, provide a PoC exploit or a fix.
- Availability vulnerabilities
- Revealer: Detecting and Exploiting Regular Expression Denial-of-Service Vulnerabilities, S&P 2021,
- SlowFuzz: automated domain-independent detection of algorithmic complexity vulnerabilities, CCS 2017,
- [optional] hands-on exercise: study the ReDoS vulnerability in CVE-2017-16119, and explain how the associated PoC exploit works. Show how it can affect a vulnerable express server installed on your machine.
- Automatic patching of vulnerabilities
- Automating Patching of vulnerable open-source software versions in application binaries, NDSS 2019,
- Automatic Hot Patch Generation for Android Kernels, USENIX Security 2020,
- [optional] hands-on exercise: Write a small tool that updates vulnerable dependencies in package.json files. The tool should support 5-10 vulnerable packages from this list.
- Removing vulnerabilities through debloating
- RazoR: a framework for post-deployment software debloating, USENIX Security 2019,
- Less is more: quantifying the security benefits of debloating web applications, USENIX Security 2019,
- [optional] hands-on exercise: Write a compiler pass, e.g, as babel plugin or esprima traversal, to find calls to lodash.defaultsDeep. Run it on a few examples that use various lodash methods.
- Vulnerability prediction
- Leopard: identifying vulnerable code for vulnerability assessment through program metrics, ICSE 2019,
- The importance of accounting for real-world labeling when predicting software vulnerabilities, FSE 2019,
- [optional] hands-on exercise: Analyze three CVEs found by Leopard and their fixes. Using your best judgment, how many of the metrics used by Leopard change after the fix?