Program Analysis for Vulnerability Detection

Description

For registration, please apply for this seminar through the central seminar assignment system.

Program analysis is a mature research area at the intersection of programming languages, formal methods, and software engineering. One of its main applications is automatic vulnerability detection. However, the complexity of modern systems is overwhelming and the vulnerabilities to be detected are increasingly sophisticated. To account for these particularities, many recent approaches advocate for lightweight program analysis techniques or hybrid methods, i.e., static and dynamic analysis. This seminar explores the trade-offs involved in designing a program analysis that scales to analyzing the security of real systems. In this seminar, we will discuss recent research papers in the area in a reading group format. Each week, one student will present papers covering a given topic, followed by a discussion. All participants are expected to actively participate in the discussion by asking questions.

Logistics

Instructor: Cristian-Alexandru Staicu,

Time: Wednesday, 10 am,

Location: Zoom (Disclaimer).

Semester Plan

• 27^th of October - kickoff meeting
• 17^th of November - Florian Romann, Fuzzing low-level programs,
• 24^th of November - Mitul Bipin, Availability vulnerabilities,
• 1^st of December - Sukanya Sengupta, Vulnerabilities in mobile apps,
• 8^th of December - Reza Zamiri, Vulnerabilities in software components and dependencies,
• 15^th of December - Florian Nawrath, Vulnerability prediction,
• 5^th of January - Davide Cecchini, Vulnerabilities in low-level programs,
• 12^th of January - Farah Shenawy, Automatic patching of vulnerabilities,
• 19^th of January - Omar Renawi, Vulnerabilities in web applications,
• 26^th of January - Hong-Thai Luu, Detect misuses of crypto APIs,
• 2^nd of February - Mitul Bipin, Availability vulnerabilities,
• 9^th of February - Omar Renawi, Vulnerabilities in web applications,
• 24^th of February 28^th of February - deadline for submitting the report.

Grading system

The final grade is an aggregate of the following parts, both presentation and final report are mandatory:

• 40% the final report,
• 40% the presentation,
• 20% for being active in class,
• bonus: up to 15% for the hands-on exercise. 

Supporting Materials

Please find below a set of useful materials for the seminar:

• The kick-off presentation's slides contain useful information about the structure and goals of this seminar, but also some required background for the assigned papers.
• Sample presentation 1 - you should aim for this much content when presenting each of the assigned papers (approx. 15 minutes). See the kick-off presentation for the recommended presentation's structure.
• Sample presentation 2 - a slightly shorter presentation (approx. 10 minutes).
• Consider using the following template for the report and its associated sources.
• You can find a sample report from last year here.

Topics

1. Vulnerabilities in web applications
   • NAVEX: precise and scalable exploit generation for dynamic web applications, USENIX Security 2018,
   • Detecting Node.js Prototype Pollution Vulnerabilities via Object Lookup Analysis, FSE 2021,
   • [optional] hands-on exercise: study the NoSQL vulnerability in CVE-2017-100049, and explain how it works; ideally, provide a PoC exploit.
2. Vulnerabilities in software components and dependencies
   • Thou shalt not depend on me: analysing the use of outdated JavaScript libraries on the web, NDSS 2017,
   • Beyond metadata: code-centric and usage-based analysis of known vulnerabilities in open-source software, ICSME 2018,
   • [optional] hands-on exercise: study the prototype pollution vulnerability in CVE-2020-8203, and explain how it works. Build two client applications: one that safely uses lodash and one that is affected by the vulnerability. How do the two approaches differ in alerting the two client applications about this vulnerability? 
3. Vulnerabilities in mobile apps
   • FIRMSCOPE: automatic uncovering of privilege-escalation vulnerabilities in pre-installed apps in Android firmware, USENIX Security 2020,
   • Iframes/popups are dangerous in mobile WebView: studying and mitigating differential context vulnerabilities, USENIX Security 2019,
   • [optional] hands-on exercise: create a simple Android application that loads third-party code in a WebView. Try to access sensitive web APIs such as the Geolocation API or the Sensor API. If access is allowed, is the user alerted that such APIs are accessed?
4. Detect misuses of crypto APIs
   • Cryptoguard: high precision detection of cryptographic vulnerabilities in massive-sized Java projects, CCS 2019,
   • CRYLOGGER: Detecting Crypto Misuses Dynamically, S&P 2021,
   • [optional] hands-on exercise: analyze the Apache Ranger's fix (here and here)in response to Cryptoguard findings. Extract a minimal, crypto API-only working example that constructs an MD5 hash (old) and an SHA-1 (new). Hash the same password with the two approaches and discuss how the length of the hashes differs.
5. Vulnerabilities in low-level programs
   • K-Miner: uncovering memory corruption in Linux, NDSS 2018,
   • Symbolic execution with SymCC: don't interpret, compile!, USENIX Security 2020,
   • Optional hands-on exercise: install and run SymCC on the example provided in the repo. Evaluate its scalability by running it on your favorite C programs (a few hundred or thousand lines of code). Report any interesting findings.
6. Fuzzing low-level programs
   • Qsym : a practical concolic execution engine tailored for hybrid fuzzing, USENIX Security 2018,
   • Redqueen: fuzzing with input-to-state correspondence, NDSS 2019,
   • [optional] hands-on exercise: study one of the vulnerabilities found by Redqueen, e.g., CVE-2018-14567, and explain how it works; ideally, provide a PoC exploit.
7. [not assigned] Fuzzing compilers and engines
   • Fuzzing JavaScript engines with aspect-preserving mutation, S&P 2020,
   • Montage: A neural network language model-guided JavaScript engine fuzzer, USENIX Security 2020,
   • [optional] hands-on exercise: study one of the vulnerabilities found by Montage, e.g., CVE-2019-0860, and explain how it works; ideally, provide a PoC exploit.
8. [not assigned] Machine learning-aided vulnerability detection
   • Neutaint: efficient dynamic taint analysis with neural networks, S&P 2020,
   • Scalable taint specification inference with big code, PLDI 2019,
   • [optional] hands-on exercise: study one of the vulnerabilities found by the presented extension of DeepCode, e.g., this path traversal, and explain how it works; ideally, provide a PoC exploit or a fix.
9. Availability vulnerabilities
   • Revealer: Detecting and Exploiting Regular Expression Denial-of-Service Vulnerabilities, S&P 2021,
   • SlowFuzz: automated domain-independent detection of algorithmic complexity vulnerabilities, CCS 2017,
   • [optional] hands-on exercise: study the ReDoS vulnerability in CVE-2017-16119, and explain how the associated PoC exploit works. Show how it can affect a vulnerable express server installed on your machine.
10. Automatic patching of vulnerabilities
    • Automating Patching of vulnerable open-source software versions in application binaries, NDSS 2019,
    • Automatic Hot Patch Generation for Android Kernels, USENIX Security 2020,
    • [optional] hands-on exercise: Write a small tool that updates vulnerable dependencies in package.json files. The tool should support 5-10 vulnerable packages from this list.
11. [not assigned] Removing vulnerabilities through debloating
    • RazoR: a framework for post-deployment software debloating, USENIX Security 2019,
    • Less is more: quantifying the security benefits of debloating web applications, USENIX Security 2019,
    • [optional] hands-on exercise: Write a compiler pass, e.g, as babel plugin or esprima traversal, to find calls to lodash.defaultsDeep. Run it on a few examples that use various lodash methods.
12. Vulnerability prediction
    • Leopard: identifying vulnerable code for vulnerability assessment through program metrics, ICSE 2019,
    • The importance of accounting for real-world labeling when predicting software vulnerabilities, FSE 2019,
    • [optional] hands-on exercise: Analyze three CVEs found by Leopard and their fixes. Using your best judgment, how many of the metrics used by Leopard change after the fix?