Query: static program analysis security

title: Security Applications of Static Program Analysis
abstract: Author(s) Belleville, Brian Advisor(s) Franz,  Static program analysis computes information about a program without executing the program. This can be used to improve software security by determining a security policy based on the program's semantics, which is then used to implement a run time protection, or by detecting bugs in the program, which can then be fixed before they are subject to an attack. We present applications of static program analysis to address software exploits that utilize memory corruption.Memory corruption exploits are one of the most severe forms of program attacks, and occur when an attacker performs invalid memory accesses to hijack a program. This can involve overwriting data to force the program to perform malicious actions, as well as reading sensitive data to leak secrets.One approach that has been proposed to stop memory corruption attacks is data space randomization (DSR) DSR utilizes static analysis to classify program variables into a set of equivalence classes, and then encrypts variables with a randomly chosen key for each equivalence class. This thwarts memory corruption attacks that introduce illegitimate data flows. However, existing implementations of DSR trade analysis precision for better run time performance, which leaves attackers sufficient leeway to mount attacks. In this dissertation we present context sensitive data space randomization, a more precise version of DSR that is able to distinguish a larger number of equivalence classes by using a context sensitive points to analysis to construct equivalence classes. We then adapt this analysis and protection to HARD, which shows that context sensitive DSR can target specialized hardware to provide precise protection with good run time performance.We also explored using static analysis to find security critical bugs. Specifically, we developed KALD, a static analysis tool which uses points to analysis to detect direct address disclosures that can lead to kernel ASLR bypasses. We show that KALD successfully detects several previously unknown direct disclosure vulnerabilities in the Linux kernel.

title: Android Security via Static Program Analysis
abstract: Android is a popular platform designed for mobile devices. It consists of a customized Linux kernel, middleware, and a few core applications such as the Phone application. The middleware, commonly referred to as the Android framework, provides libraries and runtime services to applications. Applications in Android are written mainly in Java. Once compiled, Android transforms its applications into the Dalvik Executable (or DEX) format to minimize the memory footprint. Android uses a Java VM called Dalvik to execute DEX bytecode. Unlike other mobile OSes, Android has a unique permission mechanism. At development time, an application developer needs to explicitly request permissions by including them in an application configuration file. We refer to this configuration file simply as the manifest invthe remainder of the paper. At installation time, each uservneeds to review the permissions that the application requestsvand explicitly grant them.

title: Bouncer: Static Program Analysis in Hardware
abstract: When discussing safety and security for embedded systems, we typically divide the world into software checks (which are either static or dynamic) or hardware checks (which are dynamic) As others have pointed out, hardware checks offer more than just efficiency. They are intrinsic to the device's functionality and thus are live from power up; they require little to no dependency on other software functioning correctly, and due to the fact they are wired directly into the operation of the system, are difficult or impossible to bypass. We explore an experimental new embedded system that uses special purpose hardware for static analysis that prevents all program binaries with memory errors, invalid control flow, and several other undesirable properties from ever being loaded onto the device. Static analysis often requires whole binary level, rather than instruction level, examination. We show that a carefully constructed hardware state machine, using available scratch pad memory, is capable of efficiently checking functional binaries in a streaming and verifiably non bypassable way directly in hardware as they are loaded into the embedded program store. The resulting system is surprisingly small (taking no more than .0079 mm2) efficient (capable of checking binaries at an average throughput of around 60 cycles per instruction) and yet guarantees execution free from many of the fragile behaviors that result in security and safety concerns. We believe this is the first time any static analysis has been implemented at the hardware level and opens the door to more complex hardware checked properties.

title: Static Program Analysis as a Fuzzing Aid
abstract: Fuzz testing is an effective and scalable technique to perform software security assessments. Yet, contemporary fuzzers fall short of thoroughly testing applications with a high degree of control flow diversity, such as firewalls and network packet analyzers. In this paper, we demonstrate how static program analysis can guide fuzzing by augmenting existing program models maintained by the fuzzer. Based on the insight that code patterns reflect the data format of inputs processed by a program, we automatically construct an input dictionary by statically analyzing program control and data flow. Our analysis is performed before fuzzing commences, and the input dictionary is supplied to an off the shelf fuzzer to influence input generation. Evaluations show that our technique not only increases test coverage by 10 15% over baseline fuzzers such as afl but also reduces the time required to expose vulnerabilities by up to an order of magnitude. As a case study, we have evaluated our approach on two classes of network applications: nDPI, a deep packet inspection library, and tcpdump, a network packet analyzer. Using our approach, we have uncovered 15 zero day vulnerabilities in the evaluated software that were not found by stand alone fuzzers. Our work not only provides a practical method to conduct security evaluations more effectively but also demonstrates that the synergy between program analysis and testing can be exploited for a better outcome.

title: SPARK: Static Program Analysis Reasoning and Retrieving Knowledge
abstract: Program analysis is a technique to reason about programs without executing them, and it has various applications in compilers, integrated development environments, and security. In this work, we present a machine learning pipeline that induces a security analyzer for programs by example. The security analyzer determines whether a program is either secure or insecure based on symbolic rules that were deduced by our machine learning pipeline. The machine pipeline is two staged consisting of a Recurrent Neural Networks (RNN) and an Extractor that converts an RNN to symbolic rules. To evaluate the quality of the learned symbolic rules, we propose a sampling based similarity measurement between two infinite regular languages. We conduct a case study using real world data. In this work, we discuss the limitations of existing techniques and possible improvements in the future. The results show that with sufficient training data and a fair distribution of program paths it is feasible to deducing symbolic security rules for the OpenJDK library with millions lines of code.

title: Program Analysis of Cryptographic Implementations for Security
abstract: Cryptographic implementation errors in popular open source libraries (e.g. OpenSSL, GnuTLS, BotanTLS, etc. and the misuses of cryptographic primitives (e.g. as in Juniper Network) have been the major source of vulnerabilities in the wild. These serious problems prompt the need for new compile time security checking. Such security enforcements demand the study of various cryptographic properties and their mapping into enforceable program analysis rules. We refer to this new security approach as cryptographic program analysis (CPA) In this paper, we show how cryptographic program analysis can be performed effectively andits security applications. Specifically, we systematically investigate different threat categories on various cryptographicimplementations and their usages. Then, we derive varioussecurity rules, which are enforceable by program analysistools during code compilation. We also demonstrate the capabilities of static taint analysis to enforce most of these security rules and provide a prototype implementation. We point out promising future research and development directions in this new area of cryptographic program analysis.

title: When program analysis meets mobile security: an industrial study of misusing Android internet sockets
abstract: Despite recent progress in program analysis techniques to identify vulnerabilities in Android apps, significant challenges still remain for applying these techniques to large scale industrial environments. Modern software security providers, such as Qihoo 360 and Pwnzen (two leading companies in China) are often required to process more than 10 million mobile apps at each run. In this work, we focus on effectively and efficiently identifying vulnerable usage of Internet sockets in an industrial setting. To achieve this goal, we propose a practical hybrid approach that enables lightweight yet precise detection in the industrial setting. In particular, we integrate the process of categorizing potential vulnerable apps with analysis techniques, to reduce the inevitable human inspection effort. We categorize potential vulnerable apps based on characteristics of vulnerability signatures, to reduce the burden on static analysis. We flexibly integrate static and dynamic analyses for apps in each identified family, to refine the family signatures and hence target on precise detection. We implement our approach in a practical system and deploy the system on the Pwnzen platform. By using the system, we identify and report potential vulnerabilities of 24 vulnerable apps (falling into 3 vulnerability families) to their developers, and some of these reported vulnerabilities are previously unknown. The apps of each vulnerability family in total have over 50 million downloads. We also propose countermeasures and highlight promising directions for technology transfer.

title: An approach for identifying JavaScript loaded advertisements through static program analysis
abstract: Motivated by reasons related to privacy, obtrusiveness, and security, there is great interest in the prospect of blocking advertisements. Current approaches to this goal involve keeping sets of URL based regular expressions, which are matched against every URL fetched on a web page. While generally effective, this approach is not scalable and requires constant manual maintenance of the filtering lists. To counter these shortcomings, we present a fundamentally different approach with which we demonstrate that static program analysis on JavaScript source code can be used to identify JavaScript that loads and displays ads. Our use of static analysis lets us flag and block ad related scripts before runtime, offering security in addition to blocking ads. Preliminary results from a classifier trained on the features we develop achieve 98% accuracy in identifying ad related scripts.

title: Static program analysis assisted dynamic taint tracking for software vulnerability discovery
abstract: The evolution of computer science has exposed us to the growing gravity of security problems and threats. Dynamic taint analysis is a prevalent approach to protect a program from malicious behaviors, but fails to provide any information about the code which is not executed. This paper describes a novel approach to overcome the limitation of traditional dynamic taint analysis by integrating static analysis into the system and presents framework SDCF to detect software vulnerabilities with high code coverage. Our experiments show that SDCF is not only able to provide efficient runtime protection by introducing an overhead of 4.16x based on the taint tracing technique, but is also capable of discovering latent software vulnerabilities which have not been exploited, and achieve code coverage of more than 90%

title: DepTaint: A Static Taint Analysis Method Based on Program Dependence
abstract: Since static taint analysis is performed prior to execution by considering all possible execution paths, it can discover potential security issues before the program running. Currently, many taint analysis tools pay more attention to data dependence in the program. Whereas implicit flow analysis based on control dependence is generally not considered owning to its complexity. Therefore, this paper presents a static taint analysis method named DepTaint, which expands the static checkers of LLVM, focuses on program dependence including data and control dependence in the program. DepTaint analyzes the taint variables propagated along explicit flows and implicit flows, especially commendably handles the under taint in explicit flow analysis. Our evaluations demonstrate that, for 8 programs containing data and control dependence and 8 programs injected different common vulnerabilities (i.e. array bounds, double free, format string vulnerability, heap overflow, integer overflow, stack overflow, and UAF) DepTaint significantly outperforms LLVM's static checker both at marking taint variables and achieving more finegrained taint propagation paths. Specially, for the programs containing branch selection and loop structure, DepTaint on average marks 2X and 3.6X taint variables than LLVM's static checker.