ABIDES: Adaptive BInary Debloating and Security
Abstract
Software bloat is the result of the continuous addition of new features, and the inflation of libraries with new featuresand option"s. Bloat negatively affects security and reliability in multiple ways. Larger code bases tend to include morebugs and potentially v"ulnerabilities, providing an increased attack surface to attackers. At the same time, the increasedcode complexity prevents the app""lication of certain security mechanisms, while it makes others impractical because ofhigh overheads. Finally, large code bases also"" facilitate exploitation by providing the necessary building blocks forlaunching code-reuse, privilege escalation, and other attack""s, enlarging attack surface in a different way.This proposal aims to develop novel methods and tools that can effectively and compr"ehensively reduce the attacksurface and secure deployed binary applications. We look at applications comprehensively focusing both" on the partsvisible to users, like binaries and libraries, but also the ""invisible"" parts, that is, the operating system code that" supportsthe application. This enables us to address the problem of increasing attack surfaces and security holistically to harden"applications against sophisticated attacks, such as advanced persistent threats (APTs), which consist of multipleexploit steps; the" last usually targeting the operating system (OS).This project will develop methods and tools for reducing application attack surfa"ce by: (a) hiding and removing unusedlibrary and kernel code, (b) adaptively hiding and disabling code that an application does not"" require for completing thecurrent task at hand, (c) disabling targeted features through error virtualization, and (d) specializing"" APIs throughconcretizing function arguments that remain constant across all function invocations.To deploy these methods, we plan" to create a versatile and extensible binary analysis and augmentation frameworkthat can be used to analyze and rewrite binaries. T"he framework will take advantage of information produced bycompilers, such as symbols, relocation information, and debugging symbol""s, which is frequently available for nonmalicioussoftware. This framework will be used to build various of our analyses, but concur"rently it will also beenriched by the various methods and techniques developed for attack surface reduction.Once we have reduced t"he attack surface of applications, we will develop a series of defenses taking advantage of thenew, smaller surfaces. We will lever"age the analysis and augmentation framework to develop defenses focusing onvariable granularity and partition-aware control-flow in"tegrity, continuous randomization, and self-protecting defenses(egalitarian runtime defense).Finally, to quantify the benefits of"" attack surface reduction, we will devise metrics that go beyond code size andconsider qualitative aspects of the removed or disabl"ed code. The metrics will both allow us to understand the benefitsof our attack surface reduction methods and defense mechanisms.
Document Details
- Document Type
- DoD Grant Award
- Publication Date
- Sep 01, 2017
- Source ID
- N000141712788
Entities
People
- Georgios Portokalidis
Organizations
- Office of Naval Research
- Stevens Institute of Technology
- United States Navy