Multi-layer Software Transformation for Attack Surface Reduction and Shielding
Abstract
The abundance of software vulnerabilities can be traced to a broad and diverse set of both technical and non-technicalreasons, incl""uding giving security a secondary priority in favor of rich features, time to market, performance, and overallcost. When it comes t""o current software development and deployment practices, however, a major factor is that thesepractices increasingly lead to larger" and more complex code bases. Two of the main reasons for this ~software bloat~effect are: (a) the use of application development f"rameworks, toolkits, and libraries that provide very generic interfacesand functionality, and (b) deployment models that resolve de"pendencies by packaging some or all of the requiredlibraries within the application itself. The net results of these practices are" larger code bases, increased resourceconsumption, sluggish performance, and~crucially, from a security perspective~a much larger a"ttack surface.The main objective of the proposed research is the design and implementation of innovative binary code analysis andtransformation techniques for (a) reducing the attack surface of commodity software and systems by not onlydebloating through the re"moval of unnecessary code, but also restricting the capabilities and generality of theremaining code, and (b) shielding them agains""t exploitation by retrofitting novel protection mechanisms, as well asimproving existing ones. Informed by our extensive prior rese""arch in the areas of static binary code analysis, softwarehardening, and advanced exploitation, we will develop techniques for cros""s-component analysis, optimization, andspecialization of software already deployed on end-systems. These foundationaltechnologies"" will be applied towards achieving two complementary goals:~ Reduce the attack surface by removing unnecessary code, restricting th""e capabilities and generality of remainingcode, distrupting unintended data flows, and protecting currently mutable security-critic"al code and data by ~freezing~them according to the desired policy.~ Shield software against exploitation by retrofitting an array" of protection mechanisms, such as control flow integrity,code diversification, code isolation, and data space encryption.Based on"" the technical capabilities that we already have, and the experience and insights gained from our priorresearch, we propose to deve"lop a new generation of binary code analysis and transformation techniques that will laythe foundation for novel attack surface reduction and shielding protections that represent a major leap forward.
Document Details
- Document Type
- DoD Grant Award
- Publication Date
- Sep 29, 2017
- Source ID
- N000141712891
Entities
People
- R. Sekar
Organizations
- Office of Naval Research
- Research Foundation for the State University of New York
- United States Navy