2022 IEEE Security and Privacy Workshops (SPW)最新文献

Research Report: On the Feasibility of Retrofitting Operating Systems with Generated Protocol Parsers 研究报告:用生成协议解析器改造操作系统的可行性

2022 IEEE Security and Privacy Workshops (SPW) Pub Date : 2022-05-01 DOI: 10.1109/spw54247.2022.9833857

Wayne Wang, Peter C. Johnson

{"title":"Research Report: On the Feasibility of Retrofitting Operating Systems with Generated Protocol Parsers","authors":"Wayne Wang, Peter C. Johnson","doi":"10.1109/spw54247.2022.9833857","DOIUrl":"https://doi.org/10.1109/spw54247.2022.9833857","url":null,"abstract":"Parser generators show great promise in producing more secure input validation and processing routines. Operating system kernels are a particularly appealing place to deploy generated parsers due to their position at the periphery of a machine’s attack surface, the power they wield, and their complexity. At the same time, kernels can also be byzantine and idiosyncratic. Before we attempt to create generated parsers for wide deployment into kernels, therefore, it is important to understand how much of the existing codebase those parsers will replace, what (if any) functionality beyond parsing the generated code will need to implement, and what kernel facilities the code must integrate with. To answer these questions, we analyzed three protocol implementations in each of three open-source kernels to understand their behavior and organization. We identified commonalities and differences, measured the quantity of code used for different purposes, identified when and how multiplexing decisions were made, and analyzed the order in which operations were performed. We intend this analysis to inform the creation of generated parsers, for a variety of protocols, that can be smoothly integrated into modern kernels.","PeriodicalId":334852,"journal":{"name":"2022 IEEE Security and Privacy Workshops (SPW)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130341548","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A Secure Parser Generation Framework for IoT Protocols on Microcontrollers 微控制器上物联网协议的安全解析器生成框架

2022 IEEE Security and Privacy Workshops (SPW) Pub Date : 2022-05-01 DOI: 10.1109/spw54247.2022.9833866

Sameed Ali, Sean W. Smith

{"title":"A Secure Parser Generation Framework for IoT Protocols on Microcontrollers","authors":"Sameed Ali, Sean W. Smith","doi":"10.1109/spw54247.2022.9833866","DOIUrl":"https://doi.org/10.1109/spw54247.2022.9833866","url":null,"abstract":"In the recent years, vulnerabilities found in the packet parsers of Bluetooth Low Energy (BLE) protocol have called for a need to have secure lightweight protocol packet parsers for microcontrollers. Since these packet protocol grammars consist of packets of limited size it is possible to parse them efficiently via Finite State Machines (FSM). However, parsing via FSMs would require developers to either express the grammars via regular expressions or constructed hand-coded parsers. Unfortunately, hand-coding parsers is error-prone; furthermore, due in part to certain constructs found in such grammars which are not commonly found in text-based regular grammars. In addition, expressing binary grammar constructs in regular expression is not only challenging and error-prone but the resulting expressions are often complex and unreadable. Thus the lack of an alternative language for describing these constructs is a hindrance to the use of finite state machines to generate parsers which are safe, secure and computationally bounded. This paper presents a novel secure parser generation framework which consists of an easy-to-use parser description language called \"Microparse\" and a toolkit that utilizes finite state machines to generate lightweight parsers for micro-controllers. To demonstrate the viability of this approach, we have applied our framework to generate parsers for the BLE protocol running on an Ubertooth One Microcontroller. We demonstrate that the generated FSMs are lightweight enough to be run on devices with very limited resources, and are easier to use for developers; we offer this method as a potential solution for the various bugs found in the implementation of the BLE firmware in the recent years.","PeriodicalId":334852,"journal":{"name":"2022 IEEE Security and Privacy Workshops (SPW)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129476328","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A Format-Aware Reducer for Scriptable Rewriting of PDF Files 用于PDF文件可脚本重写的格式感知减速器

2022 IEEE Security and Privacy Workshops (SPW) Pub Date : 2022-05-01 DOI: 10.1109/spw54247.2022.9833885

Prashant Anantharaman, Steven Cheung, Nicholas Boorman, M. Locasto

{"title":"A Format-Aware Reducer for Scriptable Rewriting of PDF Files","authors":"Prashant Anantharaman, Steven Cheung, Nicholas Boorman, M. Locasto","doi":"10.1109/spw54247.2022.9833885","DOIUrl":"https://doi.org/10.1109/spw54247.2022.9833885","url":null,"abstract":"Sanitizing untrusted input is a significant unsolved problem in defensive cybersecurity and input handling. Even if we assume that a safe, provably correct parser exists to validate the input syntax, processing logic may still require the application of certain transformations of the parser output. For example, parsers traditionally store the parsed objects in a generic tree structure; hence the processing logic needed to modify this structure can be significant. Also, popular parsing tools do not include the functionality to serialize (or unparse) the internal structure back to bytes.This paper argues for the need for a format-aware tool to modify structured files. In particular, we propose adding a reducer to the Parsley PDF checker. The Parsley Reducer— a tool to apply transformations on input dynamically—would allow developers to design and implement rules to transform PDF files. Next, we describe a set of Parsley normalization tools to be used with the Reducer API and showcase their capabilities using several case studies. Finally, we evaluate our normalization approach to demonstrate that (1) the developer effort to design our reducer rules is minimal, (2) tools extract more text from transformed files than the original files, and (3) other popular PDF transformation tools do not apply the corrections we demonstrate.","PeriodicalId":334852,"journal":{"name":"2022 IEEE Security and Privacy Workshops (SPW)","volume":"81 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127178895","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Research Report: Strengthening Weak Links in the PDF Trust Chain 研究报告:加强PDF信任链中的薄弱环节

2022 IEEE Security and Privacy Workshops (SPW) Pub Date : 2022-05-01 DOI: 10.1109/spw54247.2022.9833889

Mark Tullsen, William Harris, P. Wyatt

{"title":"Research Report: Strengthening Weak Links in the PDF Trust Chain","authors":"Mark Tullsen, William Harris, P. Wyatt","doi":"10.1109/spw54247.2022.9833889","DOIUrl":"https://doi.org/10.1109/spw54247.2022.9833889","url":null,"abstract":"In many practical and security-critical formats, the interpretation of a document segment as a Document Object Model (DOM) graph depends on a concept of reference and complex contextual data that binds references to data objects. Such referential context itself is defined discontinuously, and is often compressed, to satisfy practical constraints on usability and performance. The integrity of these references and their context must be ensured so that an unambiguous DOM graph is established from a basis of trust.This paper describes a case study of a critical instance of such a design, namely the construction of PDF cross-reference data, in the presence of potentially multiple incremental updates and multiple complex dialects expressing these references. Over the course of our case study, we found that the full definition of cross-reference data in PDF contains several subtleties that are interpreted differently by natural implementations, but which can nevertheless be formalized using monadic parsers with constructs for explicitly capturing and updating input streams.Producing our definition raised several issues in the PDF standard acknowledged and addressed by the PDF Association and the ISO. In the future, the definition can serve as a foundation for implementing novel format security analyses of DOM-defining formats.","PeriodicalId":334852,"journal":{"name":"2022 IEEE Security and Privacy Workshops (SPW)","volume":"53 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126659810","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Hack the Heap: Heap Layout Manipulation made Easy 破解堆:堆布局操作变得简单

2022 IEEE Security and Privacy Workshops (SPW) Pub Date : 2022-05-01 DOI: 10.1109/spw54247.2022.9833896

Jordy Gennissen, Dan O'Keeffe

{"title":"Hack the Heap: Heap Layout Manipulation made Easy","authors":"Jordy Gennissen, Dan O'Keeffe","doi":"10.1109/spw54247.2022.9833896","DOIUrl":"https://doi.org/10.1109/spw54247.2022.9833896","url":null,"abstract":"Heap layout manipulation — the act of changing the heap layout to the benefit of the attacker — is a key challenge when exploiting heap vulnerabilities. Heap layout manipulation is a hard problem even for experienced exploit developers, due to the complex ways in which even simple operations affect the layout of the heap. Furthermore, different allocators can produce vastly different heap layouts for a given set of operations, and understanding these internal implementation differences is extremely time-consuming and error-prone. Existing work either focuses only on specific types of applications, requires access to source code, or produces complex and opaque solutions needing additional reverse engineering work to complete exploits.In this work, we propose Hack the Heap: an online puzzle game that provides direct solutions to the heap layout manipulation problem. The game comes with an extensive tutorial to guide players on how to play, but requires no Computer Science knowledge. Hack the Heap also provides a toolchain to generate heap vulnerability puzzles from unmodified real-world applications. We were able to create and solve puzzles from 2 out of 3 CVEs, both of which reflected a real-world solution to the heap layout manipulation problem. Hack the Heap makes heap layout manipulation easier and hopefully more fun, without sacrificing important information needed for practical exploit development.","PeriodicalId":334852,"journal":{"name":"2022 IEEE Security and Privacy Workshops (SPW)","volume":"37 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123175210","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Towards Wireless Spiking of Smart Locks 迈向智能锁的无线峰值

2022 IEEE Security and Privacy Workshops (SPW) Pub Date : 2022-05-01 DOI: 10.1109/spw54247.2022.9833877

A. Mohammed, A. Singh, Gokce Dayanikli, Ryan M. Gerdes, M. Mina, Ming Li

{"title":"Towards Wireless Spiking of Smart Locks","authors":"A. Mohammed, A. Singh, Gokce Dayanikli, Ryan M. Gerdes, M. Mina, Ming Li","doi":"10.1109/spw54247.2022.9833877","DOIUrl":"https://doi.org/10.1109/spw54247.2022.9833877","url":null,"abstract":"The rapid growth of the Internet-of-Things (IoT) has made Smart Homes not only possible but popular in our society. While devices such as wireless security cameras, smart locks, etc. can be more convenient than their traditional counterparts, and may even lead to an increased sense of security, they may actually cause an increase in the attack surface of a home. For example, successful cyber attacks against these smart devices has been extensively documented in the literature. In contrast to existing work we discuss the vulnerabilities of these devices from a cyber-physical perspective; specifically, the threat posed by intentional electromagnetic interference (IEMI). In this paper, we present a methodology to carry out ‘wireless spiking’ attacks on smart lock devices that would allow an unauthenticated adversary to open a lock, without direct physical tampering, through the manipulation of its electrical control circuitry using IEMI. We demonstrate the proposed methodology—reverse engineering, identification of attack points, development of an attack vector, and design and transmission of attack signals—on a commercially popular smart lock. In doing so we lay the groundwork for wireless spiking attacks on smart locks, in general.","PeriodicalId":334852,"journal":{"name":"2022 IEEE Security and Privacy Workshops (SPW)","volume":"21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116686412","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Capturing the iccMAX calculatorElement: A Case Study on Format Design 捕获iccMAX计算元素:格式设计的案例研究

2022 IEEE Security and Privacy Workshops (SPW) Pub Date : 2022-05-01 DOI: 10.1109/spw54247.2022.9833859

Vijay H. Kothari, Prashant Anantharaman, Sean W. Smith, B. Hitaj, Prashanth Mundkur, N. Shankar, Letitia W. Li, Iavor S. Diatchki, William Harris

{"title":"Capturing the iccMAX calculatorElement: A Case Study on Format Design","authors":"Vijay H. Kothari, Prashant Anantharaman, Sean W. Smith, B. Hitaj, Prashanth Mundkur, N. Shankar, Letitia W. Li, Iavor S. Diatchki, William Harris","doi":"10.1109/spw54247.2022.9833859","DOIUrl":"https://doi.org/10.1109/spw54247.2022.9833859","url":null,"abstract":"ICC profiles are widely used to provide faithful digital color reproduction across a variety of devices, such as monitors, printers, and cameras. In this paper, we document our efforts on reviewing and identifying security issues with the calculatorElement description from the recent iccMAX specification (ICC.2:2019), which expands upon the ICC v4 specification (ICC.1:2010). The iccMAX calculatorElement, which captures a calculator function through a stack-based computational approach, was designed with security in mind. We analyzed the iccMAX calculatorElement using a variety of approaches that utilized: the proof assistant PVS, the theorem-proving language ACL2, the data description language DaeDaLus, and tools tied to the data description language Parsley. Bringing the tools of formal data description, theorem proving, and static analysis to a non-trivial real-world specification has shed light on both the tools and the specification. This exercise has led us to discover numerous bugs within the specification, to identify specification improvements, to identify flaws with a demo implementation, and to recognize ways that we can improve our own tools. Additionally, this particular case study has broader implications for those who work with specification, data description languages, and parsers. In this paper, we document our work on this exercise and relay our key findings.","PeriodicalId":334852,"journal":{"name":"2022 IEEE Security and Privacy Workshops (SPW)","volume":"47 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130126694","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Towards Improving the Deprecation Process of Web Features through Progressive Web Security 通过渐进式Web安全改进Web功能的弃用过程

2022 IEEE Security and Privacy Workshops (SPW) Pub Date : 2022-05-01 DOI: 10.1109/spw54247.2022.9833872

Tom van Goethem, W. Joosen

引用次数: 0

Certified Parsing of Dependent Regular Grammars 依赖规则语法的认证解析

2022 IEEE Security and Privacy Workshops (SPW) Pub Date : 2022-05-01 DOI: 10.1109/spw54247.2022.9833893

J. Sarracino, Gang Tan, Greg Morrisett

{"title":"Certified Parsing of Dependent Regular Grammars","authors":"J. Sarracino, Gang Tan, Greg Morrisett","doi":"10.1109/spw54247.2022.9833893","DOIUrl":"https://doi.org/10.1109/spw54247.2022.9833893","url":null,"abstract":"Parsers are ubiquitous, but formal reasoning about the behavior of a parser is challenging. One key challenge is parsing dependent formats, which are difficult for traditional techniques to handle because parse values can influence future parsing behavior. We present dependent regular grammars, which extend regular languages with data-dependency by generalizing concatenation to monadic bind. Even this small tweak adds significant expressive power; for example, conditional parsing and dependent repetition are both implementable using monadic bind.However, it is not obvious how to actually parse dependent regular grammars. We implement a Brzozowski derivative based matching algorithm, and we show how many popular parser combinator functions can be implemented in our library while retaining the same simplicity as traditional parser combinators.We implement and formalize these grammars in Coq, as well as a derivative-based matching algorithm. We prove soundness and completeness of the derivative operator in the standard way. We also implement a variety of popular parser combinator functions and give formal specifications to them. Finally, we implement as a case study a verified netstring parser, and prove functional correctness of the parser.","PeriodicalId":334852,"journal":{"name":"2022 IEEE Security and Privacy Workshops (SPW)","volume":"69 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121368519","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Ares: A System-Oriented Wargame Framework for Adversarial ML 战神:对抗机器学习的面向系统的战争游戏框架

2022 IEEE Security and Privacy Workshops (SPW) Pub Date : 2022-05-01 DOI: 10.1109/spw54247.2022.9833895

Farhan Ahmed, Pratik Vaishnavi, Kevin Eykholt, Amir Rahmati

{"title":"Ares: A System-Oriented Wargame Framework for Adversarial ML","authors":"Farhan Ahmed, Pratik Vaishnavi, Kevin Eykholt, Amir Rahmati","doi":"10.1109/spw54247.2022.9833895","DOIUrl":"https://doi.org/10.1109/spw54247.2022.9833895","url":null,"abstract":"Since the discovery of adversarial attacks against machine learning models nearly a decade ago, research on adversarial machine learning has rapidly evolved into an eternal war between defenders, who seek to increase the robustness of ML models against adversarial attacks, and adversaries, who seek to develop better attacks capable of weakening or defeating these defenses. This domain, however, has found little buy-in from ML practitioners, who are neither overtly concerned about these attacks affecting their systems in the real world nor are willing to trade off the accuracy of their models in pursuit of robustness against these attacks.In this paper, we motivate the design and implementation of Ares, an evaluation framework for adversarial ML that allows researchers to explore attacks and defenses in a realistic wargame-like environment. Ares frames the conflict between the attacker and defender as two agents in a reinforcement learning environment with opposing objectives. This allows the introduction of system-level evaluation metrics such as time to failure and evaluation of complex strategies such as moving target defenses. We provide the results of our initial exploration involving a white-box attacker against an adversarially trained defender.","PeriodicalId":334852,"journal":{"name":"2022 IEEE Security and Privacy Workshops (SPW)","volume":"23 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127212342","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3