QFuzz: quantitative fuzzing for side channels
QFuzz: quantitative fuzzing for side channels
复制标题
QFuzz：侧通道的定量模糊测试
DOI：
10.1145/3460319.3464817
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
Saeid Tizpaz
中科院分区：
文献类型：
--
作者：
Yannic Noller;Saeid Tizpaz
侧信道对软件系统的保密性构成重大威胁。这些漏洞很难检测和评估，因为它们来自软件的非功能属性，比如执行时间，并且需要对多个执行跟踪进行推理。最近，非干扰概念被应用于静态分析、符号执行和灰盒模糊技术中。然而，不干涉是一个严格的概念，即使信息泄漏的强度很弱，也可能拒绝安全性。安全的定量概念允许放松不干扰，并容忍小的（不可避免的）泄漏。尽管近年来取得了进展，但现有的定量方法在实践中存在可扩展性限制。在这项工作中，我们提出了QFuzz，一种灰盒模糊技术，用于定量评估侧边信道的强度，重点是最小熵。最小熵是一种基于可区分观察值（分区）数量的度量，用于评估攻击者试图一次性泄露机密所造成的威胁。我们开发了一种新的灰盒模糊，配备了两种分区算法，试图最大化可区分的观测值的数量和它们之间的成本差异。我们在现有工作和实际库（总共有70个主题）的大量基准上评估QFuzz。QFuzz优于三种最先进的检测技术。QFuzz提供了有关泄漏的定量信息，这些泄漏超出了所有三种技术的能力。至关重要的是，我们将QFuzz与最先进的量化工具进行了比较，发现QFuzz在保持类似精度的同时，在可扩展性方面明显优于该工具。总的来说，我们发现我们的方法适用于现实世界的应用程序，并为评估产生的威胁提供了有用的信息。此外，QFuzz还在一个安全关键的Java库中识别了一个零日侧通道漏洞，该漏洞已被开发人员确认并修复。
Side channels pose a significant threat to the confidentiality of software systems. Such vulnerabilities are challenging to detect and evaluate because they arise from non-functional properties of software such as execution times and require reasoning on multiple execution traces. Recently, noninterference notions have been adapted in static analysis, symbolic execution, and greybox fuzzing techniques. However, noninterference is a strict notion and may reject security even if the strength of information leaks are weak. A quantitative notion of security allows for the relaxation of noninterference and tolerates small (unavoidable) leaks. Despite progress in recent years, the existing quantitative approaches have scalability limitations in practice. In this work, we present QFuzz, a greybox fuzzing technique to quantitatively evaluate the strength of side channels with a focus on min entropy. Min entropy is a measure based on the number of distinguishable observations (partitions) to assess the resulting threat from an attacker who tries to compromise secrets in one try. We develop a novel greybox fuzzing equipped with two partitioning algorithms that try to maximize the number of distinguishable observations and the cost differences between them. We evaluate QFuzz on a large set of benchmarks from existing work and real-world libraries (with a total of 70 subjects). QFuzz compares favorably to three state-of-the-art detection techniques. QFuzz provides quantitative information about leaks beyond the capabilities of all three techniques. Crucially, we compare QFuzz to a state-of-the-art quantification tool and find that QFuzz significantly outperforms the tool in scalability while maintaining similar precision. Overall, we find that our approach scales well for real-world applications and provides useful information to evaluate resulting threats. Additionally, QFuzz identifies a zero-day side-channel vulnerability in a security critical Java library that has since been confirmed and fixed by the developers.
DOI：
10.1109/csf.2016.34
发表时间：
2016-08
期刊：
2016 IEEE 29th Computer Security Foundations Symposium (CSF)
影响因子：
--
作者：
C. Păsăreanu;Quoc-Sang Phan;P. Malacaria
通讯作者：
C. Păsăreanu;Quoc-Sang Phan;P. Malacaria