CAREER: Principled and Practical Software Shielding against Advanced Exploits

职业：针对高级漏洞的有原则且实用的软件防护

• 批准号: 1749895
• 负责人: Michail Polychronakis
• 金额: $ 49.99万
• 依托单位: SUNY at Stony Brook
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2018
• 资助国家: 美国
• 起止时间: 2018-06-01 至 2024-11-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1749895&HistoricalAwards=false
• 关键词: CAREER; Principled; Practical; Software; Shielding

The exploitation of memory corruption vulnerabilities in popular software is among the leading causes of system compromise and malware infection. While there are several reasons behind this proliferation of exploitable bugs, the reliance on unsafe programming languages such as C and C++ and the complexity of modern software play a major role. The continuous discovery of previously unknown (zero-day) vulnerabilities in browsers, document viewers, and other widely used software, and the lack of effective defenses against recent exploitation techniques that leverage memory disclosure vulnerabilities, necessitate the development of additional defense mechanisms.The main objective of this project is the design of software shielding techniques and their practical applicability to commodity software and systems. The key innovative aspects of the investigated techniques include: i) principled design that considers the strong adversarial models imposed by the latest exploitation advancements, i.e., disclosure-aided exploitation and data-only attacks, against which effective countermeasures remain an open problem; ii) novel code specialization and data protection techniques, to introduce process-level unpredictability and limit the exposure of critical data; iii) hardware-assisted implementation by leveraging recent and upcoming processor features to minimize the performance impact of the applied protections; and iv) focus on practical considerations, such as operational compatibility and non-disruptive deployment. The outcomes of this research effort are expected to improve the state of the art in defenses against advanced exploits, and achieve substantial practical impact by shielding existing vulnerable applications against exploitation, benefiting both end users and security researchers. The project also provides students the opportunity to conduct research in cybersecurity, and fosters the integration of cybersecurity into high school education through hands-on workshops for students and seminars for science teachers.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

利用流行软件中的内存损坏漏洞是系统受损和恶意软件感染的主要原因之一。虽然这种可利用的错误的扩散背后有几个原因，但对不安全的编程语言（如C和C++）的依赖以及现代软件的复杂性起着重要作用。在浏览器、文档浏览器和其他广泛使用的软件中不断发现以前未知的（零日）漏洞，以及缺乏针对利用内存泄漏漏洞的最新利用技术的有效防御，需要开发额外的防御机制。本项目的主要目标是设计软件屏蔽技术及其在商品软件和系统中的实用性。所研究技术的关键创新方面包括：i）考虑最新开发进步所施加的强对抗模型的原则性设计，即，安全辅助的利用和仅数据攻击，有效的对策仍然是一个悬而未决的问题; ii）新的代码专门化和数据保护技术，以引入进程级的不可预测性并限制关键数据的暴露; iii）通过利用最近和即将推出的处理器功能来最大限度地减少所应用的保护对性能的影响的硬件辅助实现;以及iv）注重实际考虑，例如操作兼容性和无中断部署。这项研究工作的成果预计将提高对先进漏洞利用的防御能力，并通过保护现有易受攻击的应用程序免受攻击，从而使最终用户和安全研究人员受益，从而实现实质性的实际影响。该项目还为学生提供进行网络安全研究的机会，并通过为学生举办的实践讲习班和为科学教师举办的研讨会，促进网络安全融入高中教育。该奖项反映了NSF的法定使命，并通过使用基金会的智力价值和更广泛的影响审查标准进行评估，被认为值得支持。

项目成果

The SEVerESt Of Them All: Inference Attacks Against Secure Virtual Enclaves

• DOI: 10.1145/3321705.3329820
• 发表时间: 2019-07
• 期刊: Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security
• 作者: Jan Werner;Joshua Mason;M. Antonakakis;M. Polychronakis;F. Monrose

Temporal System Call Specialization for Attack Surface Reduction

• 发表时间: 2020
• 作者: Seyedhamed Ghavamnia;Tapti Palit;Shachee Mishra;M. Polychronakis

Confine: Automated System Call Policy Generation for Container Attack Surface Reduction

• 发表时间: 2020
• 作者: Seyedhamed Ghavamnia;Tapti Palit;Azzedine Benameur;M. Polychronakis

C2C: Fine-grained Configuration-driven System Call Filtering

• DOI: 10.1145/3548606.3559366
• 发表时间: 2022-11
• 期刊: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security
• 作者: Seyedhamed Ghavamnia;Tapti Palit;M. Polychronakis

Decap: Deprivileging Programs by Reducing Their Capabilities

Decap：通过降低程序的能力来剥夺程序的特权

• DOI: 10.1145/3545948.3545978
• 发表时间: 2022
• 期刊: Intrusions and Defenses (RAID
• 作者: Hasan, Md Mehedi;Ghavamnia, Seyedhamed;Polychronakis, Michalis
• 通讯作者: Polychronakis, Michalis