SaTC: CORE: Medium: Securing WebAssembly using Static Analysis and Binary Instrumentation

WebAssembly是一种迅速流行的Web技术。它是一种低级字节码格式，于2017年推出，最初设计用于浏览器中的计算密集型任务，如密码学和游戏。今天，正如设想的那样，所有现代浏览器都支持WebAssembly，并且应用程序大量使用WebAssembly。最近，在WebAssembly二进制文件中发现了一些严重的安全问题，但没有足够的解决方案。该项目涉及Wassy的开发，Wassy是一种新颖的系统和一套全面的工具，用于检测和缓解依赖WebAssembly的应用程序中的安全漏洞。Wassy将依赖静态分析技术和二进制工具技术的组合，静态分析技术分析WebAssembly二进制文件而不执行它们，以检测可能的漏洞，二进制工具技术重写WebAssembly二进制文件以缓解潜在的漏洞。开发的技术将在一套依赖于WebAssembly二进制文件并包含漏洞的应用程序上进行评估。这项研究将减少可利用的漏洞数量，从而减少数据丢失的可能性以及相关的财务和法律风险，从而使网络应用程序的用户受益。该项目的成果将通过科学场所的出版物以及开放源码软件和数据集的发布来传播。通过采用已开发的技术，网络软件安全性得到改善，将带来社会效益。开发的静态分析技术将被设计为适应WebAssembly特有的几个特征，如基于堆栈的表示、缺乏名称和结构、缺乏类型信息以及对线性内存和函数表的基于索引的访问。将相应地开发一系列流不敏感、流敏感和上下文敏感的算法，使用适合于域的抽象，并设计为考虑与在宿主环境中执行的Java代码的交互。开发的二进制指令插入技术将旨在抵消依赖WebAssembly二进制程序的Web应用程序中可能出现的漏洞，如注入漏洞和跨站点脚本漏洞。为此，将使用二进制工具来实现对经典安全概念的适当变化，如堆栈金丝雀、内存分段和地址空间随机化。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

WebAssembly is a web technology that has rapidly been gaining in popularity. It is a low-level bytecode format that was introduced in 2017, and was originally designed for computationally-intensive tasks in the browser such as cryptography and games. Today, as envisioned, WebAssembly is supported by all modern browsers, and heavily used by applications. Recently, a number of critical security concerns in WebAssembly binaries have been identified for which no adequate solutions exist. This project is concerned with the development of WASSY, a novel system and a comprehensive suite of tools for detecting and mitigating security vulnerabilities in applications that rely on WebAssembly. WASSY will rely on a combination of static analysis techniques, which analyze WebAssembly binaries without executing them, to detect likely vulnerabilities, and binary instrumentation techniques that rewrite a WebAssembly binary to mitigate potential vulnerabilities. The developed techniques will be evaluated on a suite of applications that rely on WebAssembly binaries and that contain vulnerabilities. The research will benefit users of web applications by reducing the number of vulnerabilities that can be exploited, thereby reducing the potential for loss of data, and associated financial and legal exposure. Results of the project will be disseminated via publications in scientific venues and through release of open-source software and data sets. Societal benefits will follow from improvements in web software security that is enabled by the adoption of the developed techniques. The developed static analysis techniques will be designed to accommodate several characteristics that are specific to WebAssembly such as its stack-based representation, lack of names and structure, lack of type information, and index-based access to linear memory and function tables. A family of flow-insensitive, flow-sensitive, and context-sensitive algorithms will be developed accordingly, using abstractions suitable to the domain, and designed to account for interaction with JavaScript code that executes in the host environment. The developed binary instrumentation techniques will be designed to counteract vulnerabilities that may arise in web applications that rely on WebAssembly binaries, such as injection vulnerabilities and cross-site scripting vulnerabilities. To this end, binary instrumentation will be used to implement suitable variations on classic security concepts such as stack canaries, memory segmentation, and address space randomization.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.