SaTC: CORE: Medium: Securing WebAssembly using Static Analysis and Binary Instrumentation

WebAssembly是一种迅速流行起来的web技术。它是一种低级字节码格式，于2017年推出，最初是为加密和游戏等浏览器中的计算密集型任务而设计的。今天，正如预期的那样，WebAssembly被所有现代浏览器支持，并被应用程序大量使用。最近，WebAssembly二进制文件中的一些关键安全问题已经被识别出来，而目前还没有合适的解决方案。该项目涉及WASSY的开发，这是一个用于检测和减轻依赖WebAssembly的应用程序中的安全漏洞的新系统和一套全面的工具。WASSY将依赖于静态分析技术的组合，静态分析技术分析WebAssembly二进制文件而不执行它们，以检测可能的漏洞，而二进制检测技术重写WebAssembly二进制文件以减轻潜在的漏洞。开发的技术将在一套依赖WebAssembly二进制文件并包含漏洞的应用程序上进行评估。该研究将通过减少可被利用的漏洞数量，从而减少数据丢失的可能性，以及相关的财务和法律风险，从而使web应用程序的用户受益。该项目的结果将通过科学场所的出版物和开放源码软件和数据集的发布来传播。通过采用已开发的技术，web软件安全性的改进将带来社会效益。开发的静态分析技术将被设计成适应WebAssembly特有的几个特征，比如基于堆栈的表示、缺少名称和结构、缺少类型信息以及对线性内存和函数表的基于索引的访问。将相应地开发一系列流不敏感、流敏感和上下文敏感的算法，使用适合该领域的抽象，并设计用于与在主机环境中执行的JavaScript代码进行交互。开发的二进制检测技术将被设计用来抵消依赖WebAssembly二进制文件的web应用程序中可能出现的漏洞，例如注入漏洞和跨站点脚本漏洞。为此，二进制插装将用于实现经典安全概念（如堆栈金丝雀、内存分段和地址空间随机化）的适当变体。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

WebAssembly is a web technology that has rapidly been gaining in popularity. It is a low-level bytecode format that was introduced in 2017, and was originally designed for computationally-intensive tasks in the browser such as cryptography and games. Today, as envisioned, WebAssembly is supported by all modern browsers, and heavily used by applications. Recently, a number of critical security concerns in WebAssembly binaries have been identified for which no adequate solutions exist. This project is concerned with the development of WASSY, a novel system and a comprehensive suite of tools for detecting and mitigating security vulnerabilities in applications that rely on WebAssembly. WASSY will rely on a combination of static analysis techniques, which analyze WebAssembly binaries without executing them, to detect likely vulnerabilities, and binary instrumentation techniques that rewrite a WebAssembly binary to mitigate potential vulnerabilities. The developed techniques will be evaluated on a suite of applications that rely on WebAssembly binaries and that contain vulnerabilities. The research will benefit users of web applications by reducing the number of vulnerabilities that can be exploited, thereby reducing the potential for loss of data, and associated financial and legal exposure. Results of the project will be disseminated via publications in scientific venues and through release of open-source software and data sets. Societal benefits will follow from improvements in web software security that is enabled by the adoption of the developed techniques. The developed static analysis techniques will be designed to accommodate several characteristics that are specific to WebAssembly such as its stack-based representation, lack of names and structure, lack of type information, and index-based access to linear memory and function tables. A family of flow-insensitive, flow-sensitive, and context-sensitive algorithms will be developed accordingly, using abstractions suitable to the domain, and designed to account for interaction with JavaScript code that executes in the host environment. The developed binary instrumentation techniques will be designed to counteract vulnerabilities that may arise in web applications that rely on WebAssembly binaries, such as injection vulnerabilities and cross-site scripting vulnerabilities. To this end, binary instrumentation will be used to implement suitable variations on classic security concepts such as stack canaries, memory segmentation, and address space randomization.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.