SaTC: CORE: Medium: Securing WebAssembly using Static Analysis and Binary Instrumentation

WebAssembly是一种正在迅速普及的Web技术。它是2017年推出的一种低级字节码格式，最初是为浏览器中的计算密集型任务（如加密和游戏）而设计的。今天，正如所设想的那样，WebAssembly被所有现代浏览器支持，并被应用程序大量使用。最近，已经确定了WebAssembly二进制文件中的一些关键安全问题，这些问题没有适当的解决方案。该项目关注瓦西的开发，WASSY是一个新颖的系统和一套全面的工具，用于检测和减轻依赖WebAssembly的应用程序中的安全漏洞。瓦西将依赖于静态分析技术和二进制插装技术的组合，静态分析技术分析WebAssembly二进制文件而不执行它们，以检测可能的漏洞，二进制插装技术重写WebAssembly二进制文件以减轻潜在的漏洞。 开发的技术将在一套依赖于WebAssembly二进制文件并包含漏洞的应用程序上进行评估。这项研究将通过减少可被利用的漏洞数量，从而减少数据丢失的可能性以及相关的财务和法律的风险，使网络应用程序的用户受益。该项目的成果将通过科学场所的出版物和开放源码软件和数据集的发布进行传播。通过采用所开发的技术，网络软件安全性的改善将带来社会效益。开发的静态分析技术将被设计为适应WebAssembly特有的几个特征，例如基于堆栈的表示，缺乏名称和结构，缺乏类型信息，以及基于索引的线性内存和函数表访问。相应地，将开发一系列流不敏感、流敏感和上下文敏感的算法，使用适合于该领域的抽象，并设计为考虑与在主机环境中执行的JavaScript代码的交互。开发的二进制插装技术将被设计用于抵消依赖于WebAssembly二进制文件的Web应用程序中可能出现的漏洞，例如注入漏洞和跨站点脚本漏洞。为此，二进制插装将用于实现经典安全概念的适当变体，如堆栈金丝雀、内存分段和地址空间随机化。该奖项反映了NSF的法定使命，并通过使用基金会的智力价值和更广泛的影响审查标准进行评估，被认为值得支持。

WebAssembly is a web technology that has rapidly been gaining in popularity. It is a low-level bytecode format that was introduced in 2017, and was originally designed for computationally-intensive tasks in the browser such as cryptography and games. Today, as envisioned, WebAssembly is supported by all modern browsers, and heavily used by applications. Recently, a number of critical security concerns in WebAssembly binaries have been identified for which no adequate solutions exist. This project is concerned with the development of WASSY, a novel system and a comprehensive suite of tools for detecting and mitigating security vulnerabilities in applications that rely on WebAssembly. WASSY will rely on a combination of static analysis techniques, which analyze WebAssembly binaries without executing them, to detect likely vulnerabilities, and binary instrumentation techniques that rewrite a WebAssembly binary to mitigate potential vulnerabilities. The developed techniques will be evaluated on a suite of applications that rely on WebAssembly binaries and that contain vulnerabilities. The research will benefit users of web applications by reducing the number of vulnerabilities that can be exploited, thereby reducing the potential for loss of data, and associated financial and legal exposure. Results of the project will be disseminated via publications in scientific venues and through release of open-source software and data sets. Societal benefits will follow from improvements in web software security that is enabled by the adoption of the developed techniques. The developed static analysis techniques will be designed to accommodate several characteristics that are specific to WebAssembly such as its stack-based representation, lack of names and structure, lack of type information, and index-based access to linear memory and function tables. A family of flow-insensitive, flow-sensitive, and context-sensitive algorithms will be developed accordingly, using abstractions suitable to the domain, and designed to account for interaction with JavaScript code that executes in the host environment. The developed binary instrumentation techniques will be designed to counteract vulnerabilities that may arise in web applications that rely on WebAssembly binaries, such as injection vulnerabilities and cross-site scripting vulnerabilities. To this end, binary instrumentation will be used to implement suitable variations on classic security concepts such as stack canaries, memory segmentation, and address space randomization.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.