Tools and trade-offs for security adaptation

点击翻译按钮获取中文摘要

From Web browsers to industrial control systems, software is increasingly subject to attacks it was not designed to defend against. As the complexity of application requirements increases, developers incorporate modules with different provenance from their own code into hostile, Internet-connected environments, introducing new attack vectors into widely-deployed systems. For instance, the open-source FFmpeg project allows users to manipulate and convert various formats of audio/video content. Users have trusted FFmpeg on their own computers for years, but when integrated into the Chrome Web browser and exposed to arbitrary content on the Internet, over a thousand previously-undetected security vulnerabilities were brought to light. Industrial control systems (ICSs) incorporate third-party software to provide modern functionality such as Web interfaces, but this software can introduce security vulnerabilities such as Heartbleed. The risks introduced by software composition cannot be simply eliminated by purging all untrustworthy code. First, much “risky” code — such as media codecs in Web browsers — provides essential functionality and cannot be expunged, so re-writing would be required (causing extreme duplication of effort). Second, re-writing software may itself introduce vulnerabilities: a performant codec requires low-level, inherently risky code, so a new version might simply introduce different vulnerabilities than the first. For this reason, the US Department of Homeland Security advises ICS vendors to employ third-party Web servers rather than write their own: the third parties are better at sanitizing network inputs. Modern operating systems, programming languages and — increasingly — processors provide us with tools for securing software, but most existing software cannot benefit from them without substantial re-writing. Since we have determined that we cannot purge or re-write this software, we must instead adapt it. This research program will develop tools and technique for adapting existing software to use new security features. The goal is to turn current asymmetries on their heads: whereas today a minority of applications are protected, we will seek to enable the majority to use modern security features to protect users. This will give defenders, rather than attackers, the position of natural superiority and give users a chance at protecting their data well by default.