We have been doing a survey on published research papers which is trying to detect security vulnerabilities in programs or applications using dynamic analysis. Our work is mainly focused on mainly four domains – desktop based binary applications, Android applications, embedded or firmware binaries and web related scripting language based applications. This blog post is a high level overview of our upcoming survey paper.

Before going to the details of our findings, we would like to discuss some of the questions which we had in our mind when we started this project

• When is a bug a security vulnerability?

A defect in a program which causes the violation of at least one of the basic goals of security – confidentiality, integrity and availability (CIA).

• What is an exploit?

A piece of code, application or the input that takes the advantage of a security bug present in the vulnerable program to gain some information or cause some abnormality in its behavior.

• How do we differentiate static and dynamic analysis?

Static analysis evaluates code without executing it while dynamic analysis tests the behavior of code during execution. Dynamic analysis enables monitoring of the code during the program execution.

• Which all are the dynamic analysis techniques we are going to survey?

We are surveying the following techniques:

Dynamic taint analysis  runs a  program and  observes which  computations are  affected by predefined  taint sources such as user  input.

Symbolic  execution  automatically  builds a logical formula describing a program execution path, which reduces the problem of reasoning about the execution to the domain of  logic.

Concolic testing uses symbolic execution in conjunction with an automated theorem proving or constraint solver to generate concrete inputs with the aim of maximizing code in-order to find new bugs. It is also known as hybrid testing.

Fuzzing involves generation of various – expected, unexpected and random inputs to the program to observe its behavior – mainly crash.

Guided fuzzing uses fuzzing in conjunction with symbolic execution or concolic testing or dynamic taint analysis with an aim to improve the efficiency in finding crashes in the program under testing

• • Which are the various vulnerabilities commonly discovered using these analysis

The tabular form of our findings:

This is the link to the mindmap version of the table: http://app.mindmapmaker.org/#m:mmc88ebaf011214664b5ccbf67cc6179b7. Once the diagram is loaded, you can click on the techniques to expand the papers published under that domain.

The aforementioned mindmap diagram is a visual representation of the hierarchical information of our findings.  The central idea of our survey is the vulnerability detection using dynamic analysis.  As mentioned earlier, we have only considered 4 domains: binary, web/scripting, embedded/firmware and Android, mainly because these are the main areas where some significant amount of work is done in finding vulnerabilities. Each domain is further branched to various sub-branched based on various dynamic analysis techniques.

The pink colour nodes in the diagram represent a publication. It is usually the framework developed by the publishers or the title of the research paper to detect vulnerability using the dynamic analysis technique class mentioned in the parent node.  The publication node is always branched into two 1) outcome and 2) framework.

Outcome describes the type of vulnerabilities they were able to discover using their approach and sometimes their system may generate exploit scripts automatically. In most cases, the exploit scripts are generated for:

1. Return-to-libc attack: when there is a buffer overflow vulnerability and the stack is WX protected, the processor will refuse to execute code at certain memory locations where program can write, failing to execute the user loaded shellcode in the stack. The attacker can circumvent this protection by combing the address of the system calls code (libc) present in memory which is executable.
2. Return oriented programming is an advanced version of stack-smashing attack where the attacker gains the control over the call stack and uses the sequence of machine code already present in the memory to change the control-flow to perform arbitrary operations.

The sub branches of the framework describes the details of :

• The novel path prioritization techniques introduced in the paper in-order to reduce the search space. It could be for avoiding loops and path explosion, target code blocks which  are more likely to be vulnerable due to the presence of system calls etc.
• The reuse or modification of any existing tools like concolic testing or symbolic execution frameworks, fuzzers, constraint solvers, automatic theorem solvers, previously published approaches etc
• Inputs from the static analysis techniques to construct call graph, extract plausible vulnerable components using data flow analysis etc
• Test execution environment: whether the application is run on embedded/mobile hardware directly or on emulator
• Vulnerability analysis module to verify whether the critical exceptions or program crash can be classified as a true positive
• Exploit development module in the framework

This is a high level overview of our ongoing work, stay tuned for the comprehensive study of the survey on vulnerability detection using dynamic analysis.

References