Abstract
This paper presents a methodology for the automated detection of buffer overflow vulnerabilities in executable software. Buffer overflow exploitation has been used by hackers to breach security or simply to crash computer systems. The mere presence inside the software code of a vulnerability that allows for buffer overflow exploitations presents a serious risk. So far, all methodologies devised to mitigate this problem assume source code availability or prior knowledge on vulnerable functions. Our methodology removes this dependency and allows the analysis of executable code without any knowledge about its internal structure. This independence is fundamental for relevant scenarios such as COTS selection during system integration (for which source code is usually not available), and the definition of attackloads for dependability benchmarking.
This is a preview of subscription content, log in via an institution to check access.
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
FrSIRT – French Security Incident Response Team, available online at, http://www.frsirt.com/exploits/ )
Eichin, M., Rochlis, J.: With microscope and tweezers: An analysis of the internet virus of November 1988. In: Proceedings of the 1989 IEEE Computer Society Symposium on Security and Privacy (1989)
Microsoft Security Bulletin MS04-028, Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution, available at http://www.microsoft.com/technet/security/bulletin/MS04-028.mspx
Chiueh, T., Hsu, F.: RAD: A Compile Time Solution for Buffer Overflow Attacks. In: Proceedings of the 21st IEEE International Conference on Distributed Computing Systems, ICDCS (April 2001)
Cowan, C., et al.: StackGuard: Automatic Detection and Prevention of Buffer-overrun Attacks. In: Proceedings of the 7th USENIX Security Symposium (January 1998)
Larochelle, D., Evans, D.: Statically Detecting Likely Buffer Overflow Vulnerabilities. In: Proceedings of the 2001 USENIX Security Symposium, Washington, D C, August 13-17 (2001)
Baratloo, A., Singh, N., Tsai, T.: Transparent Run-Time Defense Against Stack Smashing Attacks. In: Proceedings of the 2000 USENIX Annual Technical Conference, San Diego, California, USA, June 18-23 (2000)
Ghosh, A., O’Connor, T.: Analyzing Programs for Vulnerability to Buffer Overrun Attacks, Technical Report, Reliable Software Technologies (January 1998)
Joey (Nishad Herath): Advanced Windows NT Security, The Black Hat Briefings 2000, Singapore (April 2000)
Newsome, J., Song, D.: Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software. In: Proceedings of the 12th Annual Network and Distributed System Security Symposium – NDSS (February 2005)
Christodorescu, M., Jha, S.: Static Analysis of Executables to Detect Malicious Patterns. In: Proceedings of the 12th USENIX Security Symposium (August 2003)
Gillette, T.: A Unique Examination of the Buffer Overflow Condition., MsC Thesis, College of Engineering of the Florida Institute of Technology (2002)
One, A.: Smashing the stack for fun and profit. Phrack Magazine, 14–49 (1998)
Durães, J., Madeira, H.: Emulation of Software Faults by Educated Mutations at Machine-Code Level. In: Proceedings of the Thirteenth IEEE International Symposium on Software Reliability Engineering, ISSRE 2002, Annapolis MD, USA (November 2002)
Durães, J., Madeira, H.: Definition of Software Fault Emulation Operators: a Field Data Study. In: Proceedings of International Conference on Dependable Systems and Networks, DSN 2003, San Francisco (2003) (IEEE William Carter Award for the best student paper)
Koopman, P., et al.: Comparing Operating Systems using Robustness Benchmarks. In: Proceedings of the 16th International Symposium on Reliable Distributed Systems, SRDS-16 (1997)
Fabre, J.C., Rodríguez, M., Arlat, J., Salles, F., Sizun, J.M.: Bulding Dependable COTS Microkernel-based Systems using MAFALDA. In: Proceedings of the 2000 Pacific Rim International Symposium on Dependable Computing, PRDC 2000, pp. 85–92 (2000)
Brown, A., Patterson, D.: Towards availability benchmark: a case study of software RAID systems. In: Proceedings of 2000 USENIX Annual Technical Conference, San Diego, California, USA, June 18-23, pp. 263–276 (2000)
Kanoun, K., Arlat, J., Costa, D., Dal Cin, M., Gil, P., Laprie, J.-C., Madeira, H., Suri, N.: DBench: Dependability Benchmarking. In: Supplement of International Conference on Dependable Systems and Networks, DSN 2001, Göteborg, Sweden (2001)
Vieira, M., Madeira, H.: A Dependability Benchmark for OLTP Application Environments. In: 29th International Converence on Very Large Databases, VLDB 2003, Berlin, Germany, September 9-12 (2003)
Durães, J., Vieira, M., Madeira, H.: Dependability Benchmarking of Web-Servers. In: Heisel, M., Liggesmeyer, P., Wittmann, S. (eds.) SAFECOMP 2004. LNCS, vol. 3219, pp. 297–310. Springer, Heidelberg (2004)
Raymond, E.: The Cathedral and the Bazaar (1998), available at http://tuxedo.org/~esr/writings/cathedral-bazaar/
Anderson, R.: Security in Open versus Closed Systems – the dance of Boltzmann, coarse and moore. In: Proceedings of the Open Source Software Economics, Law and Policy, Toulouse, France, June 20-21 (2002), available at http://www.ftp.cl.cam.ac.uk/ftp/users/rja14/toulouse.pdf
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2005 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Durães, J., Madeira, H. (2005). A Methodology for the Automated Identification of Buffer Overflow Vulnerabilities in Executable Software Without Source-Code. In: Maziero, C.A., Gabriel Silva, J., Andrade, A.M.S., de Assis Silva, F.M. (eds) Dependable Computing. LADC 2005. Lecture Notes in Computer Science, vol 3747. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11572329_5
Download citation
DOI: https://doi.org/10.1007/11572329_5
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-29572-3
Online ISBN: 978-3-540-32092-0
eBook Packages: Computer ScienceComputer Science (R0)