Software Design for Success

Castro, Laura M.

doi:10.5772/intechopen.86538

Cited by 2 publications

(2 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Taint tracking can also be performed purely in software. Data flow integrity is a form of taint tracking that protects software against non-control data attacks by using reaching definitions analysis [11]. Pointer tainting [65] is another defense against non-control data attacks that taints user input and detects an attack when a tainted value is dereferenced as a pointer.…”

Section: Related Workmentioning

confidence: 99%

BliMe: Verifiably Secure Outsourced Computation with Hardware-Enforced Taint Tracking

ElAtali,

Gunn,

Liljestrand

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Outsourced computing is widely used today. However, current approaches for protecting client data in outsourced computing fall short: use of cryptographic techniques like fullyhomomorphic encryption incurs substantial costs, whereas use of hardware-assisted trusted execution environments has been shown to be vulnerable to run-time and side-channel attacks.We present Blinded Memory (BliMe), an architecture to realize efficient and secure outsourced computation. BliMe consists of a novel and minimal set of instruction set architecture (ISA) extensions implementing a taint-tracking policy to ensure the confidentiality of client data even in the presence of server vulnerabilities. To secure outsourced computation, the BliMe extensions can be used together with an attestable, fixed-function hardware security module (HSM) and an encryption engine that provides atomic decrypt-and-taint and encrypt-and-untaint operations. Clients rely on remote attestation and key agreement with the HSM to ensure that their data can be transferred securely to and from the encryption engine and will always be protected by BliMe's taint-tracking policy while at the server.We provide an RTL implementation BliMe-BOOM based on the BOOM RISC-V core. BliMe-BOOM requires no reduction in clock frequency relative to unmodified BOOM, and has minimal power (< 1.5%) and FPGA resource (≤ 9.0%) overheads. Various implementations of BliMe incur only moderate performance overhead (8-25%). We also provide a machine-checked security proof of a simplified model ISA with BliMe extensions.

show abstract

Section: Related Workmentioning

confidence: 99%

BliMe: Verifiably Secure Outsourced Computation with Hardware-Enforced Taint Tracking

ElAtali,

Gunn,

Liljestrand

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…We make this assumption because using infoleak to bypass KASLR is usually a prerequisite for kernel control-flow hijacking. Because automated kernel infoleak exploit generation itself is challenging enough, we assume the kernel does not employ any mitigation technique that regulates data-flow, such as data-flow integrity [11]. We leave such undeployed mitigation bypassing for future work.…”

Section: Overviewmentioning

confidence: 99%

K-LEAK: Towards Automating the Generation of Multi-Step Infoleak Exploits against the Linux Kernel

Liang,

Zou,

Song

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

The severity of information leak (infoleak for short) in OS kernels cannot be underestimated, and various exploitation techniques have been proposed to achieve infoleak in OS kernels. Among them, memory-error-based infoleak is powerful and widely used in real-world exploits. However, existing approaches to finding memory-error-based infoleak lack the systematic reasoning about its search space, and do not fully explore the search space. Consequently, they fail to exploit a large number of memory errors in the kernel. According to a theoretical modeling of memory errors, the actual search space of such approach is huge, as multiple steps could be involved in the exploitation process, and virtually any memory error can be exploited to achieve infoleak. To bridge the gap between the theory and reality, we propose a framework K-LEAK to facilitate generating memory-error-based infoleak exploits in the Linux kernel. K-LEAK considers infoleak exploit generation as a data-flow search problem. By modeling unintended data flows introduced by memory errors, and how existing memory errors can create new memory errors, K-LEAK can systematically search for infoleak data-flow paths in a multistep manner. We implement a prototype of K-LEAK and evaluate it with memory errors from syzbot and CVEs. The evaluation results demonstrate the effectiveness of K-LEAK in generating diverse infoleak exploits using various multi-step strategies.

show abstract

Software Design for Success

Cited by 2 publications

References 7 publications

BliMe: Verifiably Secure Outsourced Computation with Hardware-Enforced Taint Tracking

BliMe: Verifiably Secure Outsourced Computation with Hardware-Enforced Taint Tracking

K-LEAK: Towards Automating the Generation of Multi-Step Infoleak Exploits against the Linux Kernel

Contact Info

Product

Resources

About