TRIMMER: application specialization for code debloating

Sharif, Hashim; Abubakar, Muhammad; Gehani, Ashish; Zaffar, Fareed

doi:10.1145/3238147.3238160

Cited by 75 publications

(52 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As was the case with gadget set expressivity, negative side effects were observed in two scenarios. The negative side effects observed in our results are consistent with the negative side effects observed in CHISEL [22] and TRIMMER [4]. Since CARVE is easy to reconfigure and debloating is fast, it is well suited for mitigating these negative side effects using iterative debloating [22].…”

supporting

confidence: 87%

“…Aggressively debloating more complex network-based software (e.g. cUrl) with TRIMMER reduces code size by 21% on average [4]. CARVE outperforms TRIMMER on similar benchmarks, and performs comparably to CHISEL and TOSS when accounting for benchmark selection.…”

Section: Workhop Presentationmentioning

confidence: 99%

“…CARVE also performs comparably to CHISEL with respect to CVE elimination [3]. Finally, CARVE reduces gadget counts and introduces new gadgets at rates comparable to CHISEL and TRIMMER [22,4].…”

Section: Workhop Presentationmentioning

confidence: 99%

See 2 more Smart Citations

Carve

Brown

Pande

2019

Proceedings of the 3rd ACM Workshop on Forming an Ecosystem Around Software Transformation

View full text Add to dashboard Cite

Software debloating is an emerging field of study aimed at improving the security and performance of software by removing excess library code and features that are not needed by the end user (called bloat). Software bloat is pervasive, and several debloating techniques have been proposed to address this problem. While these techniques are effective at removing bloat, they are not practical for the average end user, risk creating unsound programs and introducing new vulnerabilities, and are not well suited for debloating complex software such as network protocol implementations. In this paper, we propose CARVE, a simple yet effective securityfocused debloating technique that addresses these shortcomings. CARVE employs static source code annotation to map software features to source code, eliminating the need for advanced software analysis during debloating and reducing the overall level of technical sophistication required by the end user. CARVE also introduces the concept of debloating with replacement, which is capable of removing software features while preserving software interoperability and mitigating the risk of creating an unsound program or introducing a vulnerability. We evaluate CARVE in 12 debloating scenarios and present our results demonstrating security and performance improvements that meet or exceed those of existing techniques. CCS CONCEPTS • Security and privacy ® Software security engineering;

show abstract

supporting

confidence: 87%

Section: Workhop Presentationmentioning

confidence: 99%

See 1 more Smart Citation

Carve

Brown

Pande

2019

Proceedings of the 3rd ACM Workshop on Forming an Ecosystem Around Software Transformation

View full text Add to dashboard Cite

show abstract

“…It needs the source code and a high-level specification of its functionalities to remove unwanted features with the help of delta debugging. A similar goal is pursued by Sharif et al [35] and their prototype implementation TRIMMER, a LLVM compiler extension. With the help of a user-provided manifest about the desired features, it tries to remove unwanted functionalities to debloat the application.…”

Section: Related Workmentioning

confidence: 93%

Towards Automated Application-Specific Software Stacks

Davidsson

Pawlowski

Holz

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Software complexity has increased over the years. One common way to tackle this complexity during development is to encapsulate features into a shared library. This allows developers to reuse already implemented features instead of reimplementing them over and over again. However, not all features provided by a shared library are actually used by an application. As a result, an application using shared libraries loads unused code into memory, which an attacker can use to perform code-reuse and similar types of attacks. The same holds for applications written in a scripting language such as PHP or Ruby: The interpreter typically offers much more functionality than is actually required by the application and hence provides a larger overall attack surface.In this paper, we tackle this problem and propose a first step towards automated application-specific software stacks. We present a compiler extension capable of removing unneeded code from shared libraries and-with the help of domain knowledgealso capable of removing unused functionalities from an interpreter's code base during the compilation process. Our evaluation against a diverse set of real-world applications, among others Nginx, Lighttpd, and the PHP interpreter, removes on average 71.3% of the code in musl-libc, a popular libc implementation. The evaluation on web applications show that a tailored PHP interpreter can mitigate entire vulnerability classes, as is the case for OpenConf. We demonstrate the applicability of our debloating approach by creating an application-specific software stack for a Wordpress web application: we tailor the libc library to the Nginx web server and PHP interpreter, whereas the PHP interpreter is tailored to the Wordpress web application. In this real-world scenario, the code of the libc is decreased by 65.1% in total, thereby reducing the available code for code-reuse attacks.

show abstract

“…Though largely beneficial, this has led to unchecked bloat issues that are especially severe for modern object-oriented applications due to their excessive use of indirection, abstraction, and ease of extensibility. This problem of customizing and tailoring modern applications to only used components, in an automated fashion, is a long standing problem [27,34,45,46,52,59,61,63,67].…”

Section: Introductionmentioning

confidence: 99%

JShrink: in-depth investigation into debloating modern Java applications

Bruce

Zhang

Arora

et al. 2020

Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Softw

View full text Add to dashboard Cite

Modern software is bloated. Demand for new functionality has led developers to include more and more features, many of which become unneeded or unused as software evolves. This phenomenon, known as software bloat, results in software consuming more resources than it otherwise needs to. How to effectively and automatically debloat software is a long-standing problem in software engineering. Various debloating techniques have been proposed since the late 1990s. However, many of these techniques are built upon pure static analysis and have yet to be extended and evaluated in the context of modern Java applications where dynamic language features are prevalent. To this end, we develop an end-to-end bytecode debloating framework called JShrink. It augments traditional static reachability analysis with dynamic profiling and type dependency analysis and renovates existing bytecode transformations to account for new language features in modern Java. We highlight several nuanced technical challenges that must be handled properly and examine behavior preservation of debloated software via regression testing. We find that (1) JShrink is able to debloat our real-world Java benchmark suite by up to 47% (14% on average); (2) accounting for dynamic language features is indeed crucial to ensure behavior preservationÐreducing 98% of test failures incurred by a purely static equivalent, Jax, and 84% for ProGuard; and (3) compared with purely dynamic approaches, integrating static analysis with dynamic profiling makes the debloated software more robust to unseen test executionsÐin 22 out of 26 projects, the debloated software ran successfully under new tests.

show abstract

TRIMMER: application specialization for code debloating

Cited by 75 publications

References 33 publications

Carve

Carve

Towards Automated Application-Specific Software Stacks

JShrink: in-depth investigation into debloating modern Java applications

Contact Info

Product

Resources

About