Amid growing concerns over data privacy in web and mobile applications, this study aims to assess the privacy mechanisms in Instant Games on Facebook - a platform with approximately 3.03 billion monthly active users and a substantial repository of personal data. Instant Games have become increasingly popular due to their ease of access and social integration features. Investigating these games can provide insights into privacy mechanisms and practices, thereby informing the development of more fair, compliant and user privacy-centric gaming experiences. Thus, this paper proposes an integrated analytical framework that leverages a combination of descriptive, memory, and network analysis techniques to examine the privacy mechanisms in Facebook Instant Games. It focuses on evaluating the permission model, default settings, configurations, and API usage, as well as their impact on user data access, transfer, and sharing. Our findings uncovers discrepancies between privacy policies and actual user data notices. Through generalized settings and lack of explicit consent mechanism, our study reveals a system that often favors functionality over user privacy. Moreover, we highlight the reliance on powerful APIs that, while enhancing gameplay, pose additional privacy risks by granting broad data access to third-party services without direct user approval.
As threat modeling involves the architecture-centric identification, analysis and mitigation of security threats, it is considered an essential activity of the secure development lifecycle (SDLC). Threat modeling outcomes are used to guide the mitigation and risk management process, and to determine areas of focus in later development stages (e.g., testing and verification). Traditional threat modeling methods and techniques are driven by human experts and stakeholders and mainly conducted manually. Recently, focus has shifted towards automating (parts of) the process through improved tool support. In this paper, we evaluate the extent to which this trend also leads to easier development pipeline integration of threat modeling tools, i.e. whether this also enables conducting threat model-centric analysis within continuous integration and development (CI/CD) build pipelines so that they can contribute to the overall development-centric quality assurance process (SecDevOps). We first articulate the key requirements for threat modeling tools to be compatible or suited for CI/CD, and then we systematically evaluate and compare seven automated threat modeling tools against these requirements. Finally, we provide recommendations towards making threat analysis tools and enablers both more suitable for integration in a CI/CD context and hence, more compatible to modern software engineering processes.
Object detection stands as a fundamental component in numerous real-world applications, ranging from autonomous vehicles to security systems. As these technologies become increasingly embedded in our daily lives, ensuring the security and resilience of object detection models becomes critically essential. However, these models are vulnerable to adversarial attacks, where subtle alterations intentionally introduced into input data can mislead the model’s predictions. This paper explores the susceptibility of YOLO V8 and TensorFlow Object Detection models, such as MobileNet and ResNet, to adversarial attacks using the concept of attack transferability. Utilizing the Fast Gradient Sign Method alongside a distinct classifier model, we generate adversarial examples and evaluate the impact on object detection systems. Our analysis exposes a significant decline in object detection model’s performance in the presence of these adversarial examples, illustrating the transferability of attacks across different models. Our findings emphasize the critical necessity for robust defenses to safeguard object detection systems against transferable adversarial attacks.
Infrastructure-as-Code (IaC) is the practice of provisioning and managing cloud resources using machine-readable code. IaC is seeing increased adoption because it enhances transparency and reliability of infrastructure operations. However, as any software code, IaC can also contain misconfigurations, which can lead to insecure infrastructure, which may result in data breaches. Existing IaC scanning tools are able to detect common misconfigurations in IaC but they require IaC developers to manually repair the code. Recent advances in Large Language Models (LLMs) have led to promising results in applying LLMs to Automatic Program Repair (APR) tasks for code written in different languages. In this work, we propose an LLM-based approach to fix misconfigurations in IaC code. After misconfigurations in IaC code are identified by scanning tools, we feed the LLMs with the IaC code, details about the misconfigurations, and additional context provided by a human-in-the-loop and prompt the LLM to generate the repaired IaC code. We tested our approach on several vulnerable IaC repositories and found that the GPT-4 model from OpenAI suggests fixes that reduce up to 84.7% of the misconfiguration alarms produced by the scanners and our two-pass solution significantly improves the performance over a one-pass only approach. However, of the fixes suggested, we manually determined that only 79.6% actually solve the problem, while the remaining 20.4% are hallucinated fixes. Specifically, LLM hallucinations in the generated outputs pass checks for misconfigurations but fail other syntax and schema validation checks or do not address the underlying security issue. We propose a few potential approaches to tackle this challenge.
Package managers and public repositories such as npm streamline the distribution and maintenance of open source code. At the same time, they have become attractive targets for malicious actors to spread malware to many potential victims. In malware campaigns, families of malicious JavaScript packages exhibit common malicious behavior but differ in their names and syntactic details. We propose to thwart malware campaigns by developing semantic specifications to match similar malware with a single behavioral signature. Specifically, we report on our experience in using CodeQL to describe malicious behavior in JavaScript code, which allows us to employ an existing and mature static analysis framework as a robust building block. We describe a methodology and tool set for developing queries for newly reported and previously undetected malware, so that a single report can be used to take down entire families of similar malware. Applying our approach, we were able to discover 125 previously unreported malicious packages, which we reported and had removed from npm, without producing a single false alarm. As a result, we find that the upfront investment of developing semantic signatures in comparison to automatically learning classifiers pays off with the increased reliability of results by saving on manual effort for validation and relabeling.
The NAND Use Case provides challenge problems to researchers developing new techniques for recovering intended application-specific security properties from legacy software, modeling them in terms of application-specific abstractions, and reasoning about correctness with respect to those properties.
With the growing prevalence of Internet of Things (IoT) devices, IoT cloud platforms have become increasingly vital in the ecosystem that allows heterogeneous IoT devices to be accessed and managed by a wide range of IoT applications. IoT applications are typically hosted on dedicated application servers within the cloud platforms and offer intelligent automation, control, and management features for all connected IoT devices. However, we found that IoT devices can be attacked if the development environment is compromised. In this paper, we conduct the first systematic study on the security risks of IoT cloud platforms that are introduced by compromised development environments. We discover three novel attacks that can invoke commands on the IoT devices, initiate malicious IoT firmware update, and get access to the IoT devices through secure tunneling. We confirm the feasibility of these attacks on mainstream commercial IoT cloud platforms, including Azure IoT Hub, AWS IoT Core, Samsung SmartThings, IBM Watson IoT, and Google IoT, demonstrating their potential to impact a large number of devices. Our work leads to the creation of CVE-2023-38372 by IBM.
During the 1970s, a curious class of programs called data-oblivious algorithms started to catch the attention of researchers because of the numerous applications they enabled due to their unique properties. In particular, data-oblivious algorithms execute independently from their input data. In the context of secure applications, data-oblivious algorithms prevent an attacker from learning information about the data an algorithm is processing by observing that algorithm’s execution. However, programmers often avoid these algorithms because they require a highly stylized form of programming, resulting in a potentially error-prone design and implementation process. In addition, data-oblivious programs are often less efficient than their native counterparts due to their inability to employ data-dependent heuristics. To address these potential problems and facilitate the adoption of data-oblivious programming, we present Octal, a tool that automates the design and implementation of data-oblivious programs. Octal streamlines the development of data-oblivious algorithms by automating data-oblivious transformations into the compiler. Moreover, Octal facilitates the development of efficient data-oblivious algorithms using a guided transformation mechanism that effectively navigates the algorithm design space.We evaluate Octal’s ability to transform native workloads from the VIP-Bench benchmark suite and show that Octal reduces the lines of programmer-written code by an average of 19.5%, compared to manual conversion. Using case studies, we demonstrate how Octal’s guided transformations can optimize an inefficient data-oblivious algorithm. Further, we use Channelizer, a side-channel validation tool, to show that Octal-generated code contains no program-level side channels. By automating data-oblivious transformation and providing guidance on program performance, Octal can aid programmers in developing more secure and efficient programs.
With the adoption of compelling legislation regulating Product Security, quickly replicating or disproving the presence of publicly known vulnerabilities is becoming an essential part of the software life cycle. Moreover, third-party code is often integrated and shipped in binary form rather than source code. In this article, we present an original debugger named the Witchcraft Shell (WSH), aiming at helping software maintainers validate the existence of public vulnerabilities when source code is unavailable. By making C/C++ dynamically linked ELF executables scriptable and their internal functions callable with no or little context, we open the way to new heuristics: "partial proofs of vulnerabilities". This tool is published under a permissive dual BSD/MIT open-source license.
Safety and security concerns surrounding Internet-of-Things (IoT) platforms for smart homes have spurred the development of defense mechanisms to safeguard against unexpected behaviors in accordance with safety and security policies. However, the need to manually craft policies in tool-specific languages increases the burden on humans. Previous attempts to address this issue have fallen short, either lacking portability or requiring human intervention in other forms. Therefore, in this paper, we propose iConPAL, an automated policy authoring assistant for IoT environments. iConPAL accepts a policy description in natural language (English) and translates it into a specific formal policy language. iConPAL leverages the capabilities of modern large language models (LLMs), employs prompt engineering to automatically generate few-shot learning prompts for the LLM, and post-processes the LLM’s response to ensure the validity of the translated policy. We implemented a prototype of iConPAL and evaluated it on our curated dataset of 290 policies. We observed that iConPAL successfully translated 93.61% policies, of which 93.57% were semantically correct. iConPAL’s high accuracy makes it suitable for assisting ordinary users in drafting policies for smart homes.
Memory safety is crucial for system software, as memory corruption can lead to exploitation like remote code execution. Rust is prominent among memory-safe languages due to its widespread use in rewriting system software, such as the Linux kernel and the Tor project. Rust enforces strict compile-time policies that promote safe memory usage but allow unsafe code for compatibility reasons. The RustSec database shows developers’ reckless use of unsafe in Rust code brings back old memory issues. Moreover, industries are increasingly adopting Rust alongside C/C++ code-bases, highlighting the need to automatically detect Rust vulnerabilities or memory isolation techniques. Because the latter is expensive, there is an increasing need to develop efficient methods for detecting Rust vulnerabilities.In this study, we explore the scope and practicality of the most popular Rust vulnerability detectors to identify the challenges in developing an ideal vulnerability detector for the Rust language. We prepare a list of known memory safety vulnerabilities and select six scalable Rust vulnerability tools compatible with most Rust projects. Our toolset consists of three static and two dynamic analysis detectors, including a fuzzer assistant. In addition, we will cover the significance of prioritizing vulnerability and exploitation. Finally, we discuss a symbolic analysis method to automatically produce exploitation with the help of fuzzer and RULF.
Online information sources have a considerable influence on the security of applications developed. Prior research has shown that insecure code snippets and security advice is pervasive in popular information sources. Developer-Centered Security (DCS) as a field has suggested interventions with respect to the usage of such information sources. We argue that such interventions are based only on the study of the demand side, where as interventions to be effective in any production environment needs to be situated on a comprehensive understanding of both demand side & supply side. We study the supply side of a popular source for security knowledge - Security Stack Exchange. Our findings reveal that the manner in which the forum identifies its top answerers is inadequate. We find 424 additional answerers whose engagement and topic interests are similar to the ranked top answerers. We term the collective of these power users irrespective of their reputation as Community Security Champion (CSC)s. The significance of this work lie in equipping the community with the information on where to intervene and how to intervene. Our work can serve as a methodological foundation to study network characteristics which is critical for improved user experience and to keep information networks relevant.
Caches (and cache hierarchies) are an important aspect in modern hardware design. Caches also have a strong influence in the security of a modern platform, and in recent years there was a wave of new speculative side-channels discovered since the class was unveiled [1].This paper discusses reverse engineering techniques used by the authors to identify relevant cache characteristics that are necessary to mount some of the recently disclosed speculative side-channel attacks. The techniques are then applied on the latest interaction of Intel’s Hardware mitigation eIBRS (the "enhanced" IBRS), uncovering how it really works and how it differs, even if subtly, from the mitigations it is said to replace - retpoline (having weaknesses never discussed before). The findings open a new area for research in the speculative side-channels and how they are mitigated.
This research explores integrating LLVM’s Control Flow Integrity (CFI) into the OpenJDK Java Virtual Machine (JVM) to mitigate memory corruption vulnerabilities. We present a manual approach to CFI integration that offers a solution applicable to various real-world projects. Using the DaCapo benchmark suite, we conduct a thorough performance evaluation of the CFI-integrated JVM version. Our work reveals that introducing CFI results in an average performance overhead of approximately 11.5% and a 34% increase in binary size. Remarkably, we identify specific CFI subcategories that, when implemented individually, induce performance improvements for the JVM. This finding highlights CFI’s potential to enhance security and performance in Java and general applications. Our research advances the understanding of CFI integration in complex software such as the JVM, shedding light on the challenges and opportunities in securing software systems against memory corruption attacks.
This paper aims to solve security issues in online centralized multi-agent multi-task assignment (MAMTA) problems. Combining cutting-edge cryptographic protocols with MAMTA algorithms, we propose a securely centralized architecture for dispatching tasks among agents. Our approach suits agents with low computing power and can fit various systems well. The proposed architecture is similar to an account-based blockchain or a zk-rollup. It also potentially brings privacy to the agents. Using verifiable computation to prove proper task allocation to the agents, the central server furnishes proof that the computation is indeed as expected and that there were no errors or misbehavior. We developed a proof-of-concept for a specific use case based on the SKATE algorithm, a lightweight meta-heuristic approach for combinatorial optimization that is compatible with verifiable computation. Our use case is a robotic aerial mission in which the proposed architecture was implemented and then deployed in a real-world flight. Average proof generation and verification times were also assessed. Our results suggest the approach is suitable for future on-board use in mobile agents.
Many applications benefit from computations over the data of multiple users while preserving confidentiality. We present a solution where multiple mutually distrusting users’ data can be aggregated with an acceptable overhead, while allowing users to be added to the system at any time without re-encrypting data. Our solution to this problem is to use a Trusted Execution Environment (Intel SGX) for the computation, while the confidential data is encrypted with the data owner’s key and can be stored anywhere, without trust in the service provider. We do not require the user to be online during the computation phase and do not require a trusted party to store data in plain text. Still, the computation can only be carried out if the data owner explicitly has given permission.Experiments using common functions such as the sum, least square fit, histogram, and SVM classification, exhibit an average overhead of 1.6×. In addition to these performance experiments, we present a use case for computing the distributions of taxis in a city without revealing the position of any other taxi to the other parties.
Modern microcontroller software is often written in C/C++ and suffers from control-flow hijacking vulnerabilities. Previous mitigations suffer from high performance and memory overheads and require either the presence of memory protection hardware or sophisticated program analysis in the compiler.This paper presents DeTRAP (Debug Trigger Return Address Protection). DeTRAP utilizes a full implementation of the RISC-V debug hardware specification to provide a write-protected shadow stack for return addresses. Unlike previous work, DeTRAP requires no memory protection hardware and only minor changes to the compiler toolchain.We tested DeTRAP on an FPGA running a 32-bit RISC-V microcontroller core and found average execution time overheads to be between 0.5% and 1.9% on evaluated benchmark suites with code size overheads averaging 7.9% or less.
Outsourced computation presents a risk to the confidentiality of clients' sensitive data since they have to trust that the service providers will not mishandle this data. Blinded Memory (BliMe) [1] is a set of hardware extensions that addresses this problem by using hardware-based taint tracking to keep track of sensitive client data and enforce a security policy that prevents software from leaking this data, either directly or through side channels. Since programs can leak sensitive data through timing channels and memory access patterns when this data is used in control-flow or memory access instructions, BliMe prohibits such unsafe operations and only allows constant-time code to operate on sensitive data. The question is how a developer can confirm that their code will run correctly on BliMe. While a program can be manually checked to see if it is constant-time, this process is tedious and error-prone. In this paper, we introduce the BliMe linter, a set of compiler extensions built on top of SVF [2] that analyze LLVM bitcode to identify possible BliMe violations. We evaluate the BliMe linter analytically and empirically and show that it is sound.
AI-based systems leverage recent advances in the field of AI/ML by combining traditional software systems with AI components. Applications are increasingly being developed in this way. Software engineers can usually rely on a plethora of supporting information on how to use and implement any given technology. For AI-based systems, however, such information is scarce. Specifically, guidance on how to securely design the architecture is not available to the extent as for other systems.We present 16 architectural security guidelines for the design of AI-based systems that were curated via a multi-vocal literature review. The guidelines could support practitioners with actionable advice on the secure development of AI-based systems. Further, we mapped the guidelines to typical components of AI-based systems and observed a high coverage where 6 out of 8 generic components have at least one guideline associated to them.
The reuse of software has enabled faster fielding of systems, but all software comes with vulnerabilities, and attackers have expanded their capabilities to exploit the software supply chain, especially open source, which provides broad accessibility. Managing this risk requires the ability to measure and monitor it, but the information is scattered among acquirers, suppliers, system and software engineers, developers, testers, and verifiers. The Software Engineering Institute (SEI) has explored many aspects of software measurement. Throughout the history of software engineering, we have learned that software metrics for both the process and the product are needed. We have also explored many aspects of cybersecurity measurement and determined that we must be able to measure the processes for developing and using software and determine how those measurement results affect the resulting product’s cybersecurity. This tutorial will share the results of this exploration to show the range of potential measurement options.
