DOCSLIB.ORG

Software Systems at Risk: an Empirical Study of Cloned Vulnerabilities in Practice

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Software Systems at Risk: an Empirical Study of Cloned Vulnerabilities in Practice computers & security 77 (2018) 720–736 Available online at www.sciencedirect.com j o u r n a l h o m e p a g e : w w w . e l s e v i e r . c o m / l o c a t e / c o s e Software systems at risk: An empirical study of cloned vulnerabilities in practice ∗ Seulbae Kim, Heejo Lee Department of Computer Science and Engineering, Korea University, Seoul 136-713, Republic of Korea a r t i c l e i n f o a b s t r a c t Article history: With the growth of open source software (OSS), code clones –code fragments that are copied Received 1 October 2017 and pasted within or between software systems –are proliferating. Although code cloning Revised 10 February 2018 may expedite the process of software development, it often critically affects the security of Accepted 12 February 2018 software because vulnerabilities and bugs can easily be propagated through code clones. Available online 27 February 2018 These vulnerable code clones are increasing in conjunction with the growth of OSS, poten- tially contaminating many systems. Although researchers have attempted to detect code Keywords: clones for decades, most of these attempts fail to scale to the size of the ever-growing OSS Software vulnerability code base. The lack of scalability prevents software developers from readily managing code Open source software clones and associated vulnerabilities. Moreover, most existing clone detection techniques Vulnerability propagation focus overly on merely detecting clones and this impairs their ability to accurately find “vul- Code clone detection nerable” clones. Vulnerability exploitation In this paper, we propose VUDDY, an approach for the scalable detection of vulnerable code clones, which is capable of detecting security vulnerabilities in large software programs efficiently and accurately. Its extreme scalability is achieved by leveraging function-level granularity and a length-filtering technique that reduces the number of signature compar- isons. This efficient design enables VUDDY to preprocess a billion lines of code in 14 hours and 17 minutes, after which it requires a few seconds to identify code clones. In addition, we designed a vulnerability-preserving abstraction technique that renders VUDDY resilient to common modifications in cloned code, while preserving the vulnerable conditions even after the abstraction is applied. This extends the scope of VUDDY to identifying variants of known vulnerabilities, with high accuracy. An implementation of VUDDY has been ser- viced online for free at IoTcube, an automated vulnerability detection platform. In this study, we describe its principles, evaluate its efficacy, and analyze the vulnerabilities VUDDY de- tected in various real-world software systems, such as Apache HTTPD server and an Android smartphone. © 2018 Elsevier Ltd. All rights reserved. servers. The number of repositories in GitHub increased from 1. Introduction 1 million to 10 million between July 2010 and December 2013, and then to more than 66 million in August 2017, with most of For the past decade, open source software (OSS) has grown the repositories being software projects ( GitHub ). Black Duck rapidly in size, and is becoming a foundation for a major- Software and North Bridge revealed in 2016 Future of Open ity of applications, operating systems, databases, and web Source survey that 78% of the companies run open source ∗ Corresponding author. E-mail address: [email protected] (H. Lee). https://doi.org/10.1016/j.cose.2018.02.007 0167-4048/© 2018 Elsevier Ltd. All rights reserved. computers & security 77 (2018) 720–736 721 software ( Blackduck ). In literature, researchers showed that ing hash values through bloom filter. However, when it comes open source projects have linear to quadratic growth patterns to finding vulnerable code clones in massive code bases, Re- ( Godfrey and Tu, 2000; Scacchi, 2006; Succi et al., 2001 ). DeBug is still not satisfactory both in terms of accuracy and The considerable increase and the ubiquitous use of OSS scalability. Some techniques leverage a combination of vari- programs have naturally led to an increase in software vulner- ous approaches. VulPecker ( Li et al., 2016 ) characterizes a vul- abilities caused by code cloning, thereby posing dire threats nerability with a predefined set of features, then selects one of to the security of software systems ( Li et al., 2015 ). Numer- the existing code-similarity algorithms (e.g. Jang et al. (2012), ous instances in practice substantiate the claim that software Li et al. (2006) and Pham et al. (2010) which is optimal for the vulnerabilities are propagated through code cloning ( Dang type of vulnerable code fragment. A considerable amount of et al., 2017 ). For example, the OpenSSL Heartbleed vulnerabil- time required for the learning phase and algorithm selection ity (CVE-2014-0160) has affected a number of different types makes it improper to be used against massive open source of systems including web applications as well as OS distri- projects. An approach to analyze code heterogeneity for de- butions, and even hardware products such as routers and tecting repackaged Android malware ( Tian et al., 2016, 2017 ) switches, because the affected systems cloned a part or the utilizes machine learning algorithms, which are heavily de- entire OpenSSL library into their systems. pendent on the manual efforts to select features. Moreover, the life cycle of vulnerabilities even aggravates Meanwhile, our preliminary work, called VUDDY ( Kim such problem. That is, even if a vendor were to release a se- et al., 2017a ), proposed the most scalable and accurate curity patch immediately after the discovery of vulnerability approach for vulnerable code clone detection by leverag- in the original program, it would take time for the patch to ing function-level granularity and applying vulnerability- be fully deployed through every program that cloned the vul- preserving abstraction method. In this paper, we briefly de- nerable code of the original program ( Nappa et al., 2015 ). This scribe the approach we used for scalable and accurate detec- “time lag” between patch release and deployment increases tion of vulnerable code clones, then provide a detailed analysis when more steps and parties are involved in manufacturing of code reuse patterns and associated vulnerabilities in real- an end product. For example, Google takes the Linux kernel world software systems. In practice, we discovered several to make the Android operating system, and then smartphone kernel vulnerabilities in the recently released smartphones, vendors take the Android OS in order to make firmware for and successfully exploited the vulnerabilities. In addition, we their smartphone. Therefore, we can hardly expect that secu- identified several famous open source software which are re- rity patches issued for Linux kernel are immediately applied leased with old, vulnerable libraries. These results show that to smartphone’s firmware. Taking advantage of this fact, the security patches are deployed at a slow pace if code is reused, attackers in 2016 could successfully deploy the “Dogspectus” and because of this, unpatched vulnerabilities can easily be ransomware to a lot of Android smartphones by exploiting exploited for malicious activities even though they are not two-year-old kernel vulnerability (CVE-2014-3153) residing in zero-day vulnerabilities. the firmware. The contributions of this study include: To address such clone-related problems, many researchers have proposed code clone detection techniques ( Rattan et al., • Scalable clone detection: We propose VUDDY, an approach to 2013 ). However, few techniques are suitable for accurately scalable yet accurate code clone detection, which adopts finding vulnerability in a scalable manner. Token-based lex- a robust parsing and a novel fingerprinting mechanism for ical techniques such as CCFinder ( Kamiya et al., 2002 ) and CP- functions. VUDDY is able to process a billion lines of code in Miner ( Li et al., 2006 ) not only suffer from low scalability of only 14 hours and 17 minutes, which is an unprecedented complex token sequence comparing algorithms they take, but speed. also have high false positive rate caused by their aggressive ab- • Vulnerability-preserving abstraction: We present an effec- straction and filtering heuristics. This implies that this design tive abstraction scheme optimized for detecting unknown does not guarantee sufficient reliability to be useful for vulner- vulnerable code clones. This allows VUDDY to detect un- ability detection. Similarly, abstract data structure based ap- known vulnerable code clones, as well as known vulnera- proaches (e.g., Deckard ( Jiang et al., 2007 b), or Baxter’s ( Baxter bilities in a target program. Owing to this design, VUDDY et al., 1998 )) have to apply expensive tree-matching opera- detects 24% more vulnerable clones which are unknown tions or graph mining techniques for similarity estimation. Al- variants of known vulnerabilities. though such approaches would be capable of discovering code • Analysis of cloned vulnerabilities in real-world software sys- fragments with similar syntactic patterns, this does not guar- tems: We analyze and verify the cloned vulnerabilities de- antee an accurate vulnerability detection because two code tected in the software systems in practice, including fa- fragments with identical abstract syntax trees (ASTs) do not mous projects on GitHub and SourceForge, and smart- necessarily contain the same vulnerability ( Jiang et al., 2007 a). phones with
Load more

Recommended publications
  • Security Analysis of Docker Containers in a Production Environment
    Security analysis of Docker containers in a production environment Jon-Anders Kabbe Master of Science in Communication Technology Submission date: June 2017 Supervisor: Colin Alexander Boyd, IIK Co-supervisor: Audun Bjørkøy, TIND Technologies Norwegian University of Science and Technology Department of Information Security and Communication Technology Title: Security Analysis of Docker Containers in a Production Environment Student: Jon-Anders Kabbe Problem description: Deployment of Docker containers has achieved its popularity by providing an au- tomatable and stable environment serving a particular application. Docker creates a separate image of a file system with everything the application require during runtime. Containers run atop the regular file system as separate units containing only libraries and tools that particular application require. Docker containers reduce the attack surface, improves process interaction and sim- plifies sandboxing. But containers also raise security concerns, reduced segregation between the operating system and application, out of date or variations in libraries and tools and is still an unsettled technology. Docker containers provide a stable and static environment for applications; this is achieved by creating a static image of only libraries and tools the specific application needs during runtime. Out of date tools and libraries are a major security risk when exposing applications over the Internet, but availability is essential in a competitive market. Does Docker raise some security concerns compared to standard application deploy- ment such as hypervisor-based virtual machines? Is the Docker “best practices” sufficient to secure the container and how does this compare to traditional virtual machine application deployment? Responsible professor: Colin Alexander Boyd, ITEM Supervisor: Audun Bjørkøy, TIND Technologies Abstract Container technology for hosting applications on the web is gaining traction as the preferred mode of deployment.
    [Show full text]
  • The Rise and Imminent Fall of the N-Day Exploit Market in the Cybercriminal Underground
    The Rise and Imminent Fall of the N-Day Exploit Market in the Cybercriminal Underground Mayra Rosario Fuentes and Shiau-Jing Ding Contents TREND MICRO LEGAL DISCLAIMER The information provided herein is for general information and educational purposes only. It is not intended and 4 should not be construed to constitute legal advice. The information contained herein may not be applicable to all Introduction situations and may not reflect the most current situation. Nothing contained herein should be relied on or acted upon without the benefit of legal advice based on the particular facts and circumstances presented and nothing 7 herein should be construed otherwise. Trend Micro reserves the right to modify the contents of this document Overview of Exploit Developers at any time without prior notice. Translations of any material into other languages are intended solely as a convenience. Translation accuracy is not guaranteed nor implied. If any questions arise 12 related to the accuracy of a translation, please refer to the original language official version of the document. Any Overview of Exploit Demand and discrepancies or differences created in the translation are Availability not binding and have no legal effect for compliance or enforcement purposes. Although Trend Micro uses reasonable efforts to include accurate and up-to-date information herein, Trend Micro 16 makes no warranties or representations of any kind as to its accuracy, currency, or completeness. You agree Outdated Exploits that access to and use of and reliance on this document and the content thereof is at your own risk. Trend Micro disclaims all warranties of any kind, express or implied.
    [Show full text]
  • Sstic-2021-Actes.Pdf
    Préface Mercredi 2 juin 2021, 8 heures du matin. Sous perfusion de café, les yeux à peine entrouverts, je suis avec le reste du comité d’organisation (CO), qui est sur les rangs et veille aux derniers détails, vérifiant que la guicheteuse et les lecteurs de badge fonctionnent. Pendant ce temps, certains irréductibles sont déjà dehors, malgré le crachin breton, prêts à se ruer pour pouvoir découvrir en premier les goodies et s’installer confortablement dans l’amphi, à leur place favorite, pour feuilleter les actes et lire la préface. On ouvre les portes, c’est parti pour le 19e SSTIC ! Fondu. Huit cents personnes dans l’amphi face à nous, je vérifie avec l’orateur invité qui fait l’ouverture que tout est prêt. Avec le trac, les spots qui m’éblouissent, je m’avance pour prononcer quelques mots et lancer la conférence... Et dire qu’il y a environ un tiers de nouveaux ! Fondu. Petit tour en régie, pour discuter avec les techniciens du Couvent et s’assurer que le streaming se passe bien. Oups, on me dit sèchement de m’éloigner de la caméra ; apparemment, les talkies-walkies qui assurent la liaison avec le reste du CO, éparpillé entre le premier rang et l’accueil, font trembler les aimants du stabilisateur... Fondu. Après la présentation des résultats du challenge, une session de rumps réussie où il a fallu courir dans l’amphi pour apporter le micro, nous voilà dans le magnifique cloître du Couvent, sous un soleil bienvenu. Les petits fours sont excellents et je vois, à l’attroupement qui se forme rapidement, que le stand foie gras vient d’ouvrir.
    [Show full text]
  • Area Efficient and Low Power Carry Select Adder Using
    International Journal of Advances in Electronics and Computer Science, ISSN(p): 2394-2835 Volume-6, Issue-7, Jul.-2019 http://iraj.in EVOLUTION OF ANDROID MALWARE OFFENSE AND ANDROID ECOSYSTEM DEFENSE 1NISHANT PANDIT, 2DEEPTI V VIDYARTHI 1Student, Defence Institute of Advanced Technology, Girinagar, Pune, Maharashtra – 411025, India 2Assistant Professor, Defence Institute of Advanced Technology, Girinagar, Pune, Maharashtra – 411025, India E-mail: [email protected], [email protected] Abstract - Android mobile devices are used more and more in everyday life. They are our cameras, wallets, and keys. Basically, they embed most of our private information in our pocket. The paper captures the journey of android malware from being mere revenue generation incentives for the malware developer to stealing the personal data of people using these devices. It also discusses how the open source nature of Android has led to fragmentation of the core Operating System among various device manufacturer which introduces additional vulnerabilities. The non-availability of official Google Play store in some countries led to the emergence of various third party Application market which are largely unregulated in terms of the application verification. Android Operating system itself has come a long way in terms of the security features and fixed vulnerabilities over the course of a decade. Our evaluation shows that the Android System has become quite robust against malware threats and automatic installation of malware is not possible without user intervention. We explore certain simple settings on android which would protect the user from malware threats on Android device. Keywords - Android System, Malware Analysis, Vulnerabilities, Android Fragmentation. I.
    [Show full text]
  • The Shadows of Ghosts Inside the Response of a Unique Carbanak Intrusion
    WHITE PAPER The Shadows of Ghosts Inside the response of a unique Carbanak intrusion By: Jack Wesley Riley – Principal, Incident Response Consultant Table of contents 1 Glossary of terms................................................................................................................ 7 2 Report summary.................................................................................................................. 8 3 Intrusion overview........................................................................................................... 13 3.1 Anatomy of attack..................................................................................................... 13 3.1.1 Phase 1: D+0...................................................................................................... 14 3.1.2 Phase 2: D+0....................................................................................................... 14 3.1.3 Phase 3: D+1 through D+3............................................................................... 16 3.1.4 Phase 4: D+3 through D+25............................................................................ 17 3.1.5 Phase 5: D+25 through D+30.......................................................................... 18 3.1.6 Phase 6: D+30 through D+44.......................................................................... 19 3.2 Detection and response............................................................................................ 19 4 Intrusion details.................................................................................................................
    [Show full text]
  • Mobile Threat
    Mobile threat February 2018 David Bird FBCS considers threats via mobile devices and explains why he thinks the future may not be so bright. The unprecedented WannaCry ransomware and subsequent Petya destruct-ware outbreaks have caused mayhem internationally. As a result of a remote execution vulnerability, malware has propagated laterally due to two basic root-causes: (a) out-dated operating systems (OS), and/or (b) in-effective patching regimes. Here we have a commonality with the mobile device domain. There are many older generation devices that have different legacy mobile OSes installed that are no longer supported or updated. Legacy connected Microsoft Pocket PC palmtops and Windows CE or Windows Mobile devices are examples of tech still being used by delivery firms and supermarkets; even though they have been end-of-extended support since 2008 and 2014 respectively. So, do we have a problem? With over two and a half billion smartphones globally in 2016, the market is anticipated to reach at least six billion by 2020 due to the convenience of mobile back-end-as-a-service. Apparently, one vulnerability is disclosed every day, in which 10 per cent of those are critical. This figure does not include the number of internet-enabled tablets that are in circulation; in 2015, there were one billion globally, and this is expected to rise to almost one and a half billion by 2018. Today both Android-centric manufacturers and Apple fight for dominance in the mobile device market - squeezing out Blackberry’s enterprise smartphone monopoly. This has resulted in unsupported Blackberry smart-devices persisting in circulation, closely followed by successive versions of Windows Phone OS - with only 10 left supported.
    [Show full text]
  • Licensing Information User Manual Mysql Enterprise Monitor 3.4
    Licensing Information User Manual MySQL Enterprise Monitor 3.4 Table of Contents Licensing Information .......................................................................................................................... 4 Licenses for Third-Party Components .................................................................................................. 5 Ant-Contrib ............................................................................................................................... 10 ANTLR 2 .................................................................................................................................. 11 ANTLR 3 .................................................................................................................................. 11 Apache Commons BeanUtils v1.6 ............................................................................................. 12 Apache Commons BeanUtils v1.7.0 and Later ........................................................................... 13 Apache Commons Chain .......................................................................................................... 13 Apache Commons Codec ......................................................................................................... 13 Apache Commons Collections .................................................................................................. 14 Apache Commons Daemon ...................................................................................................... 14 Apache
    [Show full text]
  • Exploiting Host-Based Vulnerabilities
    Exploiting Host-Based Vulnerabilities • Exploit Windows-Based Vulnerabilities • Exploit *nix-Based Vulnerabilities Copyright (c) 2018 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 1 Commonalities Among Windows-Based Vulnerabilities (Slide 1 of 2) • OSs and most applications based on C, which has no default bounds-checking. • Susceptible to buffer overflows, arbitrary code execution, and privilege escalation. • Developers need to use security best practices and unit testing. • Proprietary product, so source code is not publicly available. • Fewer reviews open the door for undiscovered weaknesses. • Complexity enables vulnerabilities to remain undetected after release. • Microsoft doesn’t patch all vulnerabilities—they release new versions. • This leaves the vulnerability unaddressed in older installations. Copyright (c) 2018 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 2 Commonalities Among Windows-Based Vulnerabilities (Slide 2 of 2) • Servers: Network-based vulnerabilities; workstations: Application-based vulnerabilities. • Uses standard protocols and technologies. • Susceptible to cross-platform exploits. • Physical access puts hosts at greater risk. • Connecting cables to administrative console ports. • Booting to a different OS. • Using removable media. • Stealing and damaging hardware. • Social engineering is required to expose certain vulnerabilities. Copyright (c) 2018 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 3 Windows Operating System Vulnerabilities Category Description Remote code execution Any condition that allows attackers to execute arbitrary code. Buffer or heap overflow A programming error that allows attackers to overwrite allocated memory addresses with malicious code. Denial of service Any condition that allows attackers to use resources so that legitimate requests can’t be served. A programming error that allows attackers to access a program’s memory space and hijack the normal Memory corruption execution flow.
    [Show full text]
  • Remote Code Execution on Android
    MASARYK UNIVERSITY FACULTY OF INFORMATICS Remote code execution on Android MASTER'S THESIS Mayank Samadhiya Chennai, Fall 2017 MASARYK UNIVERSITY FACULTY OF INFORMATICS Remote code execution on Android MASTER'S THESIS Mayank Samadhiya Chennai, Fall 2017 This is where a copy of the official signed thesis assignment and a copy of the Statement of an Author is located in the printed version of the document. Declaration Hereby I declare that this paper is my original authorial work, which I have worked out on my own. All sources, references, and literature used or excerpted during elaboration of this work are properly cited and listed in complete reference to the due source. Mayank Samadhiya Advisor: Martin Stehlik i Acknowledgement I am very thankful to my organization and Government of India for giving me the opportunity to pursue Master studies at Masaryk Uni­ versity. I am thankful to RNDr. Martin Stehlik Ph.D, Mgr. Jaroslav Seděnka and Dr. Chester Rebeiro who has guided me in completion of my Master thesis. I am also thankful to Prof RNDr Václav Matyáš Ph.D. for his continuous motivation for the completion of thesis. I am also thankful to all my teachers at Masaryk University, especially Prof RNDr Václav Matyáš Ph.D., RNDr. Petr Švenda Ph. D and to all my batchmates for enabling me to learn many vital aspects of In­ formation Security. I would like to thank my wife Ritu and children Darsh and Shivay for there patience and providing me continuous encouragement and support. iii Abstract Android is an open-source platform which is widely used in smart phones, tablets and other low power applications.
    [Show full text]
  • (DIS) Installation Guide
    Delegation Issuing Service (DIS) Installation Guide © University of Kent 2005-2010 Document History Version Date Comments 0.1 9 September 2005 First draft by Wensheng 0.2 12 September 2005 Updated by Tuan Anh 0.3 14 September 2005 Reviewed by David 1.0 15 September 2005 First public release 1.1 1 July 2006 Updated with Acceptance Tests for issuing attributes 1.2 24 July 2006 Update the installation instructions 1.3 26 July 2006 Updated with Acceptance Tests for revocation attributes 1.4 14 August 2006 Fix some inconsistencies after validating by Romain 1.5 3 October 2006 Add the SearchRequestor parameter, change the parameters in the configuration file using Permis standard parameters. 1.6 24 October 2006 Add instruction for using policy stored in a file 1.7 24 October 2006 Add support for java 1.5 1.8 22 February 2007 Add support for Tomat 5.5 1.9 23 April 2007 Add support for Apache 2.2 2.0 12 August 2008 Using PERMIS v5 policies and Apache http server on Windows (by Linying) 2.1 25 March 2009 Updated the authentication of tomcat, DIS installation instruction, instruction for apache2.2 (by Kaniz) 2.2 17 February 2010 Revised and updated by Kaniz 2.3 16 April 2010 Updated by Mark 2.5 26 October 2010 Install guide rewritten and separated into its own document 2.5.2 2 November 2010 Java installation explained more fully. Tomcat native library installation corrected. Default DIS configuration file inserted. 2.5.4 5 November 2010 Addressed feedback from Kaniz System Requirements For the DIS Web Service A recent Java Runtime Environment (JRE).
    [Show full text]
  • Apachecon 2004 November 13-17, 2004 Las Vegas Nevada
    ApacheCon 2004 November 13-17, 2004 Las Vegas Nevada CLICK SESSION TITLE FOR PRESENTATION TUTORIALS MONDAY TUESDAY WEDNESDAY T01 Introduction to the Apache Web Server T02 mod_perl 2.0 by Example T03 Apache Portable Runtime 1.0 Tutorial T06 Mangling data with XSLT T07 Test-Driven Apache Module Development T08 Tapestry In Action T09 SpamAssassin Tutorial T10 Everything You Always Wanted to Know About XML Parsing T11 Scalable Internet Architectures T12 Apache Derby/Cloudscape: Embed This! T13 Struts: the good, the bad, and the ugly T14 Subversion Tutorial T15 Digging deep into XML Schema with Apache XMLBeans T16 PHP Security T17 Taming Apache Cocoon T18 Lucene in Action Search Next Help ApacheCon 2004 November 13-17, 2004 Las Vegas Nevada CLICK SESSION TITLE FOR PRESENTATION TUTORIALS MONDAY TUESDAY WEDNESDAY MO01 Behind the Scenes of the Apache Software Foundation MO02 Apache 2.0 on Windows MO03 The State of Apache Geronimo MO04 Advanced Topics in Module Design: Threadsafety and Portability MO05 The Incubator: Starting a Successful Apache Open Source Project MO06 Apache authentication MO07 Comparing Web Frameworks: Struts, Spring MVC, WebWork, Tapestry & JSF MO08 WebDAV and Apache MO09 New and upcoming features in SpamAssassin v3 MO10 What's so great about Apache 2.0? MO11 Embedding Tomcat 5 into Applications Servers MO12 Logging and Configuration - Demystifying the banes of App development MO13 Storing SpamAssassin User Data in SQL Databases MO14 Shoehorning Apache Onto Your Box: System Sizing Tips MO15 Highly available web sites with Tomcat
    [Show full text]
  • Abkürzungs-Liste ABKLEX
    Abkürzungs-Liste ABKLEX (Informatik, Telekommunikation) W. Alex 1. Juli 2021 Karlsruhe Copyright W. Alex, Karlsruhe, 1994 – 2018. Die Liste darf unentgeltlich benutzt und weitergegeben werden. The list may be used or copied free of any charge. Original Point of Distribution: http://www.abklex.de/abklex/ An authorized Czechian version is published on: http://www.sochorek.cz/archiv/slovniky/abklex.htm Author’s Email address: [email protected] 2 Kapitel 1 Abkürzungen Gehen wir von 30 Zeichen aus, aus denen Abkürzungen gebildet werden, und nehmen wir eine größte Länge von 5 Zeichen an, so lassen sich 25.137.930 verschiedene Abkür- zungen bilden (Kombinationen mit Wiederholung und Berücksichtigung der Reihenfol- ge). Es folgt eine Auswahl von rund 16000 Abkürzungen aus den Bereichen Informatik und Telekommunikation. Die Abkürzungen werden hier durchgehend groß geschrieben, Akzente, Bindestriche und dergleichen wurden weggelassen. Einige Abkürzungen sind geschützte Namen; diese sind nicht gekennzeichnet. Die Liste beschreibt nur den Ge- brauch, sie legt nicht eine Definition fest. 100GE 100 GBit/s Ethernet 16CIF 16 times Common Intermediate Format (Picture Format) 16QAM 16-state Quadrature Amplitude Modulation 1GFC 1 Gigabaud Fiber Channel (2, 4, 8, 10, 20GFC) 1GL 1st Generation Language (Maschinencode) 1TBS One True Brace Style (C) 1TR6 (ISDN-Protokoll D-Kanal, national) 247 24/7: 24 hours per day, 7 days per week 2D 2-dimensional 2FA Zwei-Faktor-Authentifizierung 2GL 2nd Generation Language (Assembler) 2L8 Too Late (Slang) 2MS Strukturierte
    [Show full text]