DOCSLIB.ORG

Language and Framework Support for Reviewably-Secure Software Systems

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Language and Framework Support for Reviewably-Secure Software Systems Language and Framework Support for Reviewably-Secure Software Systems by Adrian Matthew Mettler A dissertation submitted in partial satisfaction of the requirements for the degree of Doctor of Philosophy in Computer Science in the Graduate Division of the University of California, Berkeley Committee in charge: Professor David Wagner, Chair Professor Deirdre Mulligan Professor Dawn Song Fall 2012 Language and Framework Support for Reviewably-Secure Software Systems Copyright 2012 by Adrian Matthew Mettler 1 Abstract Language and Framework Support for Reviewably-Secure Software Systems by Adrian Matthew Mettler Doctor of Philosophy in Computer Science University of California, Berkeley Professor David Wagner, Chair My thesis is that languages and frameworks can and should be designed to make it easier for programmers to write reviewably secure systems. A system is reviewably secure if its security is easy for an experienced programmer to verify, given access to the source code. A security reviewer should be able, with a reasonable amount of effort, to gain confidence that such a system meets its stated security goals. This dissertation includes work on on language subsetting and web application framework design. It presents Joe-E, a subset of the Java programming language designed to enforce object- capability security, simplifying the task of verifying a variety of security properties by en- abling sound, local reasoning. Joe-E also enforces determinism-by-default, which permits functionally-pure methods to be identified by their signature. Functional purity is a useful property that can greatly simplify the task of correctly implementing and reasoning about application code. A number of applications of the Joe-E language are presented and evalu- ated. The second part of this dissertation presents tool and framework enhancements for improving the security of web applications. I present techniques for retrofitting existing web applications to use template systems effectively to prevent cross-site scripting and content injection vulnerabilities while preserving functionality. I also show how HTML templates can be rewritten to normalize their output, improving the assurance of security provided by automatic escaping and other static analyses. These two applications of my thesis demonstrate that practical enhancements to lan- guages and frameworks can support developers in creating more secure software that is easier to review. Continued improvement in language and framework support for reviewability is a promising approach toward improving the security provided by modern software. i To everyone who has believed in me, especially my family. ii Contents List of Figures vii List of Tables ix Acknowledgements x 1 Introduction 1 1.1 Background . 1 1.1.1 Security Review . 1 1.1.2 Programming Languages and Abstractions . 3 1.1.3 Web Templating Languages . 4 1.2 Summary . 5 1.2.1 Joe-E: A Security-Oriented Subset of Java . 6 1.2.2 Improving Security of Template-Based Web Applications . 9 2 Joe-E: An Object-Capability Subset of Java 11 2.1 Introduction . 11 2.2 Goals and Overview . 17 2.2.1 Ease of use . 17 2.2.2 Supporting secure software . 18 2.2.3 Supporting security code review . 19 2.3 Approach . 20 2.3.1 Subsetting . 21 2.4 Design of Joe-E . 21 2.4.1 Memory Safety and Encapsulation . 22 2.4.2 Removing Ambient Authority . 23 2.4.3 Exceptions and Errors . 26 2.5 Programming Patterns . 28 2.5.1 Reachability and Object Graph analysis . 28 2.5.2 Leveraging Static Typing . 29 2.5.3 Defensive Consistency . 31 2.5.4 Immutability . 31 Contents iii 2.5.5 Attenuation of Authority . 32 2.5.6 Facets . 32 2.6 Implementation . 33 2.7 Conclusions . 36 3 Verifiable Functional Purity in Joe-E 37 3.1 Introduction . 37 3.2 Applications . 39 3.2.1 Reproducibility . 40 3.2.2 Invertibility . 40 3.2.3 Untrusted code execution . 41 3.2.4 Building robust systems . 43 3.2.5 Bug reduction . 43 3.2.6 Assertions and Specifications . 44 3.3 Definitions . 45 3.3.1 Side-effect freeness . 45 3.3.2 Determinism . 45 3.4 Approach . 46 3.4.1 Equivalence of reference lists . 47 3.4.2 Immutability . 48 3.5 Pure methods . 49 3.6 Implementation . 49 3.6.1 Side effects and Nondeterminism . 50 3.6.2 Immutability . 53 3.6.3 Verifying Purity . 53 3.7 Evaluation and Experience . 54 3.7.1 AES library . 55 3.7.2 Voting machine . 56 3.7.3 HTML parser . 57 3.7.4 Summary of patterns . 60 3.7.5 Waterken Server . 60 3.8 Discussion . 61 3.9 Conclusions . 62 4 Joe-E's Overlay Type System and Marker Interfaces 63 4.1 Introduction . 63 4.2 Overlay Type System . 65 4.2.1 Marker Interfaces . 66 4.2.2 Properties . 67 4.2.3 Formalizations . 67 4.3 Immutability . 72 4.3.1 Ensuring Final Means Final . 73 Contents iv 4.4 Identity-based Authority . 74 4.4.1 Power and Tokens . 75 4.4.2 Powerless . 76 4.5 Selfless and Equatable . 78 4.6 Conclusions . 81 4.7 Appendix: Proofs of Theorems . 82 4.7.1 Completeness . 82 4.7.2 Non-circularity . 83 5 Applications of Joe-E 85 5.1 Waterken . 85 5.1.1 Consistent Persistence . 86 5.1.2 Cache Coherence . 87 5.1.3 Remote capabilities . 88 5.2 Capsules . 89 5.2.1 Design . 89 5.2.2 Implementation . 90 5.2.3 Evaluation . 91 6 Related Work: Joe-E 99 6.1 Capabilities . 99 6.1.1 Object-Capability Languages . 99 6.1.2 Privilege Separation . 100 6.2 Security for Java and Related Languages . 100 6.3 Functional Purity . 101 6.3.1 Side Effects . 102 6.3.2 Functionally Pure Languages . 103 6.4 Overlay Type Systems . 104 7 Retrofitting Web Applications for Security Review of Cross-Site Scripting Resistance 106 7.1 Introduction . 106 7.2 Background . 108 7.3 Problem . 110 7.4 Approach . 112 7.4.1 Mitigation Mode . 113 7.4.2 Strict Mode . 113 7.5 Implementation . 116 7.5.1 Context-sensitive autoescaping . 116 7.5.2 Marked strings ..
Load more

Recommended publications
  • An In-Depth Study with All Rust Cves
    Memory-Safety Challenge Considered Solved? An In-Depth Study with All Rust CVEs HUI XU, School of Computer Science, Fudan University ZHUANGBIN CHEN, Dept. of CSE, The Chinese University of Hong Kong MINGSHEN SUN, Baidu Security YANGFAN ZHOU, School of Computer Science, Fudan University MICHAEL R. LYU, Dept. of CSE, The Chinese University of Hong Kong Rust is an emerging programing language that aims at preventing memory-safety bugs without sacrificing much efficiency. The claimed property is very attractive to developers, and many projects start usingthe language. However, can Rust achieve the memory-safety promise? This paper studies the question by surveying 186 real-world bug reports collected from several origins which contain all existing Rust CVEs (common vulnerability and exposures) of memory-safety issues by 2020-12-31. We manually analyze each bug and extract their culprit patterns. Our analysis result shows that Rust can keep its promise that all memory-safety bugs require unsafe code, and many memory-safety bugs in our dataset are mild soundness issues that only leave a possibility to write memory-safety bugs without unsafe code. Furthermore, we summarize three typical categories of memory-safety bugs, including automatic memory reclaim, unsound function, and unsound generic or trait. While automatic memory claim bugs are related to the side effect of Rust newly-adopted ownership-based resource management scheme, unsound function reveals the essential challenge of Rust development for avoiding unsound code, and unsound generic or trait intensifies the risk of introducing unsoundness. Based on these findings, we propose two promising directions towards improving the security of Rust development, including several best practices of using specific APIs and methods to detect particular bugs involving unsafe code.
    [Show full text]
  • Project Snowflake: Non-Blocking Safe Manual Memory Management in .NET
    Project Snowflake: Non-blocking Safe Manual Memory Management in .NET Matthew Parkinson Dimitrios Vytiniotis Kapil Vaswani Manuel Costa Pantazis Deligiannis Microsoft Research Dylan McDermott Aaron Blankstein Jonathan Balkind University of Cambridge Princeton University July 26, 2017 Abstract Garbage collection greatly improves programmer productivity and ensures memory safety. Manual memory management on the other hand often delivers better performance but is typically unsafe and can lead to system crashes or security vulnerabilities. We propose integrating safe manual memory management with garbage collection in the .NET runtime to get the best of both worlds. In our design, programmers can choose between allocating objects in the garbage collected heap or the manual heap. All existing applications run unmodified, and without any performance degradation, using the garbage collected heap. Our programming model for manual memory management is flexible: although objects in the manual heap can have a single owning pointer, we allow deallocation at any program point and concurrent sharing of these objects amongst all the threads in the program. Experimental results from our .NET CoreCLR implementation on real-world applications show substantial performance gains especially in multithreaded scenarios: up to 3x savings in peak working sets and 2x improvements in runtime. 1 Introduction The importance of garbage collection (GC) in modern software cannot be overstated. GC greatly improves programmer productivity because it frees programmers from the burden of thinking about object lifetimes and freeing memory. Even more importantly, GC prevents temporal memory safety errors, i.e., uses of memory after it has been freed, which often lead to security breaches. Modern generational collectors, such as the .NET GC, deliver great throughput through a combination of fast thread-local bump allocation and cheap collection of young objects [63, 18, 61].
    [Show full text]
  • Ensuring the Spatial and Temporal Memory Safety of C at Runtime
    MemSafe: Ensuring the Spatial and Temporal Memory Safety of C at Runtime Matthew S. Simpson, Rajeev K. Barua Department of Electrical & Computer Engineering University of Maryland, College Park College Park, MD 20742-3256, USA fsimpsom, [email protected] Abstract—Memory access violations are a leading source of dereferencing pointers obtained from invalid pointer arith- unreliability in C programs. As evidence of this problem, a vari- metic; and dereferencing uninitialized, NULL or “manufac- ety of methods exist that retrofit C with software checks to detect tured” pointers.1 A temporal error is a violation caused by memory errors at runtime. However, these methods generally suffer from one or more drawbacks including the inability to using a pointer whose referent has been deallocated (e.g. with detect all errors, the use of incompatible metadata, the need for free) and is no longer a valid object. The most well-known manual code modifications, and high runtime overheads. temporal violations include dereferencing “dangling” point- In this paper, we present a compiler analysis and transforma- ers to dynamically allocated memory and freeing a pointer tion for ensuring the memory safety of C called MemSafe. Mem- more than once. Dereferencing pointers to automatically allo- Safe makes several novel contributions that improve upon previ- ous work and lower the cost of safety. These include (1) a method cated memory (stack variables) is also a concern if the address for modeling temporal errors as spatial errors, (2) a compati- of the referent “escapes” and is made available outside the ble metadata representation combining features of object- and function in which it was defined.
    [Show full text]
  • CHERI Instruction-Set Architecture
    UCAM-CL-TR-876 Technical Report ISSN 1476-2986 Number 876 Computer Laboratory Capability Hardware Enhanced RISC Instructions: CHERI Instruction-Set Architecture Robert N. M. Watson, Peter G. Neumann, Jonathan Woodruff, Michael Roe, Jonathan Anderson, David Chisnall, Brooks Davis, Alexandre Joannou, Ben Laurie, Simon W. Moore, Steven J. Murdoch, Robert Norton, Stacey Son September 2015 15 JJ Thomson Avenue Cambridge CB3 0FD United Kingdom phone +44 1223 763500 http://www.cl.cam.ac.uk/ c 2015 Robert N. M. Watson, Peter G. Neumann, Jonathan Woodruff, Michael Roe, Jonathan Anderson, David Chisnall, Brooks Davis, Alexandre Joannou, Ben Laurie, Simon W. Moore, Steven J. Murdoch, Robert Norton, Stacey Son, SRI International Approved for public release; distribution is unlimited. Sponsored by the Defense Advanced Research Projects Agency (DARPA) and the Air Force Research Laboratory (AFRL), under contracts FA8750-10-C-0237 (“CTSRD”) and FA8750-11-C-0249 (“MRC2”) as part of the DARPA CRASH and DARPA MRC research programs. The views, opinions, and/or findings contained in this report are those of the authors and should not be interpreted as representing the official views or policies, either expressed or implied, of the Department of Defense or the U.S. Government. Additional support was received from St John’s College Cambridge, the SOAAP Google Focused Research Award, the RCUK’s Horizon Digital Economy Research Hub Grant (EP/G065802/1), the EPSRC REMS Programme Grant (EP/K008528/1), the Isaac Newton Trust, the UK Higher Education Innovation Fund (HEIF), and Thales E-Security. Technical reports published by the University of Cambridge Computer Laboratory are freely available via the Internet: http://www.cl.cam.ac.uk/techreports/ ISSN 1476-2986 Abstract This technical report describes CHERI ISAv4, the fourth version of the Capability Hardware Enhanced RISC Instructions (CHERI) Instruction-Set Architecture (ISA)1 being developed by SRI International and the University of Cambridge.
    [Show full text]
  • Docusign City Council Transmittal Coversheet
    DocuSign Envelope ID: 77E59CA4-8312-4131-A8AC-30D35C765194 Docusign City Council Transmittal Coversheet 6470C FILE File Name PCWRP Raw Sewage Pump Station 2 - Change Order #2 Purchasing Contact Cindy Alonzo PUB Target Date July 9, 2018 City Council Target Date July 17, 2018 Contract Value Change Order #2: $137,016.17; Contract: $622,780.17 Piggy Back Option Not Applicable Contract Expiration N/A Ordinance DocuSign Envelope ID: 77E59CA4-8312-4131-A8AC-30D35C765194 EXHIBIT 2 FILE #6470 CHANGE ORDER NO. 2 XXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Approved as to Legal Form: 7/3/2018 By:_________________________ Aaron Leal, City Attorney City of Denton City of Denton Attest: Reviewed by: Approved by: 7/17/2018 PS Arora, P.E. Todd Hileman By:_________________________ Director of Wastewater City Manager Jennifer Walters, City Secretary DocuSign Envelope ID: 77E59CA4-8312-4131-A8AC-30D35C765194 DocuSign Envelope ID: 77E59CA4-8312-4131-A8AC-30D35C765194 DocuSign Envelope ID: 77E59CA4-8312-4131-A8AC-30D35C765194 Exhibit A House Bill 89 - Government Code 2270 VERIFICATION George Brown I, _______________________________________________, the undersigned representative of ______________________________CompanyControl Specialist Services, LP or Business name (hereafter referred to as company), being an adult over the age of eighteen (18) years of age, verify that the company named-above, under the provisions of Subtitle F, Title 10, Government Code Chapter 2270: 1. Does not boycott Israel currently; and 2. Will not boycott Israel during the term of the contract the above-named Company, business or individual with City of Denton. Pursuant to Section 2270.001, Texas Government Code: 1. “Boycott Israel” means refusing to deal with, terminating business activities with, or otherwise taking any action that is intended to penalize, inflict economic harm on, or limit commercial relations specifically with Israel, or with a person or entity doing business in Israel or in an Israeli-controlled territory, but does not include an action made for ordinary business purposes; and 2.
    [Show full text]
  • Memory Tagging and How It Improves C/C++ Memory Safety Kostya Serebryany, Evgenii Stepanov, Aleksey Shlyapnikov, Vlad Tsyrklevich, Dmitry Vyukov Google February 2018
    Memory Tagging and how it improves C/C++ memory safety Kostya Serebryany, Evgenii Stepanov, Aleksey Shlyapnikov, Vlad Tsyrklevich, Dmitry Vyukov Google February 2018 Introduction 2 Memory Safety in C/C++ 2 AddressSanitizer 2 Memory Tagging 3 SPARC ADI 4 AArch64 HWASAN 4 Compiler And Run-time Support 5 Overhead 5 RAM 5 CPU 6 Code Size 8 Usage Modes 8 Testing 9 Always-on Bug Detection In Production 9 Sampling In Production 10 Security Hardening 11 Strengths 11 Weaknesses 12 Legacy Code 12 Kernel 12 Uninitialized Memory 13 Possible Improvements 13 Precision Of Buffer Overflow Detection 13 Probability Of Bug Detection 14 Conclusion 14 Introduction Memory safety in C and C++ remains largely unresolved. A technique usually called “memory tagging” may dramatically improve the situation if implemented in hardware with reasonable overhead. This paper describes two existing implementations of memory tagging: one is the full hardware implementation in SPARC; the other is a partially hardware-assisted compiler-based tool for AArch64. We describe the basic idea, evaluate the two implementations, and explain how they improve memory safety. This paper is intended to initiate a wider discussion of memory tagging and to motivate the CPU and OS vendors to add support for it in the near future. Memory Safety in C/C++ C and C++ are well known for their performance and flexibility, but perhaps even more for their extreme memory unsafety. This year we are celebrating the 30th anniversary of the Morris Worm, one of the first known exploitations of a memory safety bug, and the problem is still not solved.
    [Show full text]
  • Memory Management with Explicit Regions by David Edward Gay
    Memory Management with Explicit Regions by David Edward Gay Engineering Diploma (Ecole Polytechnique F´ed´erale de Lausanne, Switzerland) 1992 M.S. (University of California, Berkeley) 1997 A dissertation submitted in partial satisfaction of the requirements for the degree of Doctor of Philosophy in Computer Science in the GRADUATE DIVISION of the UNIVERSITY of CALIFORNIA at BERKELEY Committee in charge: Professor Alex Aiken, Chair Professor Susan L. Graham Professor Gregory L. Fenves Fall 2001 The dissertation of David Edward Gay is approved: Chair Date Date Date University of California at Berkeley Fall 2001 Memory Management with Explicit Regions Copyright 2001 by David Edward Gay 1 Abstract Memory Management with Explicit Regions by David Edward Gay Doctor of Philosophy in Computer Science University of California at Berkeley Professor Alex Aiken, Chair Region-based memory management systems structure memory by grouping objects in regions under program control. Memory is reclaimed by deleting regions, freeing all objects stored therein. Our compiler for C with regions, RC, prevents unsafe region deletions by keeping a count of references to each region. RC's regions have advantages over explicit allocation and deallocation (safety) and traditional garbage collection (better control over memory), and its performance is competitive with both|from 6% slower to 55% faster on a collection of realistic benchmarks. Experience with these benchmarks suggests that modifying many existing programs to use regions is not difficult. An important innovation in RC is the use of type annotations that make the structure of a program's regions more explicit. These annotations also help reduce the overhead of reference counting from a maximum of 25% to a maximum of 12.6% on our benchmarks.
    [Show full text]
  • Designing and Implementing the OP and OP2 Web Browsers
    Designing and Implementing the OP and OP2 Web Browsers CHRIS GRIER, SHUO TANG and SAMUEL T. KING, University of Illinois at Urbana-Champaign Current web browsers are plagued with vulnerabilities, providing hackers with easy access to computer systems via browser-based attacks. Browser security efforts that retrofit existing browsers have had lim- ited success because the design of modern browsers is fundamentally flawed. To enable more secure web browsing, we design and implement a new browser, called the OP web browser, that attempts to improve the state-of-the-art in browser security. We combine operating system design principles with formal methods to design a more secure web browser by drawing on the expertise of both communities. Our design philosophy is to partition the browser into smaller subsystems and make all communication between subsystems sim- ple and explicit. At the core of our design is a small browser kernel that manages the browser subsystems and interposes on all communications between them to enforce our new browser security features. To show the utility of our browser architecture, we design and implement three novel security features. First, we develop flexible security policies that allow us to include browser plugins within our security framework. Second, we use formal methods to prove useful security properties including user interface invariants and browser security policy. Third, we design and implement a browser-level information-flow tracking system to enable post-mortem analysis of browser-based attacks. In addition to presenting the OP browser architecture, we discuss the design and implementation of a second version of OP, OP2, that includes features from other secure web browser designs to improve on the overall security and performance of OP.
    [Show full text]
  • Exploiting Thread-Related System Calls for Plagiarism Detection of Multithreaded Programs
    See discussions, stats, and author profiles for this publication at: https://www.researchgate.net/publication/303917139 Exploiting Thread-Related System Calls for Plagiarism Detection of Multithreaded Programs Article · June 2016 DOI: 10.1016/j.jss.2016.06.014 CITATION READS 1 126 6 authors, including: Zhenzhou Tian Ting Liu Xi'an University of Posts and Telecommunica… Xi'an Jiaotong University 10 PUBLICATIONS 24 CITATIONS 51 PUBLICATIONS 165 CITATIONS SEE PROFILE SEE PROFILE Qinghua Zheng Zijiang Yang Xi'an Jiaotong University Western Michigan University 246 PUBLICATIONS 1,409 CITATIONS 95 PUBLICATIONS 1,356 CITATIONS SEE PROFILE SEE PROFILE Some of the authors of this publication are also working on these related projects: VACCS: Visualization and Analysis for C Code Security View project All content following this page was uploaded by Zhenzhou Tian on 27 June 2016. The user has requested enhancement of the downloaded file. All in-text references underlined in blue are added to the original document and are linked to publications on ResearchGate, letting you access and read them immediately. The Journal of Systems and Software 119 (2016) 136–148 Contents lists available at ScienceDirect The Journal of Systems and Software journal homepage: www.elsevier.com/locate/jss Exploiting thread-related system calls for plagiarism detection of multithreaded programs ∗ Zhenzhou Tian a, Ting Liu a, , Qinghua Zheng a, Ming Fan a, Eryue Zhuang a, Zijiang Yang b,a a MOEKLINNS, Department of Computer Science and Technology, Xi’an Jiaotong University, Xi’an 710049, China b Department of Computer Science, Western Michigan University, Kalamazoo, MI 49008, USA a r t i c l e i n f o a b s t r a c t Article history: Dynamic birthmarking used to be an effective approach to detecting software plagiarism.
    [Show full text]
  • An Evolutionary Study of Linux Memory Management for Fun and Profit Jian Huang, Moinuddin K
    An Evolutionary Study of Linux Memory Management for Fun and Profit Jian Huang, Moinuddin K. Qureshi, and Karsten Schwan, Georgia Institute of Technology https://www.usenix.org/conference/atc16/technical-sessions/presentation/huang This paper is included in the Proceedings of the 2016 USENIX Annual Technical Conference (USENIX ATC ’16). June 22–24, 2016 • Denver, CO, USA 978-1-931971-30-0 Open access to the Proceedings of the 2016 USENIX Annual Technical Conference (USENIX ATC ’16) is sponsored by USENIX. An Evolutionary Study of inu emory anagement for Fun and rofit Jian Huang, Moinuddin K. ureshi, Karsten Schwan Georgia Institute of Technology Astract the patches committed over the last five years from 2009 to 2015. The study covers 4587 patches across Linux We present a comprehensive and uantitative study on versions from 2.6.32.1 to 4.0-rc4. We manually label the development of the Linux memory manager. The each patch after carefully checking the patch, its descrip- study examines 4587 committed patches over the last tions, and follow-up discussions posted by developers. five years (2009-2015) since Linux version 2.6.32. In- To further understand patch distribution over memory se- sights derived from this study concern the development mantics, we build a tool called MChecker to identify the process of the virtual memory system, including its patch changes to the key functions in mm. MChecker matches distribution and patterns, and techniues for memory op- the patches with the source code to track the hot func- timizations and semantics. Specifically, we find that tions that have been updated intensively.
    [Show full text]
  • The Software Vulnerability Ecosystem: Software Development in the Context of Adversarial Behavior
    University of Pennsylvania ScholarlyCommons Publicly Accessible Penn Dissertations 2016 The Software Vulnerability Ecosystem: Software Development In The Context Of Adversarial Behavior Saender Aren Clark University of Pennsylvania, [email protected] Follow this and additional works at: https://repository.upenn.edu/edissertations Part of the Databases and Information Systems Commons, and the Engineering Commons Recommended Citation Clark, Saender Aren, "The Software Vulnerability Ecosystem: Software Development In The Context Of Adversarial Behavior" (2016). Publicly Accessible Penn Dissertations. 2233. https://repository.upenn.edu/edissertations/2233 This paper is posted at ScholarlyCommons. https://repository.upenn.edu/edissertations/2233 For more information, please contact [email protected]. The Software Vulnerability Ecosystem: Software Development In The Context Of Adversarial Behavior Abstract Software vulnerabilities are the root cause of many computer system security fail- ures. This dissertation addresses software vulnerabilities in the context of a software lifecycle, with a particular focus on three stages: (1) improving software quality dur- ing development; (2) pre- release bug discovery and repair; and (3) revising software as vulnerabilities are found. The question I pose regarding software quality during development is whether long-standing software engineering principles and practices such as code reuse help or hurt with respect to vulnerabilities. Using a novel data-driven analysis of large databases of vulnerabilities, I show the surprising result that software quality and software security are distinct. Most notably, the analysis uncovered a counterintu- itive phenomenon, namely that newly introduced software enjoys a period with no vulnerability discoveries, and further that this “Honeymoon Effect” (a term I coined) is well-explained by the unfamiliarity of the code to malicious actors.
    [Show full text]
  • A Capability-Based Module System for Authority Control∗†
    A Capability-Based Module System for Authority Control∗† Darya Melicher1, Yangqingwei Shi2, Alex Potanin3, and Jonathan Aldrich4 1 Carnegie Mellon University, Pittsburgh, PA, USA 2 Carnegie Mellon University, Pittsburgh, PA, USA 3 Victoria University of Wellington, Wellington, New Zealand 4 Carnegie Mellon University, Pittsburgh, PA, USA Abstract The principle of least authority states that each component of the system should be given author- ity to access only the information and resources that it needs for its operation. This principle is fundamental to the secure design of software systems, as it helps to limit an application’s attack surface and to isolate vulnerabilities and faults. Unfortunately, current programming languages do not provide adequate help in controlling the authority of application modules, an issue that is particularly acute in the case of untrusted third-party extensions. In this paper, we present a language design that facilitates controlling the authority granted to each application module. The key technical novelty of our approach is that modules are first- class, statically typed capabilities. First-class modules are essentially objects, and so we formalize our module system by translation into an object calculus and prove that the core calculus is type- safe and authority-safe. Unlike prior formalizations, our work defines authority non-transitively, allowing engineers to reason about software designs that use wrappers to provide an attenuated version of a more powerful capability. Our approach allows developers to determine a module’s authority by examining the capab- ilities passed as module arguments when the module is created, or delegated to the module later during execution.
    [Show full text]