NDLI: Automatic detection of unsafe component loadings

Please wait, while we are loading the content...

Proving memory safety of floating-point computations by combining static and dynamic program analysis

Directed test generation for effective fault localization

Generating test cases for specification mining

Automatic detection of unsafe component loadings

Automated analysis of load testing results

Mutation-driven generation of unit tests and oracles

Parallel symbolic execution for structural test generation

Formal analysis of the effectiveness and predictability of random testing

Analyzing concurrency bugs using dual slicing

Software fault prediction tool

Strict control dependence and its effect on dynamic information flow analyses

Automated fixing of programs with contracts

Modeling consumer-perceived web application fault severities for testing

Learning from 6,000 projects: lightweight cross-project anomaly detection

OCAT: object capture-based automated testing

Exploiting program dependencies for scalable multiple-path symbolic execution

A study on agility and testing processes in software organizations

N-version disassembly: differential testing of x86 disassemblers

ASSURE: automated support for secure and usable requirements engineering

Analysis of invariants for efficient bounded verification

Causal inference for statistical fault localization

Perturbing numerical calculations for statistical analysis of floating-point program (in)stability

Testing system virtual machines

On test repair using symbolic execution

The Google FindBugs fixit

Automatically identifying critical input regions and code in applications

Automatic detection of unsafe component loadings

Content Provider	ACM Digital Library
Author	Su, Zhendong Kwon, Taeho
Abstract	Dynamic loading of software components (e.g., libraries or modules) is a widely used mechanism for improved system modularity and flexibility. Correct component resolution is critical for reliable and secure software execution, however, programming mistakes may lead to unintended or even malicious components to be resolved and loaded. In particular, dynamic loading can be hijacked by placing an arbitrary file with the specified name in a directory searched before resolving the target component. Although this issue has been known for quite some time, it was not considered serious because exploiting it requires access to the local file system on the vulnerable host. Recently such vulnerabilities started to receive considerable attention as their remote exploitation became realistic; it is now important to detect and fix these vulnerabilities. In this paper, we present the first automated technique to detect vulnerable and unsafe dynamic component loadings. Our analysis has two phases: 1) apply dynamic binary instrumentation to collect runtime information on component loading (online phase); and 2) analyze the collected information to detect vulnerable component loadings (offline phase). For evaluation, we implemented our technique to detect vulnerable and unsafe DLL loadings in popular Microsoft Windows software. Our results show that unsafe DLL loading is prevalent and can lead to serious security threats. Our tool detected more than 1,700 unsafe DLL loadings in 28 widely used software and discovered serious attack vectors for remote code execution. Microsoft has opened a Microsoft Security Response Center (MSRC) case on our reported issues and is working with us and other affected software vendors to develop necessary patches.
Starting Page	107
Ending Page	118
Page Count	12
File Format	PDF
ISBN	9781605588230
DOI	10.1145/1831708.1831722
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2010-07-12
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Dynamic analysis Unsafe component loading
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Automatic Detection of Unsafe Dynamic Component Loadings

Automated diagnosis and prevention of unsafe dynamic software component loadings

Automatic detection of unsafe component loadings (2010).

Automatic detection of vulnerable dynamic component loadings.

Static detection of unsafe component loadings.

EFA for structure detection in image data

Detecting Unsafe Component Loadings using Static Techniques

Response Analysis of Asphalt Pavement under Dynamic Loadings: Loading Equivalence

2d correlation analysis of loadings spectra of pca.

Automatic detection of unsafe component loadings

Similar Documents

Automatic Detection of Unsafe Dynamic Component Loadings

Automated diagnosis and prevention of unsafe dynamic software component loadings

Automatic detection of unsafe component loadings (2010).

Automatic detection of vulnerable dynamic component loadings.

Static detection of unsafe component loadings.

EFA for structure detection in image data

Detecting Unsafe Component Loadings using Static Techniques

Response Analysis of Asphalt Pavement under Dynamic Loadings: Loading Equivalence

2d correlation analysis of loadings spectra of pca.

Automatic detection of unsafe component loadings