NDLI: Memsherlock: an automated debugger for unknown memory corruption vulnerabilities

Please wait, while we are loading the content...

An analysis of browser domain-isolation bugs and a light-weight transparent defense mechanism

Do background images improve "draw a secret" graphical passwords?

Blacklistable anonymous credentials: blocking misbehaving users without ttps

Automated detection of persistent kernel control-flow attacks

Shunting: a hardware/software architecture for flexible, high-performance network intrusion prevention

Robust computational secret sharing and a unified account of classical secret-sharing goals

Optimal security hardening using multi-objective optimization on attack tree models of networks

Split-ballot voting: everlasting privacy with distributed trust

An information-theoretic model for adaptive side-channel attacks

Polyglot: automatic extraction of protocol message format using dynamic binary analysis

ConceptDoppler: a weather tracker for internet censorship

Hardware-rooted trust for secure key management and transient trust

Protecting browsers from dns rebinding attacks

Provably secure ciphertext policy ABE

Secure two-party k-means clustering

Predicting vulnerable software components

Information disclosure under realistic assumptions: privacy versus optimality

Assurance and evaluation: what next?

CANDID: preventing sql injection attacks using dynamic candidate evaluations

Beamauth: two-factor web authentication with a bookmark

How much anonymity does network latency leak?

Panorama: capturing system-wide information flow for malware detection and analysis

Highly efficient techniques for network forensics

Chosen-ciphertext secure proxy re-encryption

On the accuracy of decentralized virtual coordinate systems in adversarial networks

An independent audit framework for software dependent voting systems

Covert channels in privacy-preserving identification systems

Harvesting verifiable challenges from oblivious online sources

Asirra: a CAPTCHA that exploits interest-aligned manual image categorization

Robust key generation from signal envelopes in wireless networks

Alpaca: extensible authorization for distributed services

Security under key-dependent inputs

Privacy-preserving remote diagnostics

On the infeasibility of modeling polymorphic shellcode

Pors: proofs of retrievability for large files

Multi-module vulnerability analysis of web-based applications

Dynamic pharming attacks and locked same-origin policies for web browsers

Denial of service or denial of security?

Stealthy malware detection through vmm-based "out-of-the-box" semantic view reconstruction

Preserving privacy in gps traces via uncertainty-aware path cloaking

Attribute-based encryption with non-monotonic access structures

Analyzing the vulnerability of superpeer networks against attack

Forward-secure signatures in untrusted update environments: efficient and generic constructions

Detecting covert timing channels: an entropy-based approach

Filtering spam with behavioral blacklisting

An inquiry into the nature and causes of the wealth of internet miscreants

Robust group key agreement using short broadcasts

Efficient policy analysis for administrative role based access control

Cryptanalysis of the windows random number generator

Automaton segmentation: a new approach to preserve privacy in xml information brokering

The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86)

Provable data possession at untrusted stores

Towards automated provisioning of secure virtualized networks

Ordered multisignatures and identity-based sequential aggregate signatures, with applications to secure routing

Privacy preserving error resilient dna searching through oblivious automata

Memsherlock: an automated debugger for unknown memory corruption vulnerabilities

Memsherlock: an automated debugger for unknown memory corruption vulnerabilities

Content Provider	ACM Digital Library
Author	Sezer, Emre C. Xu, Jun Ning, Peng Kil, Chongkyung
Abstract	Software vulnerabilities have been the main contributing factor to the Internet security problems such as fast spreading worms. Among these software vulnerabilities, memory corruption vulnerabilities such as buffer overflow and format string bugs have been the most common ones exploited by network-based attacks. Many security countermeasures (e.g., patching, automatic signature generation for intrusion detection systems) require vulnerability information to function correctly. However, despite many years of research, automatically identifying unknown software vulnerabilities still remains an open problem. In this paper, we present the development of a security debugging tool named MemSherlock, which can automatically identify unknown memory corruption vulnerabilities upon the detection of malicious payloads that exploit such vulnerabilities. MemSherlock provides critical information for unknown memory corruption vulnerabilities, including (1) the corruption point in the source code (i.e., the statement that allows the exploitation of memory corruption vulnerability), (2) the slice of source code that helps the malicious input to reach the corruption point, and (3) the description of how the malicious input exploits the unknown vulnerability. We evaluate MemSherlock with a set of 11 real-world applications that have buffer overflow, heap overflow, and format string vulnerabilities. The evaluation results indicate that MemSherlock is a useful tool to facilitate the automatic vulnerability analysis process.
Starting Page	562
Ending Page	572
Page Count	11
File Format	PDF
ISBN	9781595937032
DOI	10.1145/1315245.1315314
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2007-10-28
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Memory corruption Debugging Vulnerability analysis
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in