NDLI: Risk Assessment of Buffer "Heartbleed" Over-Read Vulnerabilities

Content Provider	IEEE Xplore Digital Library
Author	Jun Wang Mingyi Zhao Qiang Zeng Dinghao Wu Peng Liu
Copyright Year	2015
Description	Author affiliation: Pennsylvania State Univ., University Park, PA, USA (Jun Wang; Mingyi Zhao; Qiang Zeng; Dinghao Wu; Peng Liu)
Abstract	Buffer over-read vulnerabilities (e.g., Heartbleed) can lead to serious information leakage and monetary lost. Most of previous approaches focus on buffer overflow (i.e., over-write), which are either infeasible (e.g., canary) or impractical (e.g., bounds checking) in dealing with over-read vulnerabilities. As an emerging type of vulnerability, people need in-depth understanding of buffer over-read: the vulnerability, the security risk and the defense methods. This paper presents a systematic methodology to evaluate the potential risks of unknown buffer over-read vulnerabilities. Specifically, we model the buffer over-read vulnerabilities and focus on the quantification of how much information can be potentially leaked. We perform risk assessment using the RUBiS benchmark which is an auction site prototype modeled after eBay.com. We evaluate the effectiveness and performance of a few mitigation techniques and conduct a quantitative risk measurement study. We find that even simple techniques can achieve significant reduction on information leakage against over-read with reasonable performance penalty. We summarize our experience learned from the study, hoping to facilitate further studies on the over-read vulnerability.
Starting Page	555
Ending Page	562
File Size	390153
Page Count	8
File Format	PDF
e-ISBN	9781479986293
DOI	10.1109/DSN.2015.59
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2015-06-22
Publisher Place	Brazil
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Risk management Measurement Payloads Benchmark testing Memory management Heart rate variability Entropy
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Risk Assessment of Buffer “Heartbleed ” Over-read Vulnerabilities

Improving cache performance using read-write partitioning

Rule-Based Source Level Patching of Buffer Overflow Vulnerabilities

A combinatorial approach to detecting buffer overflow vulnerabilities

Non-linear analysis of heart rate variability in patients with coronary heart disease

Multiscale entropy to distinguish physiologic and synthetic RR time series

Information entropy and dimension calculation on heart rate variability

Information dynamics in cardiorespiratory time series during mental stress testing

Heart Rate Variability Monitoring and Assessment System on Chip

Risk Assessment of Buffer "Heartbleed" Over-Read Vulnerabilities

Similar Documents

Risk Assessment of Buffer “Heartbleed ” Over-read Vulnerabilities

Improving cache performance using read-write partitioning

Rule-Based Source Level Patching of Buffer Overflow Vulnerabilities

A combinatorial approach to detecting buffer overflow vulnerabilities

Non-linear analysis of heart rate variability in patients with coronary heart disease

Multiscale entropy to distinguish physiologic and synthetic RR time series

Information entropy and dimension calculation on heart rate variability

Information dynamics in cardiorespiratory time series during mental stress testing

Heart Rate Variability Monitoring and Assessment System on Chip

Risk Assessment of Buffer "Heartbleed" Over-Read Vulnerabilities