NDSS 2019 Automating Patching of Vulnerable Open-Source Software Versions in Application Binaries
SESSION 5A-3 Automating Patching of Vulnerable Open-Source Software Versions in Application Binaries
Mobile application developers rely heavily on open-source software (OSS) to offload common functionalities such as the implementation of protocols and media format playback. Over the past years, several vulnerabilities have been found in popular open-source libraries like OpenSSL and FFmpeg. Mobile applications that include such libraries inherit these flaws, which make them vulnerable. Fortunately, the open-source community is responsive and patches are made available within days. However, mobile application developers are often left unaware of these flaws. The App Security Improvement Program (ASIP) is a commendable effort by Google to notify application developers of these flaws, but recent work has shown that many developers do not act on this information.
Our work addresses vulnerable mobile applications through automatic binary patching from source patches provided by the OSS maintainers and without involving the developers. We propose novel techniques to overcome difficult challenges like patching feasibility analysis, source-code-to-binary-code matching, and in-memory patching. Our technique uses a novel variability-aware approach, which we implement as OSSPatcher. We evaluated OSSPatcher with 39 OSS and a collection of 1,000 Android applications using their vulnerable versions. OSSPatcher generated 675 function-level patches that fixed the affected mobile applications without breaking their binary code. Further, we evaluated 10 vulnerabilities in popular apps such as Chrome with public exploits, which OSSPatcher was able to mitigate and thwart their exploitation.
PAPER
https://www.ndss-symposium.org/wp-con...
SLIDES
https://www.ndss-symposium.org/wp-con...
AUTHORS
Ruian Duan (Georgia Institute of Technology)
Ashish Bijlani (Georgia Institute of Technology)
Yang Ji (Georgia Institute of Technology)
Omar Alrawi (Georgia Institute of Technology)
Yiyuan Xiong (Peking University)
Moses Ike (Georgia Institute of Technology)
Brendan Saltaformaggio (Georgia Institute of Technology)
Wenke Lee (Georgia Institute of Technology)
Network and Distributed System Security (NDSS) Symposium 2019, 24-27 February 2019, Catamaran Resort Hotel & Spa in San Diego, California.
https://www.ndss-symposium.org/ndss-p...
ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.
https://www.ndss-symposium.org/
#NDSS #NDSS19 #NDSS2019 #InternetSecurity