Unknown Vulnerabilities Research Articles

REDT: Remote exploitation detection technology for network infrastructure

An attacker exploits a remote vulnerability to execute arbitrary code on network infrastructure. It seriously threatens the security of network infrastructure. To detect the exploitation attack in a timely and effective way, in this paper, we present REDT, a remote exploitation detection technology based on the effect of exploitation attack. This method determines whether there is an authentication bypass exploitation by detecting the remote authentication process and saves attack traffic to the anomalous traffic database. With the database, we can replay the attack and analyze the exploitation. In the experiment, the detection accuracy rate reached 97.67%. In addition, this method does not rely on the signatures of the vulnerability and shellcode, so it can detect undisclosed vulnerabilities exploitation and provide abnormal traffic for the study of unknown vulnerabilities.

Detecting nondeterministic payment bugs in Ethereum smart contracts

The term “smart contracts” has become ubiquitous to describe an enormous number of programs uploaded to the popular Ethereum blockchain system. Despite rapid growth of the smart contract ecosystem, errors and exploitations have been constantly reported from online contract systems, which has put financial stability at risk with losses totaling millions of US dollars. Most existing research focuses on pinpointing specific types of vulnerabilities using known patterns. However, due to the lack of awareness of the inherent nondeterminism in the Ethereum blockchain system and how it affects the funds transfer of smart contracts, there can be unknown vulnerabilities that may be exploited by attackers to access numerous online smart contracts. In this paper, we introduce a methodical approach to understanding the inherent nondeterminism in the Ethereum blockchain system and its (unwanted) influence on contract payments. We show that our new focus on nondeterminism-related smart contract payment bugs captures the root causes of many common vulnerabilities without relying on any known patterns and also encompasses recently disclosed issues that are not handled by existing research. To do so, we introduce techniques to systematically model components in the contract execution context and to expose various nondeterministic factors that are not yet fully understood. We further study how these nondeterministic factors impact contract funds transfer using information flow tracking. The technical challenge of detecting nondeterministic payments lies in discovering the contract global variables subtly affected by read-write hazards because of unpredictable transaction scheduling and external callee behavior. We show how to augment and instrument a contract program into a representation that simulates the execution of a large subset of the contract behavior. The instrumented code is then analyzed to flag nondeterministic global variables using off-the-shelf model checkers. We implement the proposed techniques as a practical tool named NPChecker (Nondeterministic Payment Checker) and evaluate it on 30K online contracts (3,075 distinct) collected from the Ethereum mainnet. NPChecker has successfully detected nondeterministic payments in 1,111 online contracts with reasonable cost. Further investigation reports high precision of NPChecker (only four false positives in a manual study of 50 contracts). We also show that NPChecker unveils contracts vulnerable to recently-disclosed attack vectors. NPChecker can identify all six new vulnerabilities or variants of common smart contract vulnerabilities that are missed by existing research relying on a “contract vulnerability checklist.”

Polar

Industrial Control System (ICS) protocols are widely used to build communications among system components. Compared with common internet protocols, ICS protocols have more control over remote devices by carrying a specific field called “function code”, which assigns what the receive end should do. Therefore, it is of vital importance to ensure their correctness. However, traditional vulnerability detection techniques such as fuzz testing are challenged by the increasing complexity of these diverse ICS protocols. In this paper, we present a function code aware fuzzing framework — Polar, which automatically extracts semantic information from the ICS protocol and utilizes this information to accelerate security vulnerability detection. Based on static analysis and dynamic taint analysis, Polar initiates the values of the function code field and identifies some vulnerable operations. Then, novel semantic aware mutation and selection strategies are designed to optimize the fuzzing procedure. For evaluation, we implement Polar on top of two popular fuzzers — AFL and AFLFast, and conduct experiments on several widely used ICS protocols such as Modbus, IEC104, and IEC 61850. Results show that, compared with AFL and AFLFast, Polar achieves the same code coverage and bug detection numbers at the speed of 1.5X-12X. It also gains increase with 0%--91% more paths within 24 hours. Furthermore, Polar has exposed 10 previously unknown vulnerabilities in those protocols, 6 of which have been assigned unique CVE identifiers in the US National Vulnerability Database.

Instruction2vec: Efficient Preprocessor of Assembly Code to Detect Software Weakness with CNN

Potential software weakness, which can lead to exploitable security vulnerabilities, continues to pose a risk to computer systems. According to Common Vulnerability and Exposures, 14,714 vulnerabilities were reported in 2017, more than twice the number reported in 2016. Automated vulnerability detection was recommended to efficiently detect vulnerabilities. Among detection techniques, static binary analysis detects software weakness based on existing patterns. In addition, it is based on existing patterns or rules, making it difficult to add and patch new rules whenever an unknown vulnerability is encountered. To overcome this limitation, we propose a new method—Instruction2vec—an improved static binary analysis technique using machine. Our framework consists of two steps: (1) it models assembly code efficiently using Instruction2vec, based on Word2vec; and (2) it learns the features of software weakness code using the feature extraction of Text-CNN without creating patterns or rules and detects new software weakness. We compared the preprocessing performance of three frameworks—Instruction2vec, Word2vec, and Binary2img—to assess the efficiency of Instruction2vec. We used the Juliet Test Suite, particularly the part related to Common Weakness Enumeration(CWE)-121, for training and Securely Taking On New Executable Software of Uncertain Provenance (STONESOUP) for testing. Experimental results show that the proposed scheme can detect software vulnerabilities with an accuracy of 91% of the assembly code.

How might we increase system trustworthiness?

Summarizing some of the changes that seem increasingly necessary to address known system and network deficiencies and anticipate currently unknown vulnerabilities.

Whole‐lung pathology of pleuroparenchymal fibroelastosis (PPFE) in an explanted lung: Significance of elastic fiber‐rich, non‐specific interstitial pneumonia‐like change in chemotherapy‐related PPFE

Pleuroparenchymal fibroelastosis (PPFE) is characterized by upper lobe-predominant subpleural fibroelastosis. Despite its characteristic uneven distribution, detailed whole-lung pathological features of PPFE have rarely been studied. We investigated PPFE in the explanted lungs from a 19-year-old male patient with a history of chemotherapy. Grossly, the explanted lungs showed upper lobe-predominant shrinkage with subpleural and central consolidation. Histologically, fibroelastosis was prominent in the perilobular areas and along the bronchovascular bundles. The other areas of the lung showed diffuse, non-specific interstitial pneumonia (NSIP)-like change with a characteristic increase of septal elastic fibers. In the digital image analysis, the ratio of elastic fibers to whole fibrosis (EF score) was lower in the subpleural areas than in the NSIP-like lesions, but the EF scores of the latter showed no significant difference between upper and middle/lower lobes. In the present case, the diffusely distributed elastic fiber-rich NSIP-like change, probably caused by the earlier chemotherapy, may have been conducive to the development of PPFE. This suggests that some unknown vulnerability of the upper lobe may exist, various primary lesions converging to the upper lobe predominance of PPFE.

Research on Mimic Defense Technology and Security Test Method of Electric Power Web Service System

In this paper, aiming at the demand of active defense against attacks in the environment of "poisonous bacteria" in electric power web service system, the mimic defense technology of electric power web service system based on dynamic transformation of resources and heterogeneous redundant executors is proposed. The dynamic environment is realized through active changes of software and hardware elements at different levels, thus destroying the deterministic and persistent dependency conditions of the attack chain on the operating environment, blocking the network attack chain, solving the problem of unknown attack defense using unknown vulnerabilities and unknown backdoors, and effectively enhancing the network security of key Web application systems in the power industry. On this basis, in order to verify the security of mimic defense technology in electric power web service system, a security test method is given to verify the feasibility and effectiveness of mimic defense technology on web.

Mimic Defense Structured Information System Threat Identification and Centralized Control

With the speeding up of the informatization process of our national economy and social development, the degree of informatization in our country is getting higher and higher. Information system has become the key infrastructure of our country. The security of these basic information networks and important information systems has been seriously related to national security and social stability, to the collective interests of enterprises, and to the vital interests of the broad masses of the people. Increasing application in improving work efficiency and economic benefits at the same time, the increasingly com-plex information system has also brought greater challenges to operation and maintenance managers. The use of known or unknown vulnerabilities, causing damage to information systems, stealing sensitive information, endangering the normal operation of business systems and other behaviors, has become one of the main causes of various security incidents. How to effectively deal with the vulnerability threat and various vulnerability problems of enterprise information systems, concentrate on the implementation of information security vulnerability warning related risks, and provide solutions to related vulnerability threats, have become an urgent problem to be solved. Therefore, we construct the mimic structured enterprise information system by establishing the threat identification system through unified management to form a comprehensive and secure cyber threat management system.

Resilience in Intelligent Transportation Systems (ITS)

Many cities are adopting increasingly advanced Intelligent Transportation Systems (ITS). These systems combine connectivity, coordination, adaptivity, and automated response for transportation policy optimization, thus increasing “smartness” and efficiency. However, the control and sensing systems of implemented ITS can open new vulnerabilities, especially to cyber-attacks. Currently vulnerability is managed within the framework of traditional risk assessment that assesses potential failures of the system in response to specified threats. Emerging technologies by their nature have threats that are not fully known, therefore, resilience, defined as the system's ability to recover and adapt to both known and unknown threats, is an emerging area that holds promise for assessing threats to ITS. To illustrate the applicability of resilience to ITS, we conducted a study of network efficiency and resilience in response to random and targeted disruptions of ITS systems in 10 urban areas. Disruptions were generated to affect either intersections or roadways controlled by ITS under different threat scenarios. Modeled attacks, under worst case scenarios, disrupted 20% of intersections causing on average 14.6% more additional delays than the same severity attacks on roadways. Additionally, locking traffic signal states was found to cause more disruption than fully disabling signals. Thus, as cities adopt ITS and other smart systems resulting in potentially unknown vulnerabilities, it is important to consider resilience of transportation infrastructure affected by potential cyber-attacks.

Unknown Vulnerability Risk Assessment Based on Directed Graph Models: A Survey

Nowadays, vulnerability attacks occur frequently. Due to the information asymmetry between attackers and defenders, vulnerabilities can be divided into known and unknown. Existing researches mainly focus on the risk assessment of known vulnerabilities. However, unknown vulnerabilities are more threatening and harder to detect. Therefore, unknown vulnerability risk assessment deserves the widespread attention. To model the exploit process, directed graph models are applied to vulnerability risk assessment. And security metrics are used to quantify the exploitability of vulnerabilities. In this paper, according to the data source of nodes, related works of unknown vulnerability risk assessment based on directed graph models are divided into two types. One is based on network-level data, the other is based on system-level data. The former is to visualize the network status, while the latter is to reflect the running process of the system. The concept and purpose of these directed graph models are given at first. Then, these models are analyzed from three aspects, including advantages, flaws and solutions. After that, challenges and solutions of unknown vulnerability risk assessment based on directed graph models are given. Meantime, security metrics for unknown vulnerability risk assessment based on directed graph models are summarized and classified. Finally, future work directions of unknown vulnerability risk assessment are discussed from the perspective of techniques and application trends. Consequently, this paper can fill in the lack of current survey on unknown vulnerability risk assessment based on directed graph models.

LearnAFL: Greybox Fuzzing With Knowledge Enhancement

Mutation-based greybox fuzzing is a highly effective and widely used technique to find bugs in software. Provided initial seeds, fuzzers continuously generate test cases to test the software by mutating a seed input. However, the majority of them are “invalid” because the mutation may destroy the format of the seeds. In this paper, we present a knowledge-learn evolutionary fuzzer based on AFL, which is called LearnAFL. LearnAFL does not require any prior knowledge of the application or input format. Based on our format generation theory, LearnAFL can learn partial format knowledge of some paths by analyzing the test cases that exercise the paths. Then LearnAFL uses these format information to mutate the seeds, which is efficient to explore deeper paths and reduce the test cases exercising high-frequency paths than AFL. We compared LearnAFL with AFL and some other state-of-the-art fuzzers on ten real-world programs. The result showed that LearnAFL could reach branch coverage 120% and 110% of that of AFL and FairFuzz, respectively. LearnAFL also found 8 unknown vulnerabilities in GNU Binutils, Libpng and Gif2png, all of which have been reported to the vendors. Besides, we compared the format information learned from the initial seed of an ELF file with a format standard of ELF files. The result showed that LearnAFL learns about 64% part of the file format without any prior knowledge.

Network Malware Laboratory BasedOn Honeypots Technologies

According to studies conducted by researchers across the globe, in recent years there has been an increase in organization and company attacks. Some attacks have been detected, but others, however, were able to bypass the security mechanisms, taking advantage of an unknown vulnerability in security systems. In this context, Honeypots systems aim to collect information on the intruder’s activities and learn about threats and attackers’ behavior. Honeypots systems are not designed to remedy failures or security errors on the network, but are responsible for providing adequate information on potential attackers before compromising real systems. In this paper, a honeypot system was designed to study the techniques used by attackers. We designed and implemented a malware analysis laboratory based on honeypots technology in a controlled environment to analyze various security incidents. The use of honeypots is based on the idea of simulating applications with vulnerabilities and recording all events produced by attackers, so the network administrator can learn about the different types of attacks to protect organizational systems that are being produced. The results have been very important in terms of the number and types of security incidents recorded by the honeypots. Also, an administration interface for controlling and analyzing the gathered information was designed. This system was not only implemented but also tested for several weeks and data was collected from the attacks was analyzed. This led to some interesting statistics and characteristics about attackers and their goals.

Reverse Engineering IoT Devices: Effective Techniques and Methods

Recent Internet of Things (IoT) botnet attacks have called the attention to the fact that there are many vulnerable IoT devices connected to the Internet today. Some of these Web-connected devices lack even basic security practices such as strong password authentication. As a consequence, many IoT devices are already infected with malware and many more are vulnerable to exploitation. In this paper we analyze the security level of 16 popular IoT devices. We evaluate several low-cost black-box techniques for reverse engineering these devices, including software and fault injection-based techniques used to bypass password protection. We use these techniques to recover device firmware and passwords. We also discover several common design flaws which lead to previously unknown vulnerabilities. We demonstrate the effectiveness of our approach by modifying a laboratory version of the Mirai botnet to automatically add these devices to a botnet. We also discuss how to improve the security of IoT devices without significantly increasing their cost or affecting their usability.

Identification of Novel Lncrnas That Predict Survival in AML Patients and Modulate Leukemic Cells

Long noncoding RNAs (lncRNAs) have complex, mainly chromatin-associated functions and their expression is highly coordinated and cell-type specific. Based on their tight regulation in normal differentiation, we set out to investigate whether lncRNAs are dysregulated in diseases where differentiation is impaired, such as in acute myeloid leukemia (AML). To identify lncRNAs that are essential for both normal hematopoiesis as well as AML maintenance, we sequenced the long polyA- and non-polyA-tagged transcriptome from successive stages of human myelopoiesis (myeloblasts, promyelocytes, metamyelocytes, and neutrophils) isolated from bone marrow of healthy donors (n=3). Applying a high-dimensional data portraying approach (OposSOM, Löffler-Wirth et al., BMC Bioinformatics, 2015), we identified functional expression modules of lncRNAs that are either positively or negatively associated with myeloid lineage commitment in our dataset. Seven out of the top15 differentiation-associated lncRNAs exhibit significant prognostic relevance in overall and event-free survival analyses of independent AML patient datasets and improve the predictive power of the current prognosis standards (cytogenetic risk/age/TP53-status). In particular, a combination of 3 transcripts, PROMYS (Promoter of Myelopoiesis, annotated as uncharacterized ncRNA LOC107985167), ANTAMY (Antagonist of Myelopoiesis, uncharacterized ncRNA LOC101927745) and LINC00677, outperformed the recently reported prognostic benefit of the LSC17high score (Ng et al, Nature, 2016) by a factor of Ø 22.7 based on concordance index score increase (Ø 4.8% vs. 0.21%).All three lncRNAs are highly conserved, expressed in 10 tested human AML cell lines as well as significantly differentially expressed in distinct cytogenetic patient subgroups of The Cancer Genome Atlas (TCGA) LAML cohort (n=171). PROMYS is downregulated in t(15;17) and t(8;21) cases, supporting its strong association with worse OS in the TCGA-LAML dataset (p=0.0001). In contrast, ANTAMY shows high expression in AML with t(8;21), and LINC00677 in NPM1+/FLT3- mutated AML patient samples with normal karyotype (CN-AML) and in core Binding factor (CBF) AMLs. Accordingly, high expression levels of both lncRNAs associate with a significantly better OS in the TCGA LAML dataset (p=0.01 and 0.02, respectively).To investigate their function in vitro, we knocked out each lncRNA individually in the human OCI/AML-5 AML cell line using CRISPR/Cas9. Loss of ANTAMY impaired proliferation (p=0.04) and increased both monocytic differentiation upon treatment with 2-0-tetradecanoylphorbol-13-acetate (TPA) (p=0.0001) and granulocytic differentiation with all-trans retinoic acid (ATRA) (p=0.0002) compared to the empty vector control. Loss of LINC00677 in OCI/AML-5 cells specifically increased granulocytic differentiation through ATRA (p=0.0002). In contrast, inactivation of PROMYS led to reduced differentiation induced by ATRA (p=0.00004) and TPA (p=0.002). Furthermore, we found that PROMYS is involved in the regulation of the Macrophage colony-stimulating factor 1 (CSF1), which is deregulated in ATRA- and TPA-induced differentiation in PROMYS knockout but not in control cells (p<0.002 and <0.00002, respectively), explaining its negative impact on differentiation. Through screening of human myelopoiesis, we identified three unexplored lncRNAs: LINC00677, PROMYS, and ANTAMY, which play a role in myeloid differentiation and have an impact on patient prognosis. Our in vitro findings confirm that ANTAMY, LINC00677, and PROMYS are active modulators of leukemic cells, which influence their proliferation, morphology, myeloid marker expression as well as apoptosis rate. These transcripts and their interaction partners add an additional layer of regulation to the understanding of differentiation and might represent previously unknown vulnerabilities of AML cells, which warrants their further investigation in vivo. DisclosuresNo relevant conflicts of interest to declare.

Technological and Human Factors of Malware Attacks

The success (or failure) of malware attacks depends upon both technological and human factors. The most security-conscious users are susceptible to unknown vulnerabilities, and even the best security mechanisms can be circumvented as a result of user actions. Although there has been significant research on the technical aspects of malware attacks and defence, there has been much less research on how users interact with both malware and current malware defences. This article describes a field study designed to examine the interactions between users, antivirus (AV) software, and malware as they occur on deployed systems. In a fashion similar to medical studies that evaluate the efficacy of a particular treatment, our experiment aimed to assess the performance of AV software and the human risk factors of malware attacks. The 4-month study involved 50 home users who agreed to use laptops that were instrumented to monitor for possible malware attacks and gather data on user behaviour. This study provided some very interesting, non-intuitive insights into the efficacy of AV software and human risk factors. AV performance was found to be lower under real-life conditions compared to tests conducted in controlled conditions. Moreover, computer expertise, volume of network usage, and peer-to-peer activity were found to be significant correlates of malware attacks. We assert that this work shows the viability and the merits of evaluating security products, techniques, and strategies to protect systems through long-term field studies with greater ecological validity than can be achieved through other means.

Research on Key Technology of Web Application Security Test Platform

With the continuous deepening and popularization of Web applications, the corresponding Web vulnerabilities and malicious attacks emerge in an endless stream, making it efficient and accurate to evaluate the security of Web applications. In this paper, Web application security testing technology, building plug-in and extensible security testing technology framework, and the key technologies of unknown vulnerability intelligence discovery and supporting self defined test tool integration are studied. In the runtime and runtime of Web application, security scanning and risk discovery can be strengthened by platform. It can enhance the safety detection of Web application and ensure the safe and reliable operation of Web application.

Untrusted Hardware Causes Double-Fetch Problems in the I/O Memory

The double fetch problem occurs when the data is maliciously changed between two kernel reads of the supposedly same data, which can cause serious security problems in the kernel. Previous research focused on the double fetches between the kernel and user applications. In this paper, we present the first dedicated study of the double fetch problem between the kernel and peripheral devices (aka. the hardware double fetch). Operating systems communicate with peripheral devices by reading from and writing to the device mapped I/O (input and output) memory. Owing to the lack of effective validation of the attached hardware, compromised hardware could flip the data between two reads of the same I/O memory address, causing a double fetch problem. We propose a static pattern-matching approach to identify the hardware double fetches from the Linux kernel. Our approach can analyze the entire kernel without relying on the corresponding hardware. The results are categorized and each category is analyzed using case studies to discuss the possibility of causing bugs. We also find four previously unknown double-fetch vulnerabilities, which have been confirmed and fixed after reporting them to the maintainers.

Mimic defense: a designed‐in cybersecurity defense framework

In recent years, both academia and industry in cyber security have tried to develop innovative defense technologies, expecting that to change the rules of the game between attackers and defenders. The authors start by analysing the root causes of security problems in cyberspace: (i) vulnerabilities in cyber systems are universal; (ii) current cyber systems are static, predictable and monoculture which allows adversaries to plan and launch attacks effectively; (iii) existing techniques cannot detect and eliminates attacks employing unknown vulnerabilities. Based on their analysis, they develop a novel defense framework, mimic defense (MD), that employs ‘dynamic, heterogeneity, redundancy (DHR)’ mechanism to defense cyber attacks. The main ideas behind MD are: constructing diverse functional equivalent variants for the protected target; scheduling some variants to run in parallel dynamically; and adopting policy-based arbitration mechanism to decide whose results of current running variants are correct. Theoretical analysis and simulation results show that DHR can significantly increase the difficulties for attackers and enhance the security of cyber systems, and the security enhancement can be more than ten times. They also present a proof-of-principle prototype that employ MD, mimic router, to examine its effectiveness. Finally, they conclude its limitations.

Stochastic modeling of self-evolving botnets with vulnerability discovery

Machine learning techniques have been actively studied and achieved significant performance improvements in various kinds of tasks. While we benefit from such techniques in many ways, they can be a serious security threat to the Internet if malicious attackers become able to utilize them to discover unknown software vulnerabilities. This paper introduces a new concept of self-evolving botnets, where computing resources of infected hosts are exploited to discover unknown vulnerabilities in non-infected hosts and the botnets evolve autonomously. We provide a stochastic epidemic model for the self-evolving botnets, and show its behaviors through numerical and simulation experiments.

Known unknowns: Conservation and research priorities for soft sediment fauna that supports a valuable SCUBA diving industry

Wildlife tourism can provide sustainable livelihoods, but can also significantly impact vulnerable species if improperly managed. To manage these impacts whilst continuing to support livelihoods, it is important to know the interests of tourists. Using the Best-Worst scaling method, we identified taxa that were most important to scuba dive tourism on shallow soft sediment habitats in Southeast Asia. We further identified differences in interest between demographic groups. We then investigated the current conservation status and research effort into the species driving this branch of tourism. The highest ranked taxa included fishes and invertebrates such as cephalopods and crustaceans. More than 200 respondents indicated that the species most important to muck dive tourism are mimic octopus/wunderpus, blue ringed octopus, rhinopias, flamboyant cuttlefish and frogfish. Diver interests were most influenced by sex, age and dive experience. The extinction risk of six of the top ten species has not yet been assessed by the International Union for Conservation of Nature. On average, the species driving this multi-million dollar tourism industry had less than one paper published every two years over the past two decades. The lack of research and conservation effort toward these species is at odds with their economic and social importance. Considering their high economic tourism value and unknown vulnerability, there is an urgent need for more research on fauna from shallow soft sediment and other habitats important to tourism.