Vulnerability Discovery Research Articles

Elite sense-making in the core executive: the case of Denmark’s 2020 Minkgate Scandal

Abstract This article analyzes the Danish Mink Scandal of 2020 using Karl Weick’s sense-making theory. It zooms in on the 72-hour decision-making process that led to the culling of Denmark’s entire 17 million farmed-for-fur mink population in response to the perceived threat of coronavirus disease 2019 (COVID-19) forming a new mutation. Since there was insufficient legal justification for the culling, the prime minister was forced to call a snap general election, leading to a change of government. We exploit detailed data material containing text messages, e-mail correspondence, documentary material, and specific inquiries. The article demonstrates the strength of Weick’s social–psychological perspective on sense-making for public management research. It shows how time pressure can cut across heavily institutionalized standard operating procedures. It can increase the centralization of the decision-making power at the apex and decouple the formal legal responsibilities, which remain institutionalized with the line ministries. The study argues that sense-making offers learning points that cannot be obtained from formal legal perspectives, which are used to assign responsibilities. Indeed, ex-post thinking may be too convenient—traditional solutions like punishing leaders or agencies may obscure the discovery of more systemic vulnerabilities when crises unfold.

Minimising cybersecurity risk exposures in industrial control system environments: a techno-human vulnerability analysis approach

ABSTRACT Organisations operating IoT-enabled industrial control systems (ICSs) are concerned about growing cybersecurity risks and impacts to their systems. Cyber-attacks on ICSs demonstrate that technology alone is neither a problem nor a solution to the growing cybersecurity issues affecting these systems. As socio-technical systems, ICSs encompass the functions and interactions of social and technological system elements to enable and/or sustain industrial processes. Thus, a more effective cybersecurity risk management process needs to consider human and technology factors, especially for high-value industrial process targets. Combining critical reviews and gap analysis of existing vulnerability assessment methods with conceptual modelling, a Vulnerability Analysis Critical Impact Point Process (VACIP) methodology is proposed which considers both human and technological vulnerabilities within a cyber-physical system environment to inform an improved insight about attack criticality and impacts. VACIP is validated using a simulated industrial mini testbed; showing that it can enable practicable support for security vulnerability discovery, impact criticality analysis, weak link identification, and prioritised controls. Its novelty is demonstrated in its combination of technology and human vulnerability evaluations in the minimisation of system security exposures. It provides a useful guide for adopting effective cybersecurity risk assessment and exposure reduction strategies.

Pitfalls in Machine Learning for Computer Security

With the growing processing power of computing systems and the increasing availability of massive datasets, machine learning algorithms have led to major breakthroughs in many different areas. This development has influenced computer security, spawning a series of work on learning-based security systems, such as for malware detection, vulnerability discovery, and binary code analysis. Despite great potential, machine learning in security is prone to subtle pitfalls that undermine its performance and render learning-based systems potentially unsuitable for security tasks and practical deployment. In this paper, we look at this problem with critical eyes. First, we identify common pitfalls in the design, implementation, and evaluation of learning-based security systems. We conduct a study of 30 papers from top-tier security conferences within the past 10 years, confirming that these pitfalls are widespread in the current security literature. In an empirical analysis, we further demonstrate how individual pitfalls can lead to unrealistic performance and interpretations, obstructing the understanding of the security problem at hand. As a remedy, we propose actionable recommendations to support researchers in avoiding or mitigating the pitfalls where possible. Furthermore, we identify open problems when applying machine learning in security and provide directions for further research.

ProInfer: inference of binary protocol keywords based on probabilistic statistics

Abstract Protocol reverse engineering is crucial in normative verification, and malware behavior analysis and vulnerability discovery. However, uncovering the structural features of binary protocols concealed within dense data representations remains a significant challenge. Accurately identifying keyword segments associated with message types is a prerequisite for meaningful semantic analysis and protocol state machine reduction. In this work, we introduce a novel approach for inferring keywords from binary protocols based on probabilistic statistics. Our method in terms of Byte employs heuristic rules to filter offset positions that are clearly unrelated to message types. We further filter candidate Byte-offsets utilizing constraint relations and provide the probabilistic ranking of each offset as the keyword segment. To enhance the reliability of keyword segment inference, we utilize the Monte Carlo algorithm to assess the difference between message clustering with candidate Byte-offset and random message clustering, and reorder candidate offsets according to the results. Then we can observe optimal values from both orderings and present the ultimate inference results. Experimental results demonstrate that our method excels in the accuracy of keyword segments identification compared with previous techniques.

Building a translational cancer dependency map for The Cancer Genome Atlas

Cancer dependency maps have accelerated the discovery of tumor vulnerabilities that can be exploited as drug targets when translatable to patients. The Cancer Genome Atlas (TCGA) is a compendium of ‘maps’ detailing the genetic, epigenetic and molecular changes that occur during the pathogenesis of cancer, yet it lacks a dependency map to translate gene essentiality in patient tumors. Here, we used machine learning to build translational dependency maps for patient tumors, which identified tumor vulnerabilities that predict drug responses and disease outcomes. A similar approach was used to map gene tolerability in healthy tissues to prioritize tumor vulnerabilities with the best therapeutic windows. A subset of patient-translatable synthetic lethalities were experimentally tested, including PAPSS1/PAPSS12 and CNOT7/CNOT78, which were validated in vitro and in vivo. Notably, PAPSS1 synthetic lethality was driven by collateral deletion of PAPSS2 with PTEN and was correlated with patient survival. Finally, the translational dependency map is provided as a web-based application for exploring tumor vulnerabilities.

VRVul-Discovery: BiLSTM-based Vulnerability Discovery for Virtual Reality Devices in Metaverse

VRVul-Discovery: BiLSTM-based Vulnerability Discovery for Virtual Reality Devices in Metaverse

To report or not to report? Extending Protection Motivation Theory to Vulnerability Discovery and Disclosure

Vulnerability researchers face difficult choices when considering whether to reporting a finding to an organization with which they are unaffiliated. We used components of Protection Motivation Theory (PMT) to create the Vulnerability Discovery and Disclosure (VDD) model to understand the decision-making processes of vulnerability researchers. PMT uses high fear appeals, threat appraisals, and coping appraisals to encourage employee prosocial behaviors while VDD proposes low fear and threat with high coping, to encourage reporting. In this exploratory study, we surveyed active vulnerability researchers to gain insight into their concerns when deciding to report to an organization. Using principal components analysis, we developed and refined the VDD survey, which may be tested by future researchers. We also discovered a higher-order efficacy construct, comprised of response and self-efficacy. We theorize that well-developed vulnerability disclosure policies, in line with a low-fear, low-threat appraisal and high efficacy may establish a culture of trust between organizations and vulnerability researchers, encouraging more reports.

How About Bug-Triggering Paths? - Understanding and Characterizing Learning-Based Vulnerability Detectors

Machine learning and its promising branch deep learning have proven to be effective in a wide range of application domains. Recently, several efforts have shown success in applying deep learning techniques for automatic vulnerability discovery, as alternatives to traditional static bug detection. In principle, these learning-based approaches are built on top of classification models using supervised learning. Depending on the different granularities to detect vulnerabilities, these approaches rely on learning models which are typically trained with well-labeled source code to predict whether a program method, a program slice, or a particular code line contains a vulnerability or not. The effectiveness of these models is normally evaluated against conventional metrics including precision, recall and F1 score. In this paper, we show that despite yielding promising numbers, the above evaluation strategy can be insufficient and even misleading when evaluating the effectiveness of current learning-based approaches. This is because the underlying learning models only produce the classification results or report individual/isolated program statements, but are unable to pinpoint bug-triggering paths, which is an effective way for bug fixing and the main aim of static bug detection. Our key insight is that a program method or statement can only be stated as vulnerable in the context of a bug-triggering path. In this work, we systematically study the gap between recent learning-based approaches and conventional static bug detectors in terms of fine-grained metrics called BTP metrics using bug-triggering paths. We then characterize and compare the quality of the prediction results of existing learning-based detectors under different granularities. Finally, our comprehensive empirical study reveals several key issues and challenges in developing classification models to pinpoint bug-triggering paths and calls for more advanced learning-based bug detection techniques.

AFL++: A Vulnerability Discovery and Reproduction Framework

Directed greybox fuzzing can mainly be used for vulnerability mining and vulnerability replication. However, there are still some issues with existing directional fuzzing tools. One is that after providing problematic changes or patches, it is not possible to quickly target and discover the problem. Secondly, it is difficult to break through the magic byte path, making it difficult to mine deep vulnerabilities. This article proposes a new vulnerability mining and repair framework: American Fuzz Lop Plus (AFL++). Firstly, we utilize alias analysis to enhance inter-procedural control flow graphs and redefine the distance calculation formula to obtain more accurate distances. Secondly, the Newton interpolation method is used for the energy initialization of each seed to prevent test cases from being filtered out due to low energy. A heuristic energy scheduling algorithm is proposed to judiciously schedule the energy of seeds. During the path exploration phase, by adjusting the seed energy, shorter-distance seeds quickly reach the target; with increasing time, seeds tend to explore deeper paths. We then represent the symbolic distance by the number of instructions passed to reach the target and investigate the shortest path search strategy to achieve path pruning, alleviating the problem of path explosion. Finally, based on the above methods, we implement the AFL++ prototype system, integrating directed greybox fuzzing with symbolic execution technology for vulnerability discovery. By interleaving directed symbolic execution and directed greybox fuzzing, the efficiency of vulnerability discovery and reproduction is effectively enhanced.

Toward Pointer-Analysis-Based Vulnerability Discovery in Human–Machine Pair Programming

Pointer analysis is the underlying technique of many static analysis tools for vulnerability discovery. It has proved to be effective in identifying a variety of vulnerabilities, such as buffer overflow vulnerabilities and injection vulnerabilities. However, most existing pointer analysis approaches require whole-program availability, i.e. the program to be analyzed should be complete, which may hinder a timely analysis during the coding phase. In this paper, we present two approaches, exhaustive and demand-driven pointer analyses, both of which are applied to a paradigm known as Human–Machine Pair Programming. The ideas enable us to discover security flaws as early as in the coding phase. In this paper, we describe in detail how our approaches maintain flow sensitivity and propagate points-to and taint information in an incremental fashion. We conduct an evaluation of our approaches on SecuriBench Micro and show that the approaches can capture all the potential vulnerabilities in the test cases, though several false alarms are reported.

Vulnerability discovery based on source code patch commit mining: a systematic literature review

Vulnerability discovery based on source code patch commit mining: a systematic literature review

The simple economics of an external shock to a bug bounty platform

Abstract We first provide background on the “nuts and bolts” of a bug bounty platform: a two-sided marketplace that connects firms and individual security researchers (“ethical” hackers) to facilitate the discovery of software vulnerabilities. Researchers get acknowledged for valid submissions, but only the first submission of a distinct vulnerability is rewarded money in this tournament-like setting. We then empirically examine the effect of an exogenous external shock (COVID-19) on Bugcrowd, one of the leading platforms. The shock presumably reduced the opportunity set for many security researchers who might have lost their jobs or been placed on a leave of absence. We show that the exogenous shock led to a huge rightward shift in the supply curve and increased the number of submissions and new researchers on the platform. During the COVID period, there was a significant growth in duplicate (already known) valid submissions, leading to a lower probability of winning a monetary reward. The supply increase resulted in a significant decline in the equilibrium price of valid submissions, mostly due to this duplicate submission supply-side effect. The results suggest that had there been a larger increase in the number of firms and bug bounty programs on the platform, many more unique software vulnerabilities could have been discovered.

Towards Unveiling Exploitation Potential With Multiple Error Behaviors for Kernel Bugs

Nowadays, fuzz testing has significantly expedited the vulnerability discovery of Linux kernel. Security analysts use the manifested error behaviors to infer the exploitability of one bug and thus prioritize the patch development. However, only using an error behavior in the report, security analysts might underestimate the exploitability of the kernel bug because it could manifest various error behaviors indicating different exploitation potentials. In this work, we conduct an empirical study on multiple error behaviors of kernel bugs to understand 1) the prevalence of multiple error behaviors and the possible impact of multiple error behaviors towards the exploitation potential; 2) the factors that manifest multiple error behaviors with different exploitation potential. We collected <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">all the fixed kernel bugs</i> reported on Syzbot from September 2017 to January 2022, including 3,352 bug reports. We observed that multiple error behaviors manifested by kernel bugs are prevalent in the real world, and more error behaviors help unveil the exploitability of kernel bugs. Then we organized Linux kernel experts to analyze a sample of kernel bug dataset (484 bug reports, unique 162 bugs) and identified 6 key contributing factors to the mutiple error behaviors. Finally, based on the empirical findings, we propose an object-driven fuzzing technique to explore all possible error behaviors that a kernel bug might bring about. To evaluate the utility of our proposed technique, we implement our fuzzing tool <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">GREBE</monospace> and apply it to 60 real-world Linux kernel bugs. On average, <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">GREBE</monospace> could manifest 2+ additional error behaviors for each of the kernel bugs. For 26 kernel bugs, <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">GREBE</monospace> discovers higher exploitation potential. We report to kernel vendors some of the bugs – the exploitability of which was wrongly assessed and the corresponding patch has not yet been carefully applied – resulting in their rapid patch adoption.

Deep Learning for Coverage-Guided Fuzzing: How Far are We?

Fuzzing is a widely-used software vulnerability discovery technology, many of which are optimized using coverage-feedback. Recently, some techniques propose to train deep learning (DL) models to predict the branch coverage of an arbitrary input owing to its always-available gradients etc. as a guide. Those techniques have proved their success in improving coverage and discovering bugs under different experimental settings. However, DL models, usually as a magic black-box, are notoriously lack of explanation. Moreover, their performance can be sensitive to the collected runtime coverage information for training, indicating potentially unstable performance. In this work, we conduct a systematic empirical study on 4 types of DL models across 6 projects to (1) revisit the performance of DL models on predicting branch coverage (2) demystify what specific knowledge do the models exactly learn, (3) study the scenarios where the DL models can outperform and underperform the traditional fuzzers, and (4) gain insight into the challenges of applying DL models on fuzzing. Our empirical results reveal that existing DL-based fuzzers do not perform well as expected, which is largely affected by the dependencies between branches, unbalanced sample distribution, and the limited model expressiveness. In addition, the estimated gradient information tends to be less helpful in our experiments. Finally, we further pinpoint the research directions based on our summarized challenges.

SFO-CID: Structural Feature Optimization Based Command Injection Vulnerability Discovery for Internet of Things

SFO-CID: Structural Feature Optimization Based Command Injection Vulnerability Discovery for Internet of Things

A Toxoplasma gondii putative amino acid transporter localizes to the plant-like vacuolar compartment and controls parasite extracellular survival and stage differentiation.

Toxoplasma gondii is a protozoan parasite that infects a broad spectrum of hosts and can colonize many organs and cell types. The ability to reside within a wide range of different niches requires substantial adaptability to diverse microenvironments. Very little is known about how this parasite senses various milieus and adapts its metabolism to survive, replicate during the acute stage, and then differentiate to the chronic stage. T. gondii possesses a lysosome-like organelle known as the plant-like vacuolar compartment (PLVAC), which serves various functions, including digestion, ion storage and homeostasis, endocytosis, and autophagy. Lysosomes are critical for maintaining cellular health and function by degrading waste materials and recycling components. To supply the cell with the essential building blocks and energy sources required for the maintenance of its functions and structures, the digested solutes generated within the lysosome are transported into the cytosol by proteins embedded in the lysosomal membrane. Currently, a limited number of PLVAC transporters have been characterized, with TgCRT being the sole potential transporter of amino acids and small peptides identified thus far. To bridge this knowledge gap, we used lysosomal amino acid transporters from other organisms as queries to search the T. gondii proteome. This led to the identification of four potential amino acid transporters, which we have designated as TgAAT1-4. Assessing their expression and sub-cellular localization, we found that one of them, TgAAT1, localized to the PLVAC and is necessary for normal parasite extracellular survival and bradyzoite differentiation. Moreover, we present preliminary data showing the possible involvement of TgAAT1 in the PLVAC transport of arginine.IMPORTANCEToxoplasma gondii is a highly successful parasite infecting a broad range of warm-blooded organisms, including about one-third of all humans. Although Toxoplasma infections rarely result in symptomatic disease in individuals with a healthy immune system, the incredibly high number of persons infected, along with the risk of severe infection in immunocompromised patients and the potential link of chronic infection to mental disorders, makes this infection a significant public health concern. As a result, there is a pressing need for new treatment approaches that are both effective and well tolerated. The limitations in understanding how Toxoplasma gondii manages its metabolism to adapt to changing environments and triggers its transformation into bradyzoites have hindered the discovery of vulnerabilities in its metabolic pathways or nutrient acquisition mechanisms to identify new therapeutic targets. In this work, we have shown that the lysosome-like organelle plant-like vacuolar compartment (PLVAC), acting through the putative arginine transporter TgAAT1, plays a pivotal role in regulating the parasite's extracellular survival and differentiation into bradyzoites.

Fine-Grained Modeling of ROP Vulnerability Exploitation Process under Stack Overflow Based on Petri Nets

Software vulnerability discovery is currently a hot topic, and buffer overflow remains a prevalent security vulnerability. One of the key issues in vulnerability discovery and analysis is how to quickly analyze buffer overflow vulnerabilities and select critical exploitation paths. Existing modeling methods for vulnerability exploitation cannot accurately reflect the fine-grained execution process of stack overflow exploitation paths. This paper, based on the discussion of buffer overflow exploitation techniques, proposes a fine-grained modeling and analysis method based on Petri nets for the selection and execution of exploitation processes, specifically focusing on the return-oriented programming in stack overflow. Through qualitative analysis, we compared the simulated time of the software with the execution time of existing exploitation tools, achieving timeout-based simulation experiments. We validated the model’s effectiveness using symbolic execution and dynamic analysis techniques. The results indicate that this model performs well for vulnerable programs with Position Independent Executable (PIE) protection enabled and has an advantage in selecting exploitation paths, enabling timeout-based simulation. This method provides a reference for rapidly constructing exploitation implementations.

EPCO-12. IN VIVO PERTURB-SEQ DEFINES BIOLOGICAL DRIVERS AND THERAPEUTIC VULNERABILITIES UNDERLYING RADIOTHERAPY RESISTANCE IN GLIOBLASTOMA

Abstract Glioblastomas are comprised of dynamic malignant cell states and microenvironment cell types. Mechanistic and functional studies of glioblastoma resistance to therapy have been limited by a lack of in vivo approaches for multiplexed interrogation of single cells. Here we use genome-wide and targeted CRISPR interference (CRISPRi) to identify therapeutic vulnerabilities in glioblastomas in vivo by coupling convection enhanced delivery (CED) with functional genomics and single-cell transcriptomics (perturb-seq). Human (GBM43, LN18) or mouse (GL261, SB28) glioblastomas expressing CRISPRi machinery were established intracranially in mice, and unmodified mouse glioblastomas were established intracranially in immunocompetent mice expressing CRISPRi machinery in the tumor microenvironment. Perturb-seq gene prioritization was performed using genome-wide CRISPRi screens ± radiotherapy in cell cultures. Dual-sgRNA Perturb-seq lentivirus libraries were transduced in vivo using CED, and single-cell RNA sequencing with sgRNA capture was performed ± radiotherapy. RESULTS: were validated using RNA sequencing of 254,288 single nuclei from 43 pairs of primary and recurrent patient-matched human glioblastomas. Perturb-seq ± radiotherapy of 98 genes underlying glioblastoma radiotherapy responses was performed across 414,092 single cells in vivo. Genetic perturbations reprogrammed tumor and microenvironment cell states in response to radiotherapy, and high dimensional manifolds revealed genetic dependencies in metabolic and DNA damage response pathways. The DNA-dependent protein kinase (DNA-PK) component PRKDC was identified as a driver of glioblastoma radiotherapy resistance through regulation of malignant cell-intrinsic growth and stress pathways, and regulation of malignant cell-extrinsic interferon pathways that controlled cell-cell interactions with the tumor microenvironment. PRKDC inhibition with nedisertib sensitized glioblastomas to radiotherapy and extended survival in vivo, and single-cell RNA sequencing revealed hyperactivation of cell stress and cytokine signatures with combination treatment. In summary, we report in vivo perturb-seq as a platform for simultaneous discovery and functional interrogation of therapeutic vulnerabilities in glioblastoma, and show DNA-PK inhibition sensitizes glioblastomas to radiotherapy in vivo.

Detecting security vulnerabilities with vulnerability nets

Detecting security vulnerabilities is a crucial part in secure software development. Many static analysis tools have proved to be effective in finding vulnerabilities, but generally there are some complex and subtle vulnerabilities that can escape from detection. Manual audits are a complementary approach to using tools. Unfortunately, most manual analyses are tedious and error prone. To benefit from both the tools and manual audits, some approaches incorporate the auditor's expertise into a static analysis tool during vulnerability discovery. Following this strategy, this paper presents a representation of source code called a vulnerability net, which is a special Petri net that integrates with data dependence graphs and control flow graphs. The combined representation can facilitate the detection of taint-style vulnerabilities such as buffer overflows and injection vulnerabilities. We test the proposed approach on Securibench Micro and demonstrate that it has the capability to identify a variety of vulnerabilities while keeping the rates of false negatives and positives low.

Demystify the Fuzzing Methods: A Comprehensive Survey

Massive software applications possess complex data structures or parse complex data structures; in such cases, vulnerabilities in the software become inevitable. The vulnerabilities are the source of cyber-security threats, and discovering this before the software deployment is challenging. Fuzzing is a vulnerability discovery solution that resonates with random-mutation, feedback-driven, coverage-guided, constraint-guided, seed-scheduling, and target-oriented strategies. Each technique is wrapped beneath the black-, white-, and grey-box fuzzers to uncover diverse vulnerabilities. It consists of methods such as identifying structural information about the test cases to detect security vulnerabilities, symbolic and concrete program states to explore the unexplored locations, and full semantics of code coverage to create new test cases. We methodically examine each kind of fuzzers and contemporary fuzzers with a profound observation that addresses various research questions and systematically reviews and analyze the gaps and their solutions. Our survey comprised the recent related works on fuzzing techniques to demystify the fuzzing methods concerning the application domains and the target that, in turn, achieves higher code coverage and sound vulnerability detection.