1 of 12

Automated Vulnerability Discovery

Introduction

Yan Shoshitaishvili�Arizona State University

2 of 12

3 of 12

Embedded device 0day

4 of 12

We're not keeping up...

# CVEs

Year

#

5 of 12

We're not keeping up...

# CVEs

Year

#

6 of 12

We're not keeping up...

# CVEs

Year

67M GitHub Repos

131M GitHub Repos

#

7 of 12

Alan Turing.

"Checking a large routine."

EDSAC Inaugural Conference, 1949.

8 of 12

Alan Turing.

"Checking a large routine."

EDSAC Inaugural Conference, 1949.

Is the program correct secure?

9 of 12

Analysis Paradigms

Static techniques try to find flaws without executing the program.

Dynamic techniques execute the program to find flaws.

#

10 of 12

Static Analysis

Pros:

  • Don't need to execute the program!
  • Can make guarantees of spotting all instances of specific vulnerability classes.

Cons:

  • Typically require source code.
  • Incredible imprecise.

"There is a buffer overflow on every line of the program" will�technically spot all instances of buffer overflows...

#

11 of 12

Dynamic Analysis

Pros:

  • Typically don't require source code.
  • Very precise.

Cons:

  • Must run the program to analyze it. Not trivial for:
    • complex programs
    • libraries
    • embedded devices
  • Can only spot bugs if the bug is triggered.

"No bugs detected" is a quite normal result of dynamic�analysis of buggy programs.

#

12 of 12

"The uses of symbolic execution, concolic execution, static analysis, and other emerging technologies to spot substantial vulnerabilities in complex, unstructured, and non-annotated code are still in their infancy."

  • Michael Zalewski, 2015