Abstract:This issue contains two papers. The first paper focuses on combinatorial testing, and the second one focuses on model checking. The first paper, ‘Combinatorial methods for dynamic grey-box SQL injection testing’ by Bernhard Garn, Jovan Zivanovic, Manuel Leithner and Dimitris E. Simos, concerns combinatorial testing for SQL injection. Code injections attacks, and in particular SQL injection (SQLi) attacks, are still among the most critical threats for web applications. These attacks rely on exploiting vulnerabilities, which must be actively chased to deploy a secure system. Leveraging combinatorial testing, the authors propose novel attack grammars to generate SQLi attacks against MySQL-compatible databases. One originality of this contribution resides in dynamically optimizing and improving the attack grammars to the context. This context-sensitive adaptation technique is supported by a prototype tool named SQLInjector+ and is validated and benchmarked on a representative set of web applications under test. The contribution is accompanied by a nice addition to the field: a simple framework called WAFTF for testing the filtering techniques of web application firewalls such as ModSecurity. (Recommended by Yves Le Traon) The second paper, ‘Comprehensive evaluation of file systems robustness with SPIN model checking’ by Jingcheng Yuan, Toshiaki Aoki and Xiaoyun Guo, presents a study that comprehensively evaluates the robustness of file systems using a model checking approach, covering the majority of the mainstream file system types and both single-thread and multi-thread modes. In particular, to abstract real file systems, the authors developed Promela models optimized to avoid state explosion during model checking and used an SPIN model checker to check these models for detecting corner-case errors during an unexpected power outage. The authors analysed counterexamples generated by model checking to determine an improved file system model that is capable of preventing errors in most mainstream file system types and then rechecked the improved file system model and verified the absence of all critical errors. (Recommended by Moonzoo Kim)

Method of model checking x86 executables for temporal security vulnerabilities

Vulnerability Analysis Framework for Binaries Based on Model Checking

Model Checking for Microarchitectural Data Sampling Security

Securing c programs by dynamic type checking

Improved Model Checking Technology for Program Temporal Safety Properties

An efficient control flow security analysis approach for binary executables

Vulnerability-based Model Checking of Security Vulnerabilities Mining Method

Hardware-Assisted Monitoring For Instruction Security In Embedded System

Finding Taint-Style Vulnerabilities in Linux-based Embedded Firmware with SSE-based Alias Analysis

Combinatorial Testing and Model Checking

Timing the Transient Execution: A New Side-Channel Attack on Intel CPUs

Modeling, Derivation, and Automated Analysis of Branch Predictor Security Vulnerabilities

Dynamic Analysis and Debugging of Binary Code for Security Applications

Implicit-Flow-Sensitive Method for Detection of Trojan-Spy Programs

Model Checking Needham-Schroeder Security Protocol Based on Temporal Logic of Knowledge

A model-guided symbolic execution approach for network protocol implementations and vulnerability detection

Shesha: Multi-head Microarchitectural Leakage Discovery in new-generation Intel Processors

Detect Use-after-free Vulnerabilities in Binaries

Dynamic Neural Control Flow Execution: An Agent-Based Deep Equilibrium Approach for Binary Vulnerability Detection

HyperCheck: A Hardware-AssistedIntegrity Monitor

SymGX: Detecting Cross-boundary Pointer Vulnerabilities of SGX Applications Via Static Symbolic Execution