Abstract:Memory corruption vulnerabilities are often exploited to corrupt sensitive objects and launch attacks. An efficient way to mitigate such threats is identifying and protecting such sensitive objects against corruption. However, it is still an open question that what objects are security sensitive and how sensitive they are. In this paper, we present the first expert system based solution AlphaEXP to identify security sensitive objects, in a specific and important target - the Linux kernel. It works by simulating an adversary to assess whether an object could be abused to get unintended capabilities and contribute to exploitation, and marks it as sensitive if so. Specifically, AlphaEXP first constructs a knowledge graph to represent the facts of the kernel, including objects, functions, and their relationships etc. Then, it explores the knowledge graph to infer potential attack paths for given vulnerabilities, and marks objects used in the attack paths as sensitive. Lastly, it evaluates the feasibility of the attack paths in a customized emulating system, and classifies the sensitivity of objects accordingly. We have built a prototype of AlphaEXP and evaluated it on 84 synthesized representative vulnerabilities and 19 real world vulnerabilities to identify sensitive kernel objects. AlphaEXP successfully generates attack paths for most of these vulnerabilities, and finds 50 objects that could be abused to get writing capability, 81 objects with reading capability, and 112 objects with execution capability, then classifies them into 12 levels of sensitivity.

Operating System Security Policy Hardening Via Capability Dependency Graphs

Design of Secure Operating System

Better Safe Than Sorry! Automated Identification of Functionality-Breaking Security-Configuration Rules

A Formal Model of Security Controls' Capabilities and Its Applications to Policy Refinement and Incident Management

SAT-solving approaches to context-aware enterprise network security management

Automated Implementation of Windows-related Security-Configuration Guides

Optimal security hardening over a probabilistic attack graph: a case study of an industrial control system using the CySecTool tool

A Policy Flexible Architecture for Secure Operating System.

Security policy testing via automated program code generation

Quantitatively Measure Access Control Mechanisms across Different Operating Systems

You Can't Always Check What You Wanted: Selective Checking and Trusted Execution to Prevent False Actuations in Cyber-Physical Systems

Access Control of Secure Operating System for Electronic Government Application

Secguard: Secure And Practical Integrity Protection Model For Operating Systems

Policy-adaptive Capability Inheritance Algorithm Consistent with POSIX Standard

Quantifying Attacker Capability Via Model Checking Multiple Properties (Extended Version)

A Verified Capability-Based Model for Information Flow Security with Dynamic Policies

Study and Improvement of MAC(Mandatory Access Control) for Windows

MODELING ATTACK SCENARIO WITH CAPABILITY

Attack Surface Metrics and Privilege-based Reduction Strategies for Cyber-Physical Systems

AlphaEXP: An Expert System for Identifying Security-Sensitive Kernel Objects

Generalized Taint Propagation Model for Access Control in Operation Systems