TECHNICAL FIELD

This disclosure relates generally to characterizing, detecting, and healing vulnerabilities in computer code.

BACKGROUND

With the proliferation of networked embedded systems, previously inconsequential embedded system nodes are becoming the target of attacks, including attacks by nation states. These embedded systems increasingly perform sensitive roles ranging from controlling our nation's critical infrastructure, to controlling the avionics in airplanes, to routing and controlling communications, and to even controlling medical devices, such as a pacemaker. Accordingly, the compromise of a single node (e.g., device) could have drastic consequences.

SUMMARY

An example process includes: identifying, by one or more processing devices, candidate code in executable code based on a static analysis of the executable code, where the candidate code includes code that is vulnerable to attack or the candidate code being on a path to code that is vulnerable to attack, and where information related to the attack is based, at least in part, on the candidate code; customizing, by one or more processing devices, a healing template based on the information to produce a customized healing template; and inserting, by one or more processing devices, the customized healing template into a version of the executable code at a location that is based on a location of the candidate code in the executable code. The customized healing template may include code that is executable to inhibit the attack. The example process may include one or more of the following features, either alone or in combination.

The executable code may comprise binary code generated from application code by a compiler executed by one or more processing devices; identifying may be performed at compile-time; and inserting may be performed at run-time. The candidate code may comprise a vulnerability point candidate (VPC). The VPC may comprise code in the executable code that is targeted for attack. The candidate code may comprise a vulnerability point source (VPS). The VPS may comprise, and be part of, a source of the path to code targeted for attack.

Identifying the candidate code may comprise identifying points within the executable code that are vulnerable to attack. Identifying the points may comprise: identifying memory store instructions that are in a program loop in the executable code and that operate on induction variables; and classifying at least some of the memory store instructions as points within the executable code that are vulnerable to attack. The process may include filtering the memory store instructions to produce the at least some memory store instructions. The at least some memory store instructions may be less than all memory store instructions. Filtering may include excluding at least some memory store instructions.

The static analysis may comprise: performing a static call-graph analysis to identify unique procedure caller-callee sets in the executable code; and modifying how a stack is organized inside a procedure of the executable code. The customized healing template may comprise code that is executable to inhibit the attack upon occurrence of the attack at run-time, but that is not executable in a case that the attack does not occur.

Identifying the candidate code may comprise determining an offset from a memory address associated with the candidate code to create a boundary, where an identity of the boundary being part of the information. Determining an offset from a memory address may comprise: storing a first value and corresponding to an address that is prior to a loop containing the candidate code; and storing a second value corresponding to an address that is immediately prior to the candidate code that is vulnerable to attack.

Identifying the candidate code may comprise identifying multiple instances of candidate code. The example process may comprise: determining which of the instances of candidate code was actually subjected to attack at run-time; and modifying the customized template at run-time so that the customized template is specific to an instance of candidate code was actually subjected to attack.

The customized template may be inserted into executable code to replace the candidate code. The customized template may be inserted into executable code at a point immediately prior to the candidate code.

An example process includes: identifying instances of candidate code in executable code based on a static analysis of the executable code, where the instances of candidate code comprise code that is vulnerable to attack or the instances of candidate code are on a path to code that is vulnerable to attack; inserting a healing template into a version of the executable code at a location that is based on a location of an instance of the candidate code in the executable code, where the healing template comprises code that is executable to inhibit the attack; identifying which of the instances of candidate code was actually subject to the attack at run-time; and updating the healing template to produce an updated healing template. The updated healing template comprises information that represents a path and a state that caused the attack. The example process may include one or more of the following features, either alone or in combination.

The executable code may comprise binary code generated from application code by a compiler executed by one or more processing devices; identifying the instances of candidate code may be performed at compile-time; and inserting may be performed at run-time. Each instance of candidate code may comprise a vulnerability point candidate (VPC), and the VPC may comprise code in the executable code that is targeted for attack. Each instance of candidate code may comprise a vulnerability point source (VPS). The VPS may comprise, and be part of, a source of the path to code targeted for attack.

Identifying the instances of candidate code may comprise identifying points within the executable code that are vulnerable to attack. Identifying the points may comprise: identifying memory store instructions that are in a program loop in the executable code and that operate on induction variables; and classifying at least some of the memory store instructions as points within the executable code that are vulnerable to attack.

The example process may comprise filtering the memory store instructions to produce the at least some memory store instructions. The at least some memory store instructions are less than all memory store instructions. Filtering may comprise excluding at least some memory store instructions that do not carry a payload.

The static analysis may comprise performing a static call-graph analysis to identify unique procedure caller-callee sets in the executable code; and modifying how a stack is organized inside a procedure of the executable code. The healing template may comprise code that is executable to inhibit the attack upon occurrence of the attack at run-time, but that is not executable in a case that the attack does not occur.

Identifying the instances of candidate code may comprise determining an offset from a memory address associated with the candidate code to create a boundary, where an identity of the boundary is part of the information. Determining may comprise: storing a first value corresponding to an address that is prior to a loop containing the candidate code; and storing a second value corresponding to an address that is immediately prior to the candidate code that is vulnerable to attack.

The example process may comprise performing, by one or more processing devices, an address space layout randomization (ASLR) process to inhibit attack against the executable code.

Identifying may comprise dynamically altering, by one or more processing devices, address ranges and start addresses allocated to local storage frames used for register spills and local variables. Identifying may comprise dynamically jittering by one or more processing devices, a caller-callee convention based on a random seed defined at startup.

The example process may comprise performing a trace to identify a vulnerability point candidate (VPC) that was subject to attack and a path on which the VPC is located.

An example process may comprise performing, by one or more processing devices, a static analysis of computer code to identify a memory instruction in the computer code that constitutes vulnerability in the computer code. The example process may include one or more of the following features, either alone or in combination.

The memory instruction may have a linear access at runtime. The memory instruction may be repeatable and operate on an induction variable. The vulnerability may result from user-system or system-system interactions causing violation of predefined boundaries in the memory instruction. The example method may comprise preventing execution of the memory instruction based on the static analysis.

The systems and systems described herein, or portions thereof, can be implemented as a computer program product that includes instructions that are stored on one or more non-transitory machine-readable storage media, and that are executable on one or more processing devices to implement (e.g., to perform) the operations described herein. The systems and systems described herein, or portions thereof, can be implemented as an apparatus, method, or electronic system that can include one or more processing devices and memory to store executable instructions to implement various operations.

The details of one or more implementations are set forth in the accompanying drawings and the description below. Other features and advantages will be apparent from the description and drawings, and from the claims.

