mechanization_of_exploits.org

Considerations

https://github.com/turnersr/turnersr.github.io/blob/master/mechanization_of_exploits/DARPA_CGC/comments.org

Exploits

CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)

Attack

Software Crash Analysis for Automatic Exploit Generation on Binary Programs by Shih-Kun Huang, Min-Hsiang Huang, Po-Yen Huang, Han-Lin Lu, and Chung-Wei Lai - https://drive.google.com/file/d/0BymO5h8P3PgAaE8zOVRYZWRCNEE/edit?usp=sharing

Unleashing MAYHEM on Binary Code - http://diyhpl.us/~bryan/papers2/security/mayhem-oakland-12.pdf

CWE-121: Stack-based Buffer Overflow

Attack

Unleashing MAYHEM on Binary Code - http://diyhpl.us/~bryan/papers2/security/mayhem-oakland-12.pdf

Defense

Eliminating Stack Overflow by Abstract Interpretation - http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.64.6170&rep=rep1&type=pdf

CWE-122: Heap-based Buffer Overflow

Attack

The Automated Exploitation Grand Challenge (Slides 22 - 27) - http://openwall.info/wiki/_media/people/jvanegue/files/aegc_vanegue.pdf

CWE-123: Write-what-where Condition

CWE-124: Buffer Underwrite (‘Buffer Underflow’)

CWE-128: Wrap-around Error

CWE-129: Improper Validation of Array Index

CWE-130: Improper Handling of Length Parameter Inconsistency

CWE-131: Incorrect Calculation of Buffer Size

Attack

Software Crash Analysis for Automatic Exploit Generation on Binary Programs by Shih-Kun Huang, Min-Hsiang Huang, Po-Yen Huang, Han-Lin Lu, and Chung-Wei Lai - https://drive.google.com/file/d/0BymO5h8P3PgAaE8zOVRYZWRCNEE/edit?usp=sharing

Unleashing MAYHEM on Binary Code - http://diyhpl.us/~bryan/papers2/security/mayhem-oakland-12.pdf

CWE-134: Uncontrolled Format String

Attack

String Analysis for x86 Binaries - http://pages.cs.wisc.edu/~mihai/publications/String%20Analysis%20for%20x86%20Binaries/String%20Analysis%20for%20x86%20Binaries.pdf

Defense

Automated Format String Attack Prevention for Win32/X86 Binaries - https://acsac.org/2007/papers/165.pdf

CWE-135: Incorrect Calculation of Multi-Byte String Length

CWE-147: Improper Neutralization of Input Terminators

CWE-158: Improper Neutralization of Null Byte or NUL Character

CWE-170: Improper Null Termination

CWE-190: Integer Overflow or Wraparound

CWE-191: Integer Underflow (Wrap or Wraparound)

Attack

Modular Bug-finding for Integer Overflows in the Large: Sound, Efficient, Bit-precise Static Analysis - http://research.microsoft.com/pubs/80722/z3prefix.pdf

UQBTng: a tool capable of automatically finnding integer overows in Win32 binaries - http://events.ccc.de/congress/2005/fahrplan/attachments/552-Paper_AToolCapableOfAutomaticallyFindingIntegerOverflowsInWin32Binaries.pdf

IntScope: Automatically Detecting Integer Overflow Vulnerability in X86 Binary Using Symbolic Execution - http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.153.1801&rep=rep1&type=pdf

New Binary System for Detecting and Locating Integer-based Vulnerability on Run-time Type Analysis

Detecting interger flaws by type-qualified system dependence graph

Defense

An ‘Explicit Type Enforcement’ Program Transformation Tool for Preventing Integer Vulnerabilities - http://www.munawarhafiz.com/research/intproblem/H11-SplashDemo_AIC.pdf

Program Transformations to Fix C Integers - http://www.munawarhafiz.com/research/intproblem/H11-SplashDemo_AIC.pdf

CWE-193: Off-by-one Error

CWE-194: Unexpected Sign Extension

CWE-195: Signed to Unsigned Conversion Error

CWE-196: Unsigned to Signed Conversion Error

CWE-401: Improper Release of Memory Before Removing Last Reference

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

WCET and Algorithmic-complexity

CacheAudit: A Tool for the Static Analysis of Cache Side Channels - http://0b4af6cdc2f0c5998459-c0245c5c937c5dedcca3f1764ecc9b2f.r43.cf2.rackcdn.com/12319-sec13-paper_doychev.pdf and http://software.imdea.org/projects/cacheaudit/

Fun with Constrained Programming by Tavis Ormandy - http://blog.cmpxchg8b.com/2012/09/fun-with-constrained-programming.html

Static Analysis for Regular Expression Exponential Runtime via Substructural Logics by Asiri Rathnayake and Hayo Thielecke - http://arxiv.org/pdf/1405.7058v1.pdf and http://www.cs.bham.ac.uk/~hxt/research/rxxr2/

Static Analysis for Regular Expression Denial-of-Service Attacks - http://arxiv.org/pdf/1301.0849v1.pdf and http://www.cs.bham.ac.uk/~hxt/research/rxxr.shtml

Fast and Precise WCET Prediction by Separated Cache and Path Analyses - http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.84.1150&rep=rep1&type=pdf

Denial of Service via Algorithmic Complexity Attacks - http://www.rootsecure.net/content/downloads/pdf/dos_via_algorithmic_complexity_attack.pdf

Static WCET analysis based on abstract interpretation and counting of elements - http://www.diva-portal.org/smash/get/diva2:292120/FULLTEXT01.pdf

Static Memory and Timing Analysis of Embedded Systems Code - http://www-fp.cs.st-andrews.ac.uk/embounded/pubs/papers/VVSS07.pdf

Cinderella: A retargetable environment for performance analysis of real-time software - https://drive.google.com/file/d/0BymO5h8P3PgAZ1AwMTM3NU9VZjg/edit?usp=sharing

Modular and generic WCET static analysis with LLVM framework - http://www.lume.ufrgs.br/bitstream/handle/10183/31020/000782100.pdf

Towards a Practical WCET Analysis Approach Based on Testing - http://lundqvist.dyndns.org/Publications/ecrts-wip08/lundqvist_sandin_ecrtswip08.pdf

http://mikegagnon.com/2012/01/01/how-to-defend-against-algorithmic-complexity-attacks/

CWE-415: Double Free

Attack

Undangle: Early Detection of Dangling Pointers in Use-After-Free and Double-Free Vulnerabilities - http://diyhpl.us/~bryan/papers2/security/Undangle%20-%20Early%20Detection%20of%20Dangling%20Pointers%20in%20Use-After-Free.pdf

Defense

DieHarder: Securing the Heap - http://people.cs.umass.edu/~emery/pubs/ccs03-novark.pdf

CWE-416: Use After Free

Attack

Finding use-after-free bugs with static analysis - http://seanhn.wordpress.com/2009/11/30/finding-bugs-with-static-analysis/

Statically Detecting Use After Free on Binary Code - http://grehack.org/files/2013/GreHack_2013_proceedings-separate_files/3-accepted_papers/3.4_Feist_-_Statically_Detecting_Use_After_Free_on_Binary_Code.pdf ( http://grehack.org/files/2013/talks/talk_3_4_Feist_-_Statically_Detecting_Use_After_Free_on_Binary_Code-grehack.pdf )

Combining Static Analyses for Helping Detection and Exploitability Vulnerabilities in Binary Code - http://seminaire-dga.gforge.inria.fr/2013/20131108_MarieLaurePotet.pdf

Undangle: Early Detection of Dangling Pointers in Use-After-Free and Double-Free Vulnerabilities - http://diyhpl.us/~bryan/papers2/security/Undangle%20-%20Early%20Detection%20of%20Dangling%20Pointers%20in%20Use-After-Free.pdf

Goanna : Syntactic Software Model Checking - http://www.cse.unsw.edu.au/~rhuuck/FHS08-atva.pdf

Defense

DieHarder: Securing the Heap - http://people.cs.umass.edu/~emery/pubs/ccs03-novark.pdf

CWE-457: Use of Uninitialized Variable

CWE-466: Return of pointer value outside of expected range

CWE-467: Use of sizeof() on a Pointer Type

CWE-468: Incorrect Pointer Scaling

CWE-469: Use of Pointer Subtraction to Determine Size

CWE-763: Release of Invalid Pointer or Reference

CWE-786: Access of Memory Location Before Start of Buffer

CWE-787: Out-of-bounds Write

CWE-788: Access of Memory Location After End of Buffer

CWE-805: Buffer Access with Incorrect Length Value

CWE-806: Buffer Access Using Size of Source Buffer

CWE-822: Untrusted Pointer Dereference

CWE-823: Use of Out-of-range Pointer Offset

CWE-824: Access of Uninitialized Pointer

Attack

Using Valgrind to detect undefined value errors with bit-precision - https://www.usenix.org/legacy/events/usenix05/tech/general/full_papers/seward/seward.pdf

CWE-825: Expired Pointer Dereference