Automatic Discovery of Software Vulnerabilities Through Binary Difference Analysis
by GAO Debin
| Speaker: |  |
Date: Time: Venue: |
7 September 2007 (Friday)
|
GAO Debin |
We look forward to seeing you at this research seminar. |
Abstract
People spend a lot of effort in finding software vulnerabilities. In particular, understanding of software vulnerabilities is extremely valuable to attackers because it may enable them to compromise thousands, if not millions, of machines around the world. Successful compromise of these machines could lead to substantial financial returns by launching denial of service attacks, gathering confidential information and etc.
In this talk, I will demonstrate a technique which enables attackers to discover software vulnerabilities automatically by comparing the patched and unpatched versions of software programs. The technique does not require access to the source code or any additional information. By statically analyzing two versions of a software program, an attacker may be able to discover vulnerabilities in the unpatched version. More importantly, because the vulnerabilities can be found automatically using our technique, attackers can launch an attack in a timely faction before most users apply the patch from the software developer.
Biography
Debin Gao is currently an Assistant Professor in the School of Information Systems at Singapore Management University. He is previously a systems software engineer in CyLab. Debin's research interests are in security and cryptography. Specific topics include intrusion detection and static analysis of binary executables. Debin has published papers in top security conferences, including USENIX Security, ACM Conference on Computer and Communications Security (CCS) and International Symposium on Recent Advances in Intrusion Detection (RAID). He received the Ann and Martin McGuinn Graduate Fellowship for the year 2005, and the Frank J. Marshall Graduate Fellowship for the year 2004. Debin received Ph.D. and M.S. in Electrical and Computer Engineering, Carnegie Mellon University in 2006 and 2004.