EvilCoder：自动化错误插入
EvilCoder: Automated Bug Insertion
摘要：
查找软件漏洞的技术已经在文献中广泛地讨论过，并且在这个主题上有大量的工作。相比之下，故意插入可利用的，安全关键的错误还没有得到（公众）的关注。乍一看，想要更多的bug似乎会适得其反，但是对bug发现技术的全面评估却缺乏基础事实和bug的稀缺性。在本文中，我们提出EvilCoder，一个系统，自动找到潜在的脆弱的源代码位置，并修改源代码，实际上是脆弱的。更具体地说，我们利用自动化程序分析技术来寻找与典型错误模式匹配的敏感汇点（例如，一个敏感的API函数，在此之前进行了健全性检查），并尝试找到与用户控制的源的数据流连接。然后，我们转换源代码，使利用成为可能，例如通过删除或修改输入清理或其他类型的安全检查。我们的工具旨在随机挑选易受攻击的位置和可能的修改，这样它就可以在同一软件语料库上生成许多不同的漏洞。我们在几个开源项目上评估了我们的工具，例如libpng和vsftpd，我们发现每个项目有22到158个唯一的连接源-汇对。这意味着我们可以插入数百个潜在的易受攻击的数据流路径和数百个错误。我们希望通过提供新生成的、充满bug的测试语料库来支持未来的bug查找技术，以便这些技术（最终）能够以一种全面且有统计意义的方式进行评估和比较。
英文摘要：
The art of finding software vulnerabilities has been covered extensively in the literature and there is a huge body of work on this topic. In contrast, the intentional insertion of exploitable, security-critical bugs has received little (public) attention yet. Wanting more bugs seems to be counterproductive at first sight, but the comprehensive evaluation of bug-finding techniques suffers from a lack of ground truth and the scarcity of bugs. In this paper, we propose EvilCoder, a system to automatically find potentially vulnerable source code locations and modify the source code to be actually vulnerable. More specifically, we leverage automated program analysis techniques to find sensitive sinks which match typical bug patterns (e.g., a sensitive API function with a preceding sanity check), and try to find data-flow connections to user-controlled sources. We then transform the source code such that exploitation becomes possible, for example by removing or modifying input sanitization or other types of security checks. Our tool is designed to randomly pick vulnerable locations and possible modifications, such that it can generate numerous different vulnerabilities on the same software corpus. We evaluated our tool on several open-source projects such as for example libpng and vsftpd, where we found between 22 and 158 unique connected source-sink pairs per project. This translates to hundreds of potentially vulnerable data-flow paths and hundreds of bugs we can insert. We hope to support future bug-finding techniques by supplying freshly generated, bug-ridden test corpora so that such techniques can (finally) be evaluated and compared in a comprehensive and statistically meaningful way.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
