System Call Argument Filtering for Interpreted Languages

Master thesis (2022)

Authors

S.L. Maquelin Electrical Engineering, Mathematics and Computer Science

Contributors

A. Zarras Cyber Security - (mentor)

G. Smaragdakis Cyber Security - (graduation committee member)

D. Spinellis Software Engineering - (graduation committee member)

Faculty

Electrical Engineering, Mathematics and Computer Science, Electrical Engineering, Mathematics and Computer Science

Cyber security System call argument interpostition Interpreted applications Argument filtering System call interposition

To reference this document use:

http://resolver.tudelft.nl/uuid:bfeb62a0-7c2d-4d74-94cb-65c805a09dc4

More Info

expand_more

Published Date

01-07-2022

Language

English

Reuse Rights

Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons.

Faculty

Electrical Engineering, Mathematics and Computer Science

Abstract

Interpreted applications are often vulnerable to remote code execution attacks. To protect interpreted applications, we should reduce the tools available to the attackers. In this thesis, we investigate the possibilities for the automation of policy generation for interpreted applications in terms of system call arguments. These policies are used for system call argument interposition. We compare two approaches working on the interpreter to find if any of these two can provide meaningful policies. The first is dynamic analysis, and the second is static analysis, which uses symbolic execution.

The symbolic execution was least effective as it provides policies only for a small portion of the system call arguments, less than ten per cent, and hinders normal execution of applications with these policies. The dynamic analysis solution fares better, providing a restriction for about forty per cent of the system call arguments. We conclude that automatic policy generation of system call arguments for interpreted applications is a meaningful endeavour.

Files

Report.pdf

(pdf | 0.842 Mb)

Unknown license