Christopher Theisen gave a presentation on using stack trace analysis of crash dumps to approximate the attack surface of software systems. The goal is to help security engineers prioritize efforts by identifying which code is most exposed based on frequency of appearance in stack traces. An analysis of Windows and Firefox crashes found that a small number of files accounted for a large percentage of vulnerabilities. Considering stack trace depth revealed the areas with the highest flaw density to focus on first. The approach provides an initial attack surface model that can be refined over time as new code is added or removed. The shape of the attack surface model, such as many-to-many vs many-to-few, may also impact security.

1. Security Metrics-Driven Evaluation,
Design, Development, & Deployment
Science of Security
Lablet
Automated Attack Surface
Approximation
Christopher Theisen
Graduate Assistant
Fall 2015
Community Forum
October 29, 2015

2. Security Metrics-Driven Evaluation,
Design, Development, & Deployment
Science of Security
Lablet

3. Security Metrics-Driven Evaluation,
Design, Development, & Deployment
Science of Security
Lablet

4. Security Metrics-Driven Evaluation,
Design, Development, & Deployment
Science of Security
Lablet
Attack Surface
• The paths in and out of a system
• the data that travels those paths
• the code that protects both

5. Security Metrics-Driven Evaluation,
Design, Development, & Deployment
Science of Security
Lablet

6. Security Metrics-Driven Evaluation,
Design, Development, & Deployment
Science of Security
Lablet
The goal of this research is to aid your
security engineers in prioritizing security
efforts by approximating the attack surface of
your software systems via crash dump
stack trace analysis.

7. Security Metrics-Driven Evaluation,
Design, Development, & Deployment
Science of Security
Lablet
Stack Traces - what happened?
Crashes - system under stress!

8. Security Metrics-Driven Evaluation,
Design, Development, & Deployment
Science of Security
Lablet

9. Security Metrics-Driven Evaluation,
Design, Development, & Deployment
Science of Security
Lablet
Catalog all code that appears on stack traces

10. Security Metrics-Driven Evaluation,
Design, Development, & Deployment
Science of Security
Lablet
[1] C. Theisen, K. Herzig, P. Morrison, B. Murphy, and L. Williams, “Approximating Attack Surfaces with Stack Traces,” in Companion
Proceedings of the 37th International Conference on Software Engineering, 2015
Windows 8 [1] User Crashes
%binaries 48.4%
%vulnerabilities 94.6%
Stack traces highlighted where
security vulnerabilities were.

11. Security Metrics-Driven Evaluation,
Design, Development, & Deployment
Science of Security
Lablet
Mozilla Firefox User Crashes
%files 8.4%
%vulnerabilities 72.1%
Stack traces highlighted where
security vulnerabilities were.

12. Security Metrics-Driven Evaluation,
Design, Development, & Deployment
Science of Security
Lablet
More stack traces, less files, higher flaw density!
Lose coverage as you increase stack trace cutoff
Priority: Bottom up
Files Flaws %Files %Vuln
>= 1 4998 282 8.4% 72.1%
>= 30 1853 210 3.1% 53.7%
>= 140 969 162 1.6% 41.4%
All 59437 391 - -

13. Security Metrics-Driven Evaluation,
Design, Development, & Deployment
Science of Security
Lablet

14. Security Metrics-Driven Evaluation,
Design, Development, & Deployment
Science of Security
Lablet

15. Security Metrics-Driven Evaluation,
Design, Development, & Deployment
Science of Security
Lablet

16. Security Metrics-Driven Evaluation,
Design, Development, & Deployment
Science of Security
Lablet

17. Security Metrics-Driven Evaluation,
Design, Development, & Deployment
Science of Security
Lablet
Initial attack surface approximation
...old nodes removed, new nodes added

18. Security Metrics-Driven Evaluation,
Design, Development, & Deployment
Science of Security
Lablet
Few to Many Many to Many Many to Few
What are the security impact of
these shapes?
A A
A

19. Security Metrics-Driven Evaluation,
Design, Development, & Deployment
Science of Security
Lablet

20. Security Metrics-Driven Evaluation,
Design, Development, & Deployment
Science of Security
Lablet

21. Security Metrics-Driven Evaluation,
Design, Development, & Deployment
Science of Security
Lablet
foo!foobarDeviceQueueRequest+0x68
foo!fooDeviceSetup+0x72
foo!fooAllDone+0xA8
bar!barDeviceQueueRequest+0xB6
bar!barDeviceSetup+0x08
bar!barAllDone+0xFF
center!processAction+0x1034
center!dontDoAnything+0x1030
crtheise@ncsu.edu
@theisencr