Open source software is the foundation of many modern software products. Over the years, developers increasingly have relied on reusable open source components for their applications. It is paramount that these open source components are secure and reliable.
The focus of this year’s intern projects reflects ISE’s general approach of tackling security issues at scale, and can be split into three main areas:
- Vulnerability research: Finding new vulnerabilities, developing infrastructure to search for known bug classes at scale, and experimenting with new detection approaches.
- Mitigation and hardening: Developing hardening approaches with the goal of fully eliminating specific vulnerability classes or mitigating their impact.
- Security education: Sharing knowledge to increase awareness among developers and to help train security engineers.
Vulnerability research
Fuzzing is a highly effective method of uncovering memory-corruption vulnerabilities in C and C++ applications. With
OSS-Fuzz, Google provides a platform for fuzzing open source software. One of this year’s intern
projects ported internal fuzz targets to OSS-Fuzz, which led to the discovery of new bugs. In this context, our interns experimented with setting up fuzzing for difficult fuzz targets such as the state machines of Memcached and Redis. Additionally, they added new fuzzers for complicated targets like
nginx,
PostgreSQL, and
Envoy, a widely used cloud-native high-performance proxy.
State-of-the-art fuzzing frameworks like
AFL,
libFuzzer, and
Honggfuzz leverage feedback such as code coverage to guide the fuzzer. Recent academic papers suggest that symbolic execution can complement existing fuzzing frameworks to find bugs that are difficult for random mutation-based fuzzers to find. Our interns evaluated the possibility of using
KLEE to augment libFuzzer and AFL. In particular, they found that adding KLEE to existing fuzzing frameworks provides benefits for fuzz targets such as sqlite and lcms. However, at this point in time, there is still work to be done before symbolic execution can be performed at scale (e.g., in
OSS-Fuzz).
In addition to finding memory-corruption vulnerabilities, fuzzing can help find logic vulnerabilities. This can be difficult as it requires understanding the semantics of the target application. One approach uses differential testing to find different behaviors in applications that are supposed to behave in the same way. One of our intern projects this summer looked into leveraging differential fuzzing to expose logic vulnerabilities and found a number of cases where YAML parsers handle edge cases differently.
Other intern projects this summer focused on the search for application-specific vulnerabilities. Our interns aimed to discover common
Google Kubernetes Engine (GKE) misconfigurations. The recently launched
GKE-Auditor, created by one of our interns, implements 18 detectors to find misconfigurations in Node isolation, role-based access control, and pod security policies. Another project implemented regression tests for the Google Compute Engine (GCE)
metadata server.
Finally, one intern project looked into improving Visual Studio Code (VSCode), a popular cross-platform code editor that is based on
Electron which combines the Chromium rendering engine and the Node.js runtime. VSCode can be vulnerable to
DOM cross-site scripting attacks. For this reason, our intern’s work centered on making VSCode
Trusted Types-compliant by using and contributing to the
static and
dynamic analysis tools to find violations. This work not only led to an improvement of
VSCode, but also of
Chromium.
Because finding all vulnerabilities is an impossible task, we always look for ways to mitigate their impact or eliminate certain vulnerability classes completely. The main focus of this year’s hardening projects were to enable security enhancements for major web frameworks and to provide sandboxing for popular libraries written in memory-unsafe languages such as C and C++.
As a result, these web security features were implemented in a number of common application frameworks, including Apache Struts [
CSP,
COOP/COEP], Apache Wicket [
Fetch Metadata,
COOP/COEP], .NET Core [
CSP], Django [
Trusted Types,
COOP], and WordPress [
Fetch Metadata,
CSP]. We're looking forward to working with open source maintainers to further develop and integrate these defenses into more popular frameworks!
Executing native code that comes from untrusted origins or processes data from untrusted sources is risky because it may be malicious or contain vulnerabilities. Sandboxing mitigates these risks by executing code in a low-privileged environment.This process often requires modifying the interfaces of third-party libraries and setting up their execution environment.
Sandboxed API is a framework to help with these tasks that is used at Google.
Our interns also worked on providing reusable sandboxes for
popular open source libraries such as curl, OpenJPEG, LoadPNG, LibUV, and libTIFF. Now, anyone who wants to use these libraries to process untrusted data can do so safely.
Capture the flag (
CTF) competitions are useful for transferring security knowledge and training security engineers. The
kCTF project provides a Kubernetes-based infrastructure which offers a hardened environment to securely deploy CTF tasks and isolate them from each other. One intern project added a
number of improvements to the documentation including enabling a version control to allow multiple authors to work on one challenge and simplifing CTF’s usage.
Follow
No comments :
Post a Comment