Name:

    Kevin Flansburg

Advisor:

    Taesoo Kim

Committee Members:

    Polo Chau

    Manos Antonakakis

Date and Time:

    November 23, 2015 11:00 AM

Location:

    Klaus 3100

Title:

    A Framework for Reproducible Exploit Testing Environments

Abstract:

To demonstrate working exploits or vulnerabilities, people often share
their findings as a form of proof-of-concept (PoC) prototype. Such
practices are particularly useful to learn about real vulnerabilities
and state-of-the-art exploitation techniques.  Unfortunately, the shared
PoC exploits are seldom reproducible; in part because they are often not
thoroughly tested, but largely because authors lack a formal way to
specify the tested environment or its dependencies.  Although exploit
writers attempt to overcome such problems by describing their
dependencies or testing environments using comments, this informal way
of sharing PoC exploits makes it hard for exploit authors to achieve the
original goal of demonstration.  More seriously, these non- or
hard-to-reproduce PoC exploits have limited potential to be utilized for
other useful research purposes such as penetration testing, or in
benchmark suites to evaluate defense mechanisms.

In this paper, we present XShop, a framework and infrastructure to
describe environments and dependencies for exploits in a formal way, and
to automatically resolve these constraints and construct an isolated
environment for development, testing, and to share with the community.
We show how XShop's flexible design enables new possibilities for
utilizing these reproducible exploits in five practical use cases: as a
security benchmark suite, in pen-testing, for large scale vulnerability
analysis, as a shared development environment, and for regression
testing. We design and implement such applications by extending the
XShop framework and demonstrate its effectiveness with twelve real
exploits against well-known bugs that include GHOST, Shellshock, and
Heartbleed.  We believe that the proposed practice not only brings
immediate incentives to exploit authors but also has the potential to be
grown as a community-wide knowledge base.