Team for Research in
Ubiquitous Secure Technology

Automatic Patch-Based Exploit Generation is Possible: Techniques and Implications
David Brumley, Pongsin Poosankam, Dawn Song, Jiang Zheng

Citation
David Brumley, Pongsin Poosankam, Dawn Song, Jiang Zheng. "Automatic Patch-Based Exploit Generation is Possible: Techniques and Implications". 2008 IEEE Symposium on Security and Privacy,, April, 2008; To appear at the 2008 IEEE Symposium on Security and Privacy, Oakland, CA.

Abstract
The automatic patch-based exploit generation problem is: given a program P and a patched version of the program P', automatically generate an exploit for the potentially unknown vulnerability present in P but fixed in P'. In this paper, we propose techniques for automatic patch-based exploit generation, and show that our techniques can automatically generate exploits for vulnerable programs based upon patches provided via Windows Update.

In many cases we are able to automatically generate exploits within minutes or less. Although our techniques may not work in all cases, a fundamental tenet of security is to conservatively estimate the capabilities of attackers. Thus, our results indicate that automatic patch-based exploit generation should be considered practical. One important security implication of our results is that current patch distribution schemes which stagger patch distribution over long time periods, such as Windows Update, may allow attackers who receive the patch first to compromise the significant fraction of vulnerable hosts who have not yet received the patch. Thus, we conclude update schemes, such as Windows Update as currently implemented, can detract from overall security, and should be redesigned.

Electronic downloads

Citation formats  
  • HTML
    David Brumley, Pongsin Poosankam, Dawn Song, Jiang Zheng.
    <a
    href="http://www.truststc.org/pubs/381.html">Automatic
    Patch-Based Exploit Generation is Possible: Techniques and
    Implications</a>, 2008 IEEE Symposium on Security and
    Privacy,, April, 2008; To appear at the <a
    href="http://www.ieee-security.org/TC/SP2008/oakland08.html"
    >2008 IEEE Symposium on Security and Privacy, Oakland,
    CA</a>.
  • Plain text
    David Brumley, Pongsin Poosankam, Dawn Song, Jiang Zheng.
    "Automatic Patch-Based Exploit Generation is Possible:
    Techniques and Implications". 2008 IEEE Symposium on
    Security and Privacy,, April, 2008; To appear at the <a
    href="http://www.ieee-security.org/TC/SP2008/oakland08.html"
    >2008 IEEE Symposium on Security and Privacy, Oakland,
    CA</a>.
  • BibTeX
    @inproceedings{BrumleyPoosankamSongZheng08_AutomaticPatchBasedExploitGenerationIsPossibleTechniques,
        author = {David Brumley and Pongsin Poosankam and Dawn Song
                  and Jiang Zheng},
        title = {Automatic Patch-Based Exploit Generation is
                  Possible: Techniques and Implications},
        booktitle = {2008 IEEE Symposium on Security and Privacy,},
        month = {April},
        year = {2008},
        note = {To appear at the <a
                  href="http://www.ieee-security.org/TC/SP2008/oakland08.html"
                  >2008 IEEE Symposium on Security and Privacy,
                  Oakland, CA</a>},
        abstract = {The automatic patch-based exploit generation
                  problem is: given a program P and a patched
                  version of the program P', automatically generate
                  an exploit for the potentially unknown
                  vulnerability present in P but fixed in P'. In
                  this paper, we propose techniques for automatic
                  patch-based exploit generation, and show that our
                  techniques can automatically generate exploits for
                  vulnerable programs based upon patches provided
                  via Windows Update. <p>In many cases we are able
                  to automatically generate exploits within minutes
                  or less. Although our techniques may not work in
                  all cases, a fundamental tenet of security is to
                  conservatively estimate the capabilities of
                  attackers. Thus, our results indicate that
                  automatic patch-based exploit generation should be
                  considered practical. One important security
                  implication of our results is that current patch
                  distribution schemes which stagger patch
                  distribution over long time periods, such as
                  Windows Update, may allow attackers who receive
                  the patch first to compromise the significant
                  fraction of vulnerable hosts who have not yet
                  received the patch. Thus, we conclude update
                  schemes, such as Windows Update as currently
                  implemented, can detract from overall security,
                  and should be redesigned.},
        URL = {http://www.truststc.org/pubs/381.html}
    }
    

Posted by Christopher Brooks on 25 Apr 2008.
For additional information, see the Publications FAQ or contact webmaster at www truststc org.

Notice: This material is presented to ensure timely dissemination of scholarly and technical work. Copyright and all rights therein are retained by authors or by other copyright holders. All persons copying this information are expected to adhere to the terms and constraints invoked by each author's copyright.