Source-Code Vulnerability Detection
The growing dependence of the economy and the armed forces on networked information systems has increased the importance of information security. Programming errors cause many security vulnerabilities. Popular languages like C and C++ are particularly prone to programming errors that expose systems to attack. For example, a commonly exploited vulnerability is inadequate bounds checking on C/C++ buffers. By overrunning a stack buffer, an attacker can overwrite critical system bookkeeping information and take control of a system. Other programming errors, such as null pointer dereferences, can also create vulnerabilities.
The seriousness of the problem has led to the development of a variety of tools. Some of these tools do run-time monitoring—but such tools require significant computational overhead and/or miss classes of vulnerabilities. Furthermore, run-time tools do not completely eliminate the vulnerability, so it can still be exploited through a denial-of-service attack. In contrast, source code scanning tools have the potential to completely eliminate many types of vulnerabilities, without run-time overhead.
Unfortunately, simple scanning technology is often very inaccurate in practice. This means that users must spend an inordinate amount of time on code audits. Often, the overwhelming number of potential vulnerabilities that must be investigated makes a code audit totally impractical; the audit is abandoned and the vulnerabilities remain.
Under an Air Force SBIR contract, GrammaTech is developing a solution to automatically detect vulnerabilities using advanced static analysis techniques. The technology has the potential to greatly increase the accuracy of automatic vulnerability detection, drastically reducing the amount of manual source code analysis required. Furthermore, the remaining manual investigation will be greatly simplified by GrammaTech’s program understanding tool, CodeSurfer. If this project is successful, the technology will enable programmers to rapidly identify and fix vulnerabilities before applications are deployed.