Grant: Discovery Grants Program - Individual

Every day, we are witnessing an increasing surge of sophisticated attacks against the cyber infrastructure of corporations, governments, and individuals. These attacks are perpetrated by cyber-criminals, cyber-terrorists, and state-sponsored actors. Indeed, in 2021, the number of zero-day attacks nearly doubled compared to the previous year, and the number of newly reported vulnerabilities hit an all-time high, surpassing 20,000 for the first time. Each vulnerability can be exploited to execute millions of attacks. For example, the remote code execution vulnerability was exploited in more than 33 million incidents from February to April 2022. Furthermore, vulnerability exploitation enables the execution of software supply chain attacks. For instance, 72 hours after the reporting of the Log4j vulnerability in 2021, more than 800,000 exploitation attempts were detected, and among these, attempts by state-sponsored actors, which tried to execute software supply chain attacks. Supply chain attacks can have very damaging consequences, especially in the currently tense geopolitical context, as they can be used to disrupt and damage critical infrastructure. In this regard, the notorious SolarWinds supply chain attack affected over 18,000 systems spanning multiple government agencies as well as various corporations, including 15 critical infrastructure corporations. The long-term recovery cost from such an attack is estimated to reach over 100 billion dollars. Since modern systems typically integrate many components from various providers, there is a persistent risk of importing multiple known and unknown vulnerabilities. These can result from: (i) unintended software development artifacts, (ii) external attackers injecting on-purpose vulnerabilities into open-source packages, and (iii) insiders intentionally injecting vulnerabilities in developed software. In this setting, detecting and mitigating vulnerabilities and supply chain threats represent a significant problem that requires an advanced, automated, accurate, and scalable tradecraft to address it. As the source code may not always be available, we envision examining executable binaries and firmware images. The primary goal of this research is to advance the state-of-the-art in terms of vulnerability research and supply chain security. To this end, we aim to establish a synergy between binary code representation, advanced static analysis, machine learning, and fuzzing to: (1) Investigate binary code vulnerabilities and supply chain attacks to identify their fingerprints and explore their generalization toward characterizing unknown vulnerabilities that lead to zero-day attacks; (2) Design and implement accurate and scalable static analyses to detect vulnerabilities and supply chain attacks; (3) Devise offensive techniques, such as fuzzing, to stress-test potentially vulnerable locations; (4) Investigate vulnerability mitigation through code rewriting and automatic patching.