Automatically generating malicious disks using symbolic execution

Proceedings - IEEE Symposium on Security and Privacy

Volumn 2006, Issue , 2006, Pages 243-257

  Yang, Junfeng ^a   Sar, Can ^a   Twohey, Paul ^a   Cadar, Cristian ^a   Engler, Dawson ^a  

^a Stanford University   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

FILE SYSTEM CODES; FILE SYSTEM IMAGES; MALICIOUS DISKS;

COMPUTER OPERATING SYSTEMS; CONSTRAINT THEORY; DATA REDUCTION; IMAGE ANALYSIS; SECURITY OF DATA;

CODES (SYMBOLS);

EID: 33751060454     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2006.7     Document Type: Conference Paper

References (37)

1. Distributing software with internet-enabled disk images, http://developer.apple.com/documentation/ DeveloperTools/Conceptual/ Soft%wareDistribution/Concepts/sd_disk_imagas.html.
2. Linspire - the world's easiest desktop linux. http://www.linspire.com.
3. The user-mode linux kernel home page. http://user-mode-limix.sourceforge. net.
4. T. Ball. A theory of predicate-complete test coverage and generation. In FMCO'2004: Symp. on Formal Methods for Components and Objects. SpringerPress, 2004.
5. T. Ball, R. Majumdar, T. Millstein, and S. K. Rajamani. Automatic predicate abstraction of C programs. In PLDI '01: Proceedings of the ACM SIGPLAN 2001 conference on Programming language design and implementation, pages 203-213. ACM Press, 2001.
6. T. Ball and S. Rajamani. Automatically validating temporal safety properties of interfaces. In SPIN 2001 Workshop on Model Checking of Software, May 2001.
7. R. S. Boyer, B. Elspas, and K. N. Levitt. Select - a formal system for testing and debugging programs by symbolic execution. ACM SIGPLAN Notices, 10(6):234-45, June 1975.
8. W. Bush, J. Pincus, and D. Sielaff. A static analyzer for finding dynamic programming errors. Software: Practice and Experience, 30(7):775-802, 2000.
9. C. Cadar and D. Engler. Execution generated test cases: How to make systems code crash itself. In Proceedings of the 12th International SPIN Workshop on Model Checking of Software, August 2005. A longer version of this paper appeared as Technical Report CSTR-2005-04, Computer Systems Laboratory, Stanford University.
10. C. Cadar, P. Twohey, V. Ganesh, and D. Engler. EXE: A system for automatically generating inputs of death using symbolic execution. Technical Report CSTR 2006-01, Stanford, 2006.
11. E. Clarke and D. Kroening. Hardware verification using ANSI-C programs as a reference. In Proceedings of ASP-DAC 2003, pages 308-311. IEEE Computer Society Press, January 2003.
12. J. Corbett, M. Dwyer, J. Hatcliff, S. Laubach, C. Pasareanu, Robby, and H. Zheng. Bandera: Extracting finite-state models from Java source code. In ICSE 2000, 2000.
13. M. Das, S. Lerner, and M. Seigle. Path-sensitive program verification in polynomial time. In Proceedings of the ACM SIGPLAN 2002 Conference on Programming Language Design and Implementation, Berlin, Germany, June 2002.
14. N. Eén and N. Sörensson. An extensible sat-solver. In E. Giunchiglia and A. Tacchella, editors, SAT, volume 2919 of Lecture Notes in Computer Science, pages 502-518. Springer, 2003.
15. The ext2/ext3 File system, http://e2fsprogs.sf.net.
16. R. Ferguson and B. Korel. The chaining approach for software test data generation. ACM Trans. Softw. Eng. Methodol., 5(1):63-86, 1996.
17. J. Foster, T. Terauchi, and A. Aiken. Flow-sensitive type qualifiers. In Proceedings of the ACM SIGPLAN 2002 Conference on Programming Language Design and Implementation, June 2002.
18. P. Godefroid. Model Checking for Programming Languages using VeriSoft. In Proceedings of the 24th ACM Symposium on Principles of Programming Languages, 1997.
19. P. Godefroid, N. Klarlund, and K. Sen. Dart: Directed automated random testing. In Proceedings of the Conference on Programming Language Design and Implementation (PLDI), Chicago, IL USA, June 2005. ACM Press.
20. A. Gotlieb, B. Botella, and M. Rueher. Automatic test data generation using constraint solving techniques. In ISSTA '98: Proceedings of the 1998 ACM SIGSOFT international symposium on Software testing and analysis, pages 53-62. ACM Press, 1998.
21. N. Gupta, A. P. Mathur, and M. L. Sofia. Automated test data generation using an iterative relaxation method. In SIGSOFT '98/FSE-6: Proceedings of the 6th A CM SIGSOFT international symposium on Foundations of software engineering, pages 231-244. ACM Press, 1998.
22. R. Hastings and B. Joyce. Purify: Fast detection of memory leaks and access errors. In Proceedings of the Winter USENIX Conference, Dec. 1992.
23. G. J. Holzmann. The model checker SPIN. Software. Engineering, 23(5):279-295, 1997.
24. The IBM Journaling File System for Linux, http://www-124.ibm.com/jfs.
25. S. Khurshid, C. S. Pasareanu, and W. Visser. Generalized symbolic execution for model checking and testing. In Proceedings of the Ninth International Conference on Tools and Algorithms for the Construction and Analysis of Systems, 2003.
26. E. Larson and T. Austin. High coverage detection of input-related security faults. In Proceedings of the 12th USENIX Security Symposium (Security 2003), August 2003.
27. Linux Test Project. http://ltp.sf.net.
28. M. Musuvathi and D. R. Engler. Model checking large network protocol implementations. In Proceedings of the First Symposium on Networked Systems Design and Implementation, 2004.
29. G. C. Necula, S. McPeak, S. Rahul, and W. Weimer. Cil: Intermediate language and tools for analysis and transformation of c programs. In Proceedings of Conference on Compilier Construction, March 2002.
30. G. Nelson and D. Oppen. Simplification by cooperating decision procedures. A CM Transactions on Programming Languages and Systems, 1(2):245-57, 1979.
31. V. Prabhakaran, L. N. Bairavasundaram, N. Agrawal, H. S. Gunawi, A. C. Arpaci-Dusseau, and R. H. Arpaci-Dusseau. Iron file systems. In SOSP '05: Proceedings of the twentieth ACM symposium on Operating systems principles, pages 206-220, New York, NY, USA, 2005. ACM Press.
32. O. Ruwase and M. S. Lam. A practical dynamic buffer overflow detector. In Proceedings of the 11th Annual Network and Distributed System Security Symposium, pages 159-169, 2004.
33. K. Sen, D. Marinov, and G. Agha. CUTE: A concolic unit testing engine for C. In 5th joint meeting of the European Software Engineering Conference and ACM SIGSOFT Symposium on the Foundations of Software Engineering (ESEC/FSE'05), Sept. 2005.
34. stress. http://weather.ou.edu/~apw/projacts/stress.
35. D. Wagner, J. Foster, E. Brewer, and A. Aiken. A first step towards automated detection of buffer overrun vulnerabilities. In The 2000 Network and Distributed Systems Security Conference. San Diego, CA, Feb. 2000.
36. Y. Xie and A. Aiken. Scalable error detection using boolean satisfiability. In POPL '05: Proceedings of the 32nd ACM SIGPLAN-SIGACT symposium on Principles of programming languages, pages 351-363, New York, NY, USA, 2005. ACM Press.
37. J. Yang, P. Twohey, D. Engler, and M. Musuvathi. Using model checking to find serious file system errors. In Proceedings of the Sixth Symposium on Operating Systems Design and Implementation, Dec. 2004.