<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000'>Soumyadeep Ghosh will present his research seminar/general exam on <br>Monday April 23 at 2PM in Room 402. The members of his committee <br>are: David August (advisor), Andrew Appel, and Margaret Martonosi.<br>Everyone is invited to attend his talk and those faculty wishing to remain <br>for the oral exam following are welcome to do so. His abstract and <br>reading list follow below.<br><div style="color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><div><div><div><span class="Apple-style-span" style="orphans: 2; text-align: -webkit-auto; text-indent: 0px; widows: 2; -webkit-text-decorations-in-effect: none; ">--<br><br><div>Title: Region-based Type Enforcement for C</div><div><br></div><div>Abstract:</div><div><br></div><div>Attacks that violate memory safety to corrupt program state or gain</div><div>control over the execution of vulnerable programs form a large class of</div><div>security threats. In a type-unsafe language such as C, different</div><div>vulnerabilities due to lack of type enforcement (for e.g. buffer</div><div>overflows, format string attacks, etc.) can lead to program crash,</div><div>leakage of privileged information, and malicious code injection. These</div><div>vulnerabilities stem from exploitation of facts that are undefined in</div><div>the C standard. Existing bounds checking techniques cannot prevent</div><div>attacks where bounds violations do not occur. Other techniques provide</div><div>type enforcement, but they are either limited by incomplete code</div><div>coverage or require non-trivial changes to the source code. In this</div><div>work, we present a dynamic type enforcement system for C, that prevents</div><div>memory safety errors by detecting program behavior undefined by the C</div><div>standard. We evaluate the performance and applicability of our type</div><div>enforcement system on a number of real-world applications with reported</div><div>vulnerabilities. </div><div><br></div><div>Reading List:</div><div><br></div><div>Textbooks:</div><div>[1] A. W. Appel. Modern Compiler Implementation in C. Cambridge</div><div>University Press, 1998.</div><div><br></div><div>[2] J. L. Hennessy and D. A. Patterson. Computer Architecture: A</div><div>Quantitative Approach, Fourth Edition. Morgan Kaufmann, 2006.</div><div><br></div><div>Papers:</div><div><br></div><div>[1] P. Akritidis, C. Cadar, C. Raiciu, M. Costa, and M. Castro.</div><div>Preventing memory error exploits with WIT. In Proceedings of the 2008</div><div>IEEE Symposium on Security and Privacy, 2008.</div><div><br></div><div>[2] D. Avots, M. Dalton, V. B. Livshits, and M. S. Lam. Improving</div><div>software security with a C pointer analysis. In Proceedings of the 27th</div><div>International Conference on Software Engineering, 2005.</div><div><br></div><div>[3] S. Chen, J. Xu, N. Nakka, Z. Kalbarczyk, and R. K. Iyer. Defeating</div><div>memory corruption attacks via pointer taintedness detection. In</div><div>Proceedings of the 2005 International Conference on Dependable Systems</div><div>and Networks, 2005. </div><div><br></div><div>[4] S. Chen, J. Xu, E. C. Sezer, P. Gauriar, and R. K. Iyer.</div><div>Non-control-data attacks are realistic threats. In Proceedings of the</div><div>14th conference on USENIX Security Symposium, 2005.</div><div><br></div><div>[5] D. Dhurjati, S. Kowshik, V. Adve, and C. Lattner. Memory safety</div><div>without runtime checks or garbage collection. In Proceedings of the 2003</div><div>ACM SIGPLAN Conference on Language, Compiler, and Tool for Embedded</div><div>Systems, 2003.</div><div><br></div><div>[6] M. Hind. Pointer analysis: Haven’t we solved this problem yet? In</div><div>2001 ACM SIGPLAN-SIGSOFT Workshop on Program Analysis for Software Tools</div><div>and Engineering (PASTE’01), 2001.</div><div><br></div><div>[7] T. Jim, J. G. Morrisett, D. Grossman, M. W. Hicks, J. Cheney, and</div><div>Y. Wang. Cyclone: A safe dialect of C. In Proceedings of the General</div><div>Track of the annual conference on USENIX Annual Technical Conference,</div><div>2002.</div><div><br></div><div>[8] S. Nagarakatte, J. Zhao, M. M. Martin, and S. Zdancewic. Softbound:</div><div>highly compatible and complete spatial memory safety for C. In</div><div>Proceedings of the 2009 ACM SIGPLAN Conference on Programming Language</div><div>Design and Implementation, 2009.</div><div><br></div><div>[9] G. C. Necula, S. McPeak, and W. Weimer. CCured: type-safe</div><div>retrofitting of legacy code. In Proceedings of the 29th ACM</div><div>SIGPLAN-SIGACT symposium on Principles of programming languages, 2002.</div><div><br></div><div>[10] C. Schlesinger, K. Pattabiraman, N. Swamy, D. Walker, and B. Zorn.</div><div>Yarra: An extension to C for data integrity and partial safety. In</div><div>Proceedings of the Computer Security Foundations Forum (CSF), 2011. </div><div style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><br></div><br><br></span></div><div>
</div>
<br></div></div><div><b><br></b></div></div><br></div></body></html>