An empirical study of vulnerabilities in edge frameworks to support security testing improvement

Abstract

Edge computing is a distributed computing paradigm aiming at ensuring low latency in modern data intensive applications (e.g., video streaming and IoT). It consists of deploying computation and storage nodes close to the end-users. Unfortunately, being distributed and close to end-users, Edge systems have a wider attack surface (e.g., they may be physically reachable) and are more complex to update than other types of systems (e.g., Cloud systems) thus requiring thorough security testing activities, possibly tailored to be cost-effective. To support the development of effective and automated Edge security testing solutions, we conducted an empirical study of vulnerabilities affecting Edge frameworks. The study is driven by eight research questions that aim to determine what test triggers, test harnesses, test oracles, and input types should be considered when defining new security testing approaches dedicated to Edge systems. preconditions and inputs leading to a successful exploit, the security properties being violated, the most frequent vulnerability types, the software behaviours and developer mistakes associated to these vulnerabilities, and the severity of Edge vulnerabilities. We have inspected 147 vulnerabilities of four popular Edge frameworks. Our findings indicate that vulnerabilities slip through the testing process because of the complexity of the Edge features. Indeed, they can’t be exhaustively tested in-house because of the large number of combinations of inputs, outputs, and interfaces to be tested. Since we observed that most of the vulnerabilities do not affect the system integrity and, further, only one action (e.g., requesting a URL) is sufficient to exploit a vulnerability

HyperPUT: generating synthetic faulty programs to challenge bug-finding tools

“…Besides being commonly used as targets of fuzzing techniques (Candea and Godefroid 2019 ; Malik and Pastore 2023 ; Payer 2019 ), assertions can model a broad range of safety properties (Lamport 1977 ). These include memory-related errors (e.g., violating corresponds to a null pointer dereferencing error), as well as (partial) correctness errors (e.g., violating corresponds to a postcondition error), but exclude liveness properties such as termination.…”

Formal Methods and Validation Techniques for Ensuring Automotive Systems Security

“…The utilization of specialized frameworks that provide tools and methodologies for conducting comprehensive security testing is crucial [194][195][196]. These frameworks encompass a range of techniques, including vulnerability scanning, code analysis, and security assessment [196][197][198].…”

“…The utilization of specialized frameworks that provide tools and methodologies for conducting comprehensive security testing is crucial [194][195][196]. These frameworks encompass a range of techniques, including vulnerability scanning, code analysis, and security assessment [196][197][198]. They assist in automating security testing processes, identifying security weaknesses, and ensuring adherence to established security standards [199][200][201].…”