When Good Components Go Bad

Abstract

We propose a new formal criterion for evaluating secure compilation schemes for unsafe languages, expressing end-to-end security guarantees for software components that may become compromised after encountering undefined behavior-for example, by accessing an array out of bounds. Our criterion is the first to model dynamic compromise in a system of mutually distrustful components with clearly specified privileges. It articulates how each component should be protected from all the others-in particular, from components that have encountered undefined behavior and become compromised. Each component receives secure compilation guarantees-in particular, its internal invariants are protected from compromised componentsup to the point when this component itself becomes compromised, after which we assume an attacker can take complete control and use this component's privileges to attack other components. More precisely, a secure compilation chain must ensure that a dynamically compromised component cannot break the safety properties of the system at the target level any more than an arbitrary attackercontrolled component (with the same interface and privileges, but without undefined behaviors) already could at the source level. To illustrate the model, we construct a secure compilation chain for a small unsafe language with buffers, procedures, and components, targeting a simple abstract machine with built-in compartmentalization. We give a careful proof (mostly machine-checked in Coq) that this compiler satisfies our secure compilation criterion. Finally, we show that the protection guarantees offered by the compartmentalized abstract machine can be achieved at the machine-code level using either software fault isolation or a tagbased reference monitor.

A Categorical Approach to Secure Compilation

“…A compiler from the high-level to the low-level might be insecure as it exposes source-level programs to illicit control flow. This is another important and well-documented example of failure of full abstraction [8,37,3,33].…”

Mir: Automated Quantifiable Privilege Reduction Against Dynamic Library Compromise in JavaScript

“…Formalization Prior work has developed formal frameworks for stating and proving strong isolation properties in the context of new languages or subsets of existing lan-guages [1,18,20,37,38]. MIR takes a different approach, working with an existing language and offering a quantification of privilege reduction rather than an all-or-nothing property.…”

“…Modern software development relies heavily on third-party libraries. 1 Such reliance has led to an explosion of attacks [14,29,33,34,56,68]: overprivileged code in imported libraries provides an attack vector that is exploitable long after libraries reach their end-users. Even when libraries are created and authored with the best possible intentions-i.e., are not actively malicious-their privilege can be exploited at runtime to compromise the entire application-or worse, the broader system on which the application is executing.…”

“…Inference Unfortunately, manually specifying permissions is challenging, even for security-paranoid developers. Typical challenges include (1) naming issues, such as variable aliasing, poor variable names, and non-local use, (2) library-internal code, possibly not intended for humans, and (3) continuous codebase evolution, which requires updating the specification for every code change. To address these problems, MIR analyzes name uses within a library to automatically infer permissions.…”

The high-level benefits of low-level sandboxing

“…There is existing work on formal, high-level properties of compartmentalization in the context of compilation. Juglaret et al [2016] and Abate et al [2018] investigate how a compiler can transfer properties of a compartmentalized source language application to the target language. While this work also relies on the notion of robust properties (at least superficially), it is actually complementary.…”