Scargos: Towards automatic vulnerability distribution

Recent work has suggested automated approaches to vulnerability distribution, but their usage has been limited to local networks and memory corruption detection techniques and has precluded custom vulnerability response processes. We present Scargos, a novel approach to automate the distribution and verification of vulnerabilities across the internet, while allowing for automatic, custom countermeasures without the need to trust a central authority. By leveraging collaborative detection, vulnerability reports can be contributed by anybody and are announced to an open network by using packet-based self-certifying alerts (SCA), which are a proof of the existence of a vulnerability by capturing the original, unmodified attack. We show that our approach allows for detection of previously unknown attacks, while an entire life cycle including distribution and verification is achieved on average in under 2 seconds.

• Publication year

  2015

• Venue

  International Conference on E-Business and Telecommunication Networks

• Publication date

  2015-07-20

• Fields of study

  Computer Science

• Identifiers
  DOI 10.5220/0005566203690376
• External record

  Open on Semantic Scholar

• Source metadata

  Semantic Scholar

• No claims are published for this paper.

• No concepts are published for this paper.

• Before we knew it: an empirical study of zero-day attacks in the real world

  2012cited by this paper
• Minemu: The World's Fastest Taint Tracker

  2011influential reference
• Experiences and Observations from the NoAH Infrastructure

  2010cited by this paper
• Experiences with the NoAH Honeynet Testbed to Detect new Internet Worms

  2009cited by this paper
• FlexiTaint: A programmable accelerator for dynamic taint propagation

  2008influential reference
• Dytan: a generic dynamic taint analysis framework

  2007influential reference
• Toward Automated Dynamic Malware Analysis Using CWSandbox

  2007cited by this paper
• Argos: an emulator for fingerprinting zero-day attacks for advertised honeypots with automatic signature generation

  2006cited by this paper
• Protocol-Independent Adaptive Replay of Application Dialog

  2006influential reference
• Vigilante: end-to-end containment of internet worms

  2005influential reference
• Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software, Network and Distributed System Security Symposium Conference Proceedings : 2005

  2005influential reference
• The Blaster worm: then and now

  2005cited by this paper
• Can we contain Internet worms

  2004cited by this paper
• Minos: Control Data Attack Prevention Orthogonal to Memory Model

  2004cited by this paper
• Secure program execution via dynamic information flow tracking

  2004cited by this paper
• Honeycomb

  2004cited by this paper

• No citing papers are available for this paper.