Ghost Patches: Fake Patches for Fake Vulnerabilities - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2017

Ghost Patches: Fake Patches for Fake Vulnerabilities

Jeffrey Avery
  • Fonction : Auteur
  • PersonId : 1023776
Eugene H. Spafford
  • Fonction : Auteur
  • PersonId : 986133

Résumé

Offensive and defensive players in the cyber security sphere constantly react to either party’s actions. This reactive approach works well for attackers but can be devastating for defenders. This approach also models the software security patching lifecycle. Patches fix security flaws, but when deployed, can be used to develop malicious exploits.To make exploit generation using patches more resource intensive, we propose inserting deception into software security patches. These ghost patches mislead attackers with deception and fix legitimate flaws in code. An adversary using ghost patches to develop exploits will be forced to use additional resources. We implement a proof of concept for ghost patches and evaluate their impact on program analysis and runtime. We find that these patches have a statistically significant impact on dynamic analysis runtime, increasing time to analyze by a factor of up to 14x, but do not have a statistically significant impact on program runtime.
Fichier principal
Vignette du fichier
449885_1_En_27_Chapter.pdf (366.47 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01648988 , version 1 (27-11-2017)

Licence

Paternité

Identifiants

Citer

Jeffrey Avery, Eugene H. Spafford. Ghost Patches: Fake Patches for Fake Vulnerabilities. 32th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), May 2017, Rome, Italy. pp.399-412, ⟨10.1007/978-3-319-58469-0_27⟩. ⟨hal-01648988⟩
333 Consultations
237 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More