Researchers from the Georgia Institute of Technology College of Computing earlier this year found 11 previously undiscovered flaws in two of the most widely used Internet browsers—Google Chrome and Mozilla Firefox. Worry not, however: The flaws have long been fixed.
The security researchers developed a new cyber-security analysis method that discovered the holes buried deep in the systems. They were rewarded for their work with the Internet Defense Prize, an award presented by Facebook, in partnership with USENIX, at the 24th USENIX Security Symposium that ended Aug. 14.
Ph.D. students Byoungyoung Lee and Chengyu Song, along with Professors Taesoo Kim and Wenke Lee (pictured), received $100,000 from Facebook to continue their research to make the Internet safer.
Their research paper, “Type Casting Verification: Stopping an Emerging Attack Vector,” explores vulnerabilities in C++ programs—such as in Chrome and Firefox—that result from “bad casting” or “type confusion.” Bad casting enables an attacker to corrupt the memory in a browser so that it follows a malicious logic instead of proper instructions.
The researchers developed a new, proprietary detection tool called CAVER to catch them. CAVER is a run-time detection tool with 7.6 percent to 64.6 percent overhead on browser performance (Chrome and Firefox, respectively). The 11 vulnerabilities that Georgia Tech identified have been confirmed and fixed by vendors, USENIX said.
“It is time for the Internet community to start addressing the more difficult, deeper security problems,” Lee, a professor in the School of Computer Science, said in a press statement. “The security research community has been working on various ways to detect and fix memory safety bugs for decades, and have made progress on ‘stack overflow’ and ‘heap overflow’ bugs, but these have now become relatively easy problems.
“Our work studied the much harder and deeper bugs—in particular, ‘use-after-free’ and ‘bad casting’—and our tools discovered serious security bugs in widely used software, such as Firefox and libstdc++. We are grateful to Facebook for this recognition.”
The work was selected for Facebook’s second ever Internet Defense Prize award, which recognizes superior quality research that combines a working prototype with significant contributions to the security of the Internet, particularly in the areas of protection and defense.
The USENIX Association is the Advanced Computing Systems Association. It was founded in 1975 under the name Unix Users Group, focusing primarily on the study and development of Unix and similar systems. It has since grown into a respected organization among practitioners, developers and researchers of computer operating systems.