Triggerflow: Regression Testing by Advanced Execution Path Inspection

Iaroslav Gridin, Cesar Pereida García, Nicola Tuveri, Billy Bob Brumley

Tutkimustuotos: KonferenssiartikkeliScientificvertaisarvioitu

4 Sitaatiot (Scopus)


Cryptographic libraries often feature multiple implementations of primitives to meet both the security needs of handling private information and the performance requirements of modern services when the handled information is public. OpenSSL, the de-facto standard free and open source cryptographic library, includes mechanisms to differentiate the confidential data and its control flow, including run-time flags, designed for hardening against timing side-channels, but repeatedly accidentally mishandled in the past. To analyze and prevent these accidents, we introduce Triggerflow, a tool for tracking execution paths that, assisted by source annotations, dynamically analyzes the binary through the debugger. We validate this approach with case studies demonstrating how adopting our method in the development pipeline would have promptly detected such accidents. We further show-case the value of the tooling by presenting two novel discoveries facilitated by Triggerflow: one leak and one defect.

OtsikkoDetection of Intrusions and Malware, and Vulnerability Assessment - 16th International Conference, DIMVA 2019, Proceedings
ToimittajatClémentine Maurice, Giorgio Giacinto, Roberto Perdisci, Magnus Almgren, Roberto Perdisci
KustantajaSpringer Verlag
ISBN (painettu)9783030220372
DOI - pysyväislinkit
TilaJulkaistu - 2019
OKM-julkaisutyyppiA4 Artikkeli konferenssijulkaisussa
TapahtumaInternational Conference on Detection of Intrusions and Malware, and Vulnerability Assessment - Gothenburg, Ruotsi
Kesto: 19 kesäk. 201920 kesäk. 2019


NimiLecture Notes in Computer Science
ISSN (painettu)0302-9743
ISSN (elektroninen)1611-3349


ConferenceInternational Conference on Detection of Intrusions and Malware, and Vulnerability Assessment


  • Jufo-taso 1

!!ASJC Scopus subject areas

  • Theoretical Computer Science
  • Yleinen tietojenkäsittelytiede


Sukella tutkimusaiheisiin 'Triggerflow: Regression Testing by Advanced Execution Path Inspection'. Ne muodostavat yhdessä ainutlaatuisen sormenjäljen.

Siteeraa tätä