You are here

LeastProtocol: Minimizing Attack Surface by Removing Unwanted Protocol Features

Award Information
Agency: Department of Defense
Branch: Navy
Contract: N68335-18-C-0391
Agency Tracking Number: N18A-018-0091
Amount: $124,739.00
Phase: Phase I
Program: STTR
Solicitation Topic Code: N18A-T018
Solicitation Number: 2018.0
Solicitation Year: 2018
Award Year: 2018
Award Start Date (Proposal Award Date): 2018-06-04
Award End Date (Contract End Date): 2018-12-04
Small Business Information
228 Park Ave S #80688
New York, NY 10003
United States
DUNS: 078801536
HUBZone Owned: No
Woman Owned: No
Socially and Economically Disadvantaged: No
Principal Investigator
 Artem Dinaburg
 (814) 222-0199
Business Contact
 Lauren Pearl
Phone: (207) 632-7068
Research Institution
 NYU Tandon School of Engineering
 Dr. Brendan Dolan-Gavitt
6 MetroTech Center
Brooklyn, NY 11201
United States

 (617) 913-9060
 Nonprofit College or University

Standard protocols such as SSL, SSH, etc. are implemented as one-size-fits-all libraries. To maximize compatibility, these libraries implement rarely used features that increase attack surface. Examples include the SSL Heart Beat feature (HeartBleed) and weak SSH ciphers (LOGJAM).The Navy would like to reduce software attack surface by removing unused protocol features. Our proposal, LeastProtocol, aims to develop a means to identify and eliminate features from existing software binaries. We will base our feature removal and identification research on two techniques: monitored execution and differential slicing. Multiple research papers have demonstrated that monitored execution combined with statistical techniques can map coarse protocol features to implementation code. Differential slicing compares two program executions and identifies locations where execution differs, enabling precise feature identification.For Phase 1, we will implement a proof of concept that works on a single protocol and implementation. The protocol and implementation will be of a real, deployed protocol but limited to open source software that runs on x86 Linux. We envision LeastProtocol will accept a protocol specification, a list of features, and a program binary. The tool will output a new binary that speaks the same protocol sans unwanted features.

* Information listed above is at the time of submission. *

US Flag An Official Website of the United States Government