syssec_red_book

4. Software Vulnerabilitiescations [91, 106, 342]. Also, many academic efforts aim at applying securityconcepts from operating systems to the web platform [198, 332, 369, 389, 390].4.6 Research GapsAs software vulnerabilities are the primary source of security breaches, the useof software hardening and exploit mitigation techniques is very important, asthey can offer instant and effective protection against current and future threats.However, the runtime overhead that many of these mechanisms impose, andthe deployment complexity of others, often prevent their widespread adoption.Furthermore, not all software developers harden the software they write, sourcecode is not available for commercial applications, and determined attackershave been constantly bypassing security measures [82, 101, 114, 159, 304].For instance, although address space randomization is an effective countermeasureagainst code-reuse attacks, its effectiveness is hindered by code segmentsleft in static locations [186, 224], while, depending on the randomizationentropy, it might be possible to circumvent it using brute-force guessing [347].Even if all the code segments of a process are fully randomized, vulnerabilitiesthat allow the leakage of memory contents can enable the calculation of thebase address of a DLL at runtime [256, 346, 386]. The above is indicative ofa constantly recurring pattern of exploit mitigations that require significanteffort to be deployed and adopted, only to be bypassed by a more sophisticatedor alternative exploitation technique later on.Another important issue is the reliance on “remedy” methods that removespecific software vulnerabilities after they have been exposed (e.g., throughsoftware patches and automated operating system updates), or provide somemitigation by disinfecting infected hosts (e.g., through the use of virus scanners).Although such methods are very important for keeping systems in goodhealth and up to date with the latest security fixes, they cannot protect againstattacks that exploit previously unknown vulnerabilities. In such cases, therelevant patches or signatures provided by vendors to fix new security flaws ordetect new malware usually come late, as their generation relies on significant,time-consuming human intervention [350]. Furthermore, administrators aresometimes reluctant to use automated patch installation systems, as they firstneed to verify through extensive testing that the new patches will not introduceany stability problems [333].4.7 Example ProblemsA few indicative issues for which existing solutions still do not provide asatisfactory level of protection include:Memory corruption vulnerabilities: despite numerous approaches, from programminglanguage and compiler level improvements to operating sys-32